1

I'm trying to add ftp service to firewalld, and every time I run firewall-cmd --add-service=ftp (this is with out the permanent flag) I get Error: COMMAND_FAILED.
If I run firewall-cmd --permanent --add-service=ftp (this is with the permanent flag), it returns success.

However after I reload the service I can't connect via ssh until I disable firewalld over rescue mode.

I'm not trying to open ssh's port. I'm just stating that I lose access to the server after running firewall-cmd --permanent --add-service=ftp and then reload with firewall-cmd --reload.

3
  • What makes you think --add-service=ftp for port 21 would open port 22 used by SSH? Jun 11, 2017 at 10:20
  • that's not at all what im trying to do, im saying after i run firewall-cmd --permanent --add-service=ftp and reload firewalld i get locked out of ssh
    – ben
    Jun 11, 2017 at 14:32
  • and if i run the command without the --permanent flag i get Error: COMMAND_FAILED any time i try to add a service to firewalld i was using ftp as an example
    – ben
    Jun 11, 2017 at 14:39

1 Answer 1

-1

Indeed this happens with grs kernel on Centos 7. Actually, your question includes the answer. In order to eliminate the problem you need to avoid using the command firewall-cmd --permanent --zone=public --add-service=ftp when opening firewalld ports, or remove it if it is already there with firewall-cmd --permanent --remove-service=ftp. This solves the issue!

You can use the command firewall-cmd --permanent --zone=public --add-port=21/tcp though, so you can have port 21 open if you want.

The explanation is that firewalld tries to load the nf_conntrack_ftp kernel module, even when module support is disabled, and in grs kernel this module is disabled indeed.

I can guess that even if you don't use a grs kernel, you have the nf_conntrack_ftp kernel module disabled. If you reverse this reasoning, you could enable this module, but I am not sure if you can, and I have not tried this solution that looks obvious to me.

This also solves the problem of being locked out after firewall-cmd --reload when service=ftp is added in firewalld, which in fact is the problem I had with the grs kernel.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .