We have a Java process which contains an embedded FTP server which I'd like to run on a RHEL5 machine. I don't want to run the process as root and I don't want clients to have to specify a port when making a connection. It seems like I should be able to configure vsftpd to listen on an alternative port (e.g. 20000) and then configure ipchains to forward all traffic on port 21 to 20000. I think specifically I need to:
- Configure vsftpd to listen on port 20000
ip_conntrack_ftpto forward traffic from port 21 to 20000
So my initial question is does this seem like a reasonable approach?
To accomplish step 1 I've modified my vsftpd.conf to have the following line:
I can then restart vsftpd and verify it is listening on 20000 by doing the following:
> ftp tstweb1 20000 Connected to tstweb1.pulseenergy.com. 220 (vsFTPd 2.0.5) 530 Please login with USER and PASS. 530 Please login with USER and PASS. KERBEROS_V4 rejected as an authentication type Name (tstweb1:cclark):
And I proceed to login without issue. Step 1 complete.
As for step 2, I don't see the module loaded:
> /sbin/lsmod | grep ftp >
So I try to load it with the proper port forwarding information:
> /sbin/modprobe ip_conntrack_ftp ports=21,20000
And I verify it has loaded:
> /sbin/lsmod | grep ftp ip_conntrack_ftp 41489 0 ip_conntrack 91109 3 ip_conntrack_ftp,iptable_nat,ip_nat
But I get a connection refused when I try to use it:
> ftp tstweb1 ftp: connect: Connection refused
I know FTP is a complex protocol with active and passive modes and communication on multiple ports but I was under the impression the
ip_conntrack_ftp module would hide a lot of that for me. Do I need to write some specific iptables rules in addition?