Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running Fedora Core 13 and I have vsftpd (vsftpd-2.2.2-7.fc13.x86_64) up and running, and I can login, but it keeps hanging:

$ ftp xxx.local
Connected to xxx.local.
220 (vsFTPd 2.2.2)
Name (xxx.local:xxx): xxx
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.

It hangs for a while, then returns...

421 Service not available, remote server timed out. Connection closed.

Here is my vsftpd.conf:

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=NO
listen=YES
pam_service_name=vsftpd
userlist_enable=YES
userlist_deny=NO
tcp_wrappers=YES

Here is my IPTABLES:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.0.0/24 -m state --state NEW -m tcp -p tcp --dport 20 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -m state --state NEW -m tcp -p tcp --dport 5150 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

I also have the following added to my iptables-config:

IPTABLES_MODULES="nf_conntrack_ftp"

Any ideas as to why it is hanging at that point?

share|improve this question

1 Answer 1

Try using lftp to get a better debugging set of output as a client and paste it here; for instance:

$ lftp -u <username> localhost
Password: 
lftp user@localhost:~> debug 5  
lftp user@localhost:~> ls
---- Connecting to localhost (127.0.0.1) port 21
<--- 220 (vsFTPd 2.2.2)          
---> FEAT
<--- 211-Features:
<---  EPRT
<---  EPSV
<---  MDTM
<---  PASV
<---  REST STREAM
<---  SIZE
<---  TVFS
<---  UTF8
<--- 211 End
---> OPTS UTF8 ON
<--- 200 Always in UTF8 mode.
---> USER user
<--- 331 Please specify the password.
---> PASS XXXX
<--- 230 Login successful.       
---> PWD
<--- 257 "/home/user"
---> PASV
<--- 227 Entering Passive Mode (127,0,0,1,159,49).
---- Connecting data socket to (127.0.0.1) port 40753
---> LIST
<--- 150 Here comes the directory listing.
<--- 226 Directory send OK.

We need to see better client side debugging to figure out where the connection is hanging; most likely it's passive ports. I don't trust the iptables module, instead in the vsftpd.conf set the min and max ports:

ftp_data_port=20
listen_port=21
pasv_min_port=64123
pasv_max_port=64321

...then open that range in your iptables. I prefer to be explicit rather than implicit when dealing with ports.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.