Record an FTP service Fault Analysis and FTP service Fault Analysis

Record an FTP service Fault Analysis and FTP service Fault Analysis

1. Concepts

The active and passive ftp mode is annoying. I believe you will not bother watching the descriptions below carefully!

For historical reasons, the FTP service requires two default ports: 20 (data port) and 21 (control port)

The initial working process of the FTP service is: the Client requests port 21 of the Server to establish a control connection, and then the Server actively uses Port 20 to connect to the Client to establish a data connection. The result is always rejected by the firewall of the Client. (Active mode)

After all, the Server is used by most people, so it is impossible to do things in the lower case or lower case. To solve the problem that the Server is rejected, the passive mode is born: the Client requests port 21 of the Server to establish a control connection, and then the Server tells the Client which data ports I have opened. You can connect them by yourself. (Passive mode)

The difference between the two modes is summarized as one sentence: the premise is that the Client requests the Server to establish a control connection, and the difference is who initiates a data connection.

 

Ii. Fault Case Analysis

The public IP address of the FTP server is 124. x Intranet IP Address: 192.168.1.85. The server is Vsftpd.

Fault (connection timeout ):

 

When I saw this problem, I was at a loss and did not carefully analyze the connection process. I used to connect with tools because I believe that tools are more powerful in some aspects, sure enough, I used CuteFTP to connect normally, so I saw the tool connection log and noticed a sentence:

What does this sentence mean? Why should we replace it?

Let's analyze the process:

1. The Client sends a control connection request to the Server (Public IP address) and passes account and password verification.

2. The Client sends the PASV command to the Server to enter the passive mode.

3. The Server returns the listener IP address (192.168.1.85) and data transmission port (38*256 + 254 = 9982) to the Client)

4. The Client finds that the returned IP address (192.168.1.85) is different from the previous connection (124. x). The Client modifies the IP address to the correct public IP address.

5. The Client sends a data connection request to port 124 of port 9982. x to establish a data connection.

After this analysis, let's look back at the problems encountered during command connection. It is not hard to see that it is stuck in the Client's application for sending a data connection to the Server. Why? Because our command mode is not intelligent, we do not convert the Intranet IP address returned by the Server into a public IP address, so the timeout for connection to 192.168.1.85 is returned.

Why does the system only return Intranet IP addresses?

It turns out that the public IP address is not configured on this server, but bound through the routing interface. Therefore, the FTP server program only knows that there is one Intranet IP address.

Solution: Write the configuration file pasv_address = Public IP address.

# Man vsftpd. conf