62

Whenever I install vsftpd on centos, I only setup the jail environment for the users and rest is default configuration of vsftpd. I create user and try to connect with filezila ftp client, but I could not connect with passive mode. I always change the transfer settings to active mode to successfully connect to the ftp server otherwise I get 

 Error: Failed to retrieve directory listing

So is there a way to change any directive in vsftp.conf file and we can connect with passive mode to the server?

Improve this question

5 Answers 5

Reset to default
106

To configure passive mode for vsftpd you need to set some parameters in vsftpd.conf.

pasv_enable=Yes
pasv_max_port=10100
pasv_min_port=10090

This enables passive mode and restricts it to using the eleven ports for data connections. This is useful as you need to open these ports on your firewall.

iptables -I INPUT -p tcp --destination-port 10090:10100 -j ACCEPT

If after testing this all works then save the state of your firewall with

service iptables save

which will update the /etc/sysconfig/iptables file.

To do this is CentOS 7 you have to use the new firewalld, not iptables:

Find your zone:

# firewall-cmd --get-active-zones
public
  interfaces: eth0

My zone is 'public', so I set my zone to public, add the port range, and after that we reload:

# firewall-cmd --permanent --zone=public --add-port=10090-10100/tcp
# firewall-cmd --reload

What happens when you make a connection

  • Your client makes a connection to the vsftpd server on port 21.

  • The sever responds to the client telling it which port to connect to from the range specified above.

  • The client makes a data connection on the specified port and the session continues.

There is a great explanation of the different ftp modes here.

Improve this answer
6
  • Wondering why you put the max port after the min... but more importantly, if you open ports 10090 to 10100, that's 11 ports and not 10 as you say.
    – Alexis Wilke
    Nov 6, 2015 at 7:41
  • I believe it's alphabetical, it really doesn't matter as they are separate directives.
    – user9517
    Nov 6, 2015 at 7:52
  • 3
    This is not working for me without pasv_address.
    – fbmd
    Nov 30, 2015 at 22:12
  • 2
    took me ages to find this, none of the vsftpd guides list this... brilliant
    – Pete
    Jun 13, 2016 at 11:37
  • Wonderful - this vsftp configuration solved all my FTP-firewall problems :)
    – BurninLeo
    Jan 17, 2018 at 13:06
29

To enable passive mode, set the following configuration options in your vsftp.conf:

pasv_enable=YES
pasv_min_port=41361
pasv_max_port=65534
pasv_address=xxx.xxx.xxx.xxx

You can of course change the start and end port, and should replace the xxx's with the public IP of your server.

In addition, you should open the passive mode port range in your firewall. On centos, you can load the ip_conntrack_ftp module to handle ftp connections in your firewall. Edit /etc/sysconfig/iptables-config and add ip_conntrack_ftp to the IPTABLES_MODULES option. Afterwards restart iptables:

/sbin/service iptables restart
Improve this answer
4
  • 5
    pasv_address is what does the trick when everything else has been set up and it still doesn't work.
    – fbmd
    Nov 30, 2015 at 22:12
  • 2
    @fbmd before trying pasv_address, one should also check if both pasv_max and min_port are in the right order. It happened to me that I had the max value configured in the pasv_min_port, and vsftpd simply ignores this. It is a known silent flaw / bug that will visually makes you think that pasv ports are correclty configured, but they are not. This happened to me, and solved my problem.
    – Pedro Sousa
    Mar 8, 2018 at 8:55
  • If you want to specify a DNS address in pasv_address, you should add pasv_addr_resolve=YES (defaults to NO)
    – Pierre-Damien
    Jun 17, 2019 at 14:59
  • pasv_address is required to be set to external IP address when FTP server is behind router with ports forwarded. Also the router need to have hairpin NAT option enabled to have FTP accessible locally.
    – PeterM
    Feb 2 at 16:58
8

Beside the pasv_enable=YES, specify a port range in which VSFTP will run PASV mode:

pasv_min_port=50000
pasv_max_port=50999
pasv_enable=YES

Don't forget to configure iptables allows packet transmission on these ports:

iptables -I INPUT -p tcp --dport 50000:50999 -j ACCEPT
Improve this answer
2
  • On a standard CentOS system there is a blanket DROP that causes rules added with iptables -A INPUT ... to be ignored
    – user9517
    Aug 25, 2012 at 16:59
  • Make sure you include pasv_address in the vsftpd.conf file.
    – Pedro Madrid
    Dec 19, 2016 at 13:37
5

I had to do the following steps to get vsftp passive mode working on CentOS 8:

Enable passive mode in vsftpd config /etc/vsftpd/vsftpd.config:

pasv_enable=Yes
pasv_min_port=50000
pasv_max_port=50999

Enable ftp Service in firewalld:

firewall-cmd --permanent --zone=public --add-service=ftp
firewall-cmd --reload

As mentioned in another post you have to load the kernel module "nf_conntrack_ftp" (which was already the case in CentOS 8) and enable "nf_conntrack_helper" in kernel settings:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper

Add this line to /etc/sysctl.conf (or /etc/sysctl.d/10-nf_conntrack_helper.conf when /etc/sysctl.d/ is present) for a reboot persistent setting:

net.netfilter.nf_conntrack_helper=1

With connection track enabled there is no need to additional configure the passive ports in the local firewall.

Improve this answer
4

Usually, it's not the ftp server, vsftpd, but the firewall like iptable that prevents passive mode from being used (blocking tcp connection needed for data transfert).

Improve this answer
2
  • Actually, vsftpd could be smart enough to open a port in the firewall... but from the answers I see here, it does not look like it's capable of such a feat.
    – Alexis Wilke
    Nov 6, 2015 at 7:43
  • 5
    @Alexsis. There is no point to a firewall if apps just ignore the rules and open ports anyway.
    – ekerner
    Jul 26, 2016 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .