Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am in the process of setting up my home FTP with virtual users on a CentOS 6.0. I am using the following guide.

I was able to run the first script vsftpd_virtual_config_withTLS.sh successfully and configured it accordingly.

I then run the add user script vsftpd_virtualuser_add.sh successfully and configure a virtual user.

I then run the following commands to allow Iptables to allow connections over port 21

sudo iptables -I INPUT -p tcp --dport 21 -j ACCEPT
sudo iptables -I OUTPUT -p udp --dport 21 -j ACCEPT
sudo /sbin/service iptables save
sudo /sbin/service iptables restart

I then restart the vsftpd server. I then try to connect to my newly configured ftp server (Encryption: Require explicit FTP over TLS) with Filezilla 3.5.0 (which uses GnuTLS: 2.10.5) and I get the following error when connecting.

Error:  GnuTLS error -53: Error in the push function.

I have tried other ftp clients such as Fireftp and it still fails to list the directory listing. I have also ensured that vsftpd, gnutls, and filezilla are all the latest version. I am however very unfamiliar with TLS so any help with this situation would be greatly appreciated. Thanks!

EDIT: Posting my vsftpd.conf file as requested

anon_world_readable_only=NO
anonymous_enable=NO
chroot_local_user=YES
guest_enable=NO
guest_username=ftp
hide_ids=YES
listen=YES
listen_address=[redacted]
local_enable=YES
max_clients=100
max_per_ip=2
nopriv_user=ftp
pam_service_name=ftp
pasv_max_port=65535
pasv_min_port=64000
session_support=NO
use_localtime=YES
user_config_dir=/etc/vsftpd/users
userlist_enable=YES
userlist_file=/etc/vsftpd/denied_users
xferlog_enable=YES
anon_umask=027
local_umask=027
async_abor_enable=YES
connect_from_port_20=YES
dirlist_enable=NO
download_enable=NO
#
# TLS Configuration
#
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=NO
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
rsa_cert_file=/etc/pki/tls/certs/vsftpd.pem

EDIT: After having trying quanta suggestion I am getting at least a failed directory listing in Filezilla. Below is my output from Filezilla.

Status: Connecting to [redacted]...
Status: Connection established, waiting for welcome message...
Response:   220 (vsFTPd 2.2.2)
Command:    AUTH TLS
Response:   234 Proceed with negotiation.
Status: Initializing TLS...
Status: Verifying certificate...
Command:    USER [redacted]
Status: TLS/SSL connection established.
Response:   331 Please specify the password.
Command:    PASS *********
Response:   230 Login successful.
Command:    SYST
Response:   215 UNIX Type: L8
Command:    FEAT
Response:   211-Features:
Response:    AUTH SSL
Response:    AUTH TLS
Response:    EPRT
Response:    EPSV
Response:    MDTM
Response:    PASV
Response:    PBSZ
Response:    PROT
Response:    REST STREAM
Response:    SIZE
Response:    TVFS
Response:    UTF8
Response:   211 End
Command:    OPTS UTF8 ON
Response:   200 Always in UTF8 mode.
Command:    PBSZ 0
Response:   200 PBSZ set to 0.
Command:    PROT P
Response:   200 PROT now Private.
Status: Connected
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/"
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PASV
Response:   227 Entering Passive Mode (192,168,1,10,251,213).
Command:    LIST
Error:  GnuTLS error -53: Error in the push function.
Error:  Connection timed out
Error:  Failed to retrieve directory listing

EDIT: Error seems to be with iptables. My iptables config is listed below.

# Generated by iptables-save v1.4.7 on Wed Aug 24 00:29:05 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [157:20225]
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 60021 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2011 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m tcp --dport 2011 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 1024:65535 --dport 64000:65535 -m state --state ESTABLISHED -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -p tcp -m tcp --sport 20 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 21 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 21 -j ACCEPT
-A OUTPUT -p udp -m udp --sport 60021 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 2011 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 2011 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 20 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 64000:65535 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Aug 24 00:29:05 201

Edit: When run the query that quanta suggested below I get the following

grep: /usr/src/kernels/2.6.32-71.29.1.el6.x86_64-x86_64/.config: No such file or directory

So ip_conntrack_ftp seems not to be loading correctly and I am not sure how to rectify this.

share|improve this question
    
Please post your vsftpd.conf file? –  quanta Aug 23 '11 at 2:14
    
added the vsftpd.conf file –  Nic Young Aug 23 '11 at 17:19

1 Answer 1

up vote 0 down vote accepted
connect_from_port_20=YES

Do you want to run vsftpd in active mode? If so, add the following iptables rule and try again:

iptables -A OUTPUT -p tcp --sport 20 -j ACCEPT

For the passive mode, try this:

# modprobe ip_conntrack_ftp

and:

iptables -A INPUT -p tcp --sport 1024: --dport 64000:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 64000:65535 --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this answer
    
quanta, I have tried your suggestion and it is still not working. I am however getting a failed directory listing. I haved added my output I receive from filezilla. –  Nic Young Aug 24 '11 at 4:27
    
Please check out my above suggestion. –  quanta Aug 24 '11 at 5:18
    
sadly I seem to be getting the same error. Could this be an IPtables specific issue or could it have something to do with the certificate? –  Nic Young Aug 24 '11 at 6:08
    
As a temporary, you can turn of the iptables to see what happens. –  quanta Aug 24 '11 at 6:09
    
Well that seems to be the problem. Iptables is disabled and I am able to connect and list the directory. I have added my iptables config, I am not sure what is wrong with it. –  Nic Young Aug 24 '11 at 6:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.