What's the impact of setting pasv_min_port=pasv_max_port in vsftpd?

Question

I am installing an FTP server vsftpd following this tutorial, which can be summarized as:

apt-get install vsftpd Then in Config file /etc/vsftpd.conf uncomment the lines local_umask=022 and write_enable=YES, and at the end, add:

lock_upload_files=NO 
chroot_local_user=YES
force_dot_files=YES

and change the following (feel free to change 8745 with whichever port you prefer):

pasv_enable=YES 
pasv_min_port=8745
pasv_max_port=8745

What's the impact of setting pasv_min_port to be the same port as pasv_max_port in vsftpd? E.g., does it any impact on the performance?

Answer 1

TL; DR: The impact is that your FTP server will only support 1 transfer at a time. Definitely a no-no for FTP servers meant to serve concurrent clients. It might be ok for a private FTP server used by only one person at a time, as long as that person is happy with not being allowed multiple simultaneous transfers.

---

The FTP protocol (regardless of the server software used, be it vsftpd or others) works in a dual-channel approach.

The first channel, bound to the well-known port 21, functions as "control channel". This channel is used for sending requests to the server and receiving replies from it. Requests are of the kind of commands, such as "list this directory" or "send this file" or also "tell me the features you support" etc. Replies are of the kind related to status conditions and short, textual, easily parseable answers.

The second channel is used for bulk transfers such as the stream of the actual data making up a file sent or received, or the stream of data making up a directory listing. In the most typical usage scenario, such second channel is established on demand and lasts for only one operation, i.e. each single file transferred (or directory listing) establishes a new channel (TCP connection) from scratch between the client and the server. All long, the first channel (the one on port 21) is kept open for control purposes.

In FTP Passive mode, the passive ports are used by the server to select one port to listen on while waiting for such ephemeral second channel (TCP connection) from the client that requested the file-transfer/directory-listing. Because the second channel bears no authentication/identification, nor any kind of "cookie", the server can only make an association between the port it has chosen and a specific operation that has been requested. That is: each second channel is tightly bound to a precise file or a specific directory requested by a specific client.

Consequently, if you provide the server with only one port to choose among for second channels, the server can support only one "bulk transfer" at a time. It doesn't matter how many clients are currently connected to the "control channel" on port 21: only one of those clients would transfer a file or list a directory at any given moment, and other clients requesting a transfer on that same moment would instead receive a reply from the server notifying a temporary error.

In other words, using only one passive port is essentially like a big mutually-exclusive lock for FTP transfers insisting on the same FTP server.