0

We need to ftp on "active mode" using Ubuntu ec2 instance as a client on a remote not ec2 ftp server.

Unfortunately we can't use sftp functionality. And we are able to connect using passive mode, but all we need is to use "active mode". I know active mode is problematic on NAT level (private-public IPs), but is there a way to overcome that?

On the client (ec2 instance), using active mode we got:

#ftp 11.11.11.11
Connected to 11.11.11.11.
220 (vsFTPd 3.0.2)
Name (11.11.11.11:ubuntu): ftpuser
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd files
250 Directory successfully changed.
ftp> ls
500 Illegal PORT command.
ftp: bind: Address already in use

The ftp server (not ec2 instance) configuration is as following:

listen=YES
listen_ipv6=NO
anonymous_enable=NO
local_enable=YES
write_enable=YES
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
ascii_upload_enable=YES
ascii_download_enable=YES
chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list
ls_recurse_enable=YES
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=ftp
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
seccomp_sandbox=NO
allow_writeable_chroot=YES
pasv_enable=YES
pasv_min_port=10024
pasv_max_port=10048
port_enable=YES
pasv_address=11.11.11.11

Inbound and Outbound is wide-open to the world!

enter image description here enter image description here

Improve this question
4
  • It's all happening on the client side since active FTP connects back from server to client. If each layer of firewall or NAT between client and server doesn't implement an ALG for FTP, won't work. Maybe if you're using a tunnel between client and server to avoid NAT...
    – A.B
    Mar 29, 2022 at 19:54
  • Consider first that an EC2 instance has a private IP address assigned to it, but through an internet gateway is reachable via a public IP address. The PORT command includes sending an IP address to the remote server to use to connect back to the client (in active mode). But, the client only knows about it’s private IP address. So at the very least the server is receiving an invalid IP address to connect to (the private IP of the EC2 instance). I’m not sure why the particular “address in use” error but you have to solve the primary issue before worrying about that.
    – Appleoddity
    Mar 30, 2022 at 4:51
  • The FTP client has to have a feature to recognize the public IP address or configure the IP address sent in the PORT command. Otherwise you’re stuck doing incredibly, inelegant hacks like this: serverfault.com/questions/889934/…
    – Appleoddity
    Mar 30, 2022 at 4:52
  • The lftp client supports this feature (specifying the IP address for the PORT command) ftp:port-ipv4. I’m sure there are others. Drastic times call for drastic measures.
    – Appleoddity
    Mar 30, 2022 at 4:59

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .