12

Why do I get kicked out of a FTP session once I run a command? It seems that once I successfully login into a server is get the following after running a command such as "ls" (I've enclosed the error portion in the "[ERROR]" tags):

allen92@allen92-VirtualBox:~/Videos$ ftp -n ftp.FreeBSD.org
Connected to ftp.FreeBSD.org.
220 beastie.tdk.net FTP server (Version 6.00LS) ready.
ftp> user
(username) anonymous
331 Guest login ok, send your email address as password.
Password: 
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
[ERROR]
421 Service not available, remote server has closed connection
[ERROR]
ftp> 

This seems to happen on any remote FTP server. Everything works fine when I login onto the local machine and run FTP commands. If in fact the "421" error is a generic error, is there any way to find out the source of the problem? Any leads on this would be appreciated. I haven't been able to find any support on this particular issue. Anybody with an similar problem please share your thoughts.

NOTE: I have VSFTPD installed.

13

There is most likely a NAT-firewall between you and the servers showing the symptom. (NAT-firewalls hide a whole network behind a single IP-number).

The problem is that ftp wants to send the data resulting from the command in a new, separate TCP/IP connection and that cannot go through the firewall because it needs to go from the server to you, and you are hidden behind the firewall which has no clue that the data is intended for your machine. When the FTP protocol was designed, many modern devices like the NAT-router (which became necessary when there were more devices than available IP-addresses) had not been invented yet.

Use the pasv command (may be called something different in your client) to change to a passive connection where data connections go from you to the server.

See http://slacksite.com/other/ftp.html for a more detailed explanation.

  • Thanks, a lot. In the case of VSFTPD, the command for entering passive mode is "passive". That seems to be working for now. I think this whole situation has to do with me running the Linux install on a virtual machine and its not-so-standard settings. I am going to find out how enable "passive" mode by default. Once I find out I'll post for anybody interested. – AllenD Sep 14 '13 at 7:12
  • It is not uncommon that the default network for virtual machines is some kind of NAT, so the machine is not exposed. For VirtualBox changing to Bridged makes it show up like any other machine on the local network. – Thorbjørn Ravn Andersen Dec 5 '17 at 19:05
-1

Add or enable this line in /etc/vsftpd.conf

seccomp_sandbox=NO

  • This answer solved my issue but I still have questions about this undocumented configuration. – A1rPun Nov 11 '18 at 13:46
  • Why seccomp_sandbox=NO is the right answer under certain circumstances is documented in the /etc/vsftpd.conf file: ``` # seccomp_sanbox add an aditional security layer limiting the number of a # syscalls can be performed via vsftpd. However it might happen that a # whitelist don't allow a legitimate call (usually indirectly triggered by # third-party library like pam, or openssl) and the process is being killed by kernel. # # Therefor if your server dies on common situations (file download, upload), # uncomment following line and don't forget to open bug at # bugzilla.novell.com se – GSchukat Apr 17 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.