Vsftpd cannot be accessed normally in Linux

Article Title: vsftpd cannot be accessed normally in Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

1. Permissions make vsftpd inaccessible

After the vsftpd software is installed, the default home directory of ftp is/var/ftp, which is caused by an incorrect/var/ftp permission setting. The permissions of this directory cannot be opened; this is because you have run chmod 777/var/ftp.

The Home Directory of the following FTP users cannot be fully open to all users, user groups, and other user groups;

[Root @ localhost ~] # Ls-ld/var/ftp

Drwxrwxrwx 3 root 4096 2009-03-23/var/ftp correct this error. The following method should be used;

[Root @ localhost ~] # Chown root: root/var/ftp

[Root @ localhost ~] # Chmod 755/var/ftp

2. After the LINUX Server firewall is enabled, you cannot log on normally.

If you add port 21 to the firewall configuration file, you still cannot access the FTP server normally.

First, you must understand the concept;

FTP supports two modes: Standard (PORT mode) and Passive (PASV mode ). The FTP client in Standard mode sends the PORT command to the FTP server. The client in Passive mode sends the PASV command to the FTP Server.

The differences between PORT and PASV are as follows:

In Port mode, the FTP client first establishes a connection with the tcp port 21 of the FTP server and sends commands through this channel. When the client needs to receive data, it sends the Port command through this channel. The PORT command contains the PORT used by the client to receive data. When transmitting data, the server connects to the specified port of the client through its TCP port 20 to send data. The FTP server must establish a new connection with the client to transmit data.

The Passive mode is similar to the Standard mode when a control channel is established, but the Port command is not sent after the connection is established, but the Pasv command. After the FTP server receives the Pasv command, it randomly opens a high-end port (the port number is greater than 1024) and notifies the client to send data requests on this port. The client connects to this port of the FTP server, the FTP server then transmits data through this port. At this time, the FTP server no longer needs to establish a new connection with the client.

Because ie uses Passive (Passive) mode by default, it is necessary to connect to the Linux server over port 1024, while the firewall does not develop a port above 1024, resulting in firewall blocking login to the ftp server.

Solution:

1. Client settings

Remove the check box to allow IE to use port (active) mode, but it is troublesome to set each client.

2. server-side settings (take CentOS as an example)

Modify the vsftpd. conf configuration file to support Passive (Passive) mode.

# Vim/etc/vsftpd. conf Add the following content in the last line:

Pasv_min_port = 3000 (set the port range in passive mode)

Pasv_max_port = 3010 (set the port range in passive mode) Add a port in the firewall configuration file iptables

# Vim/etc/sysconfig/iptables

-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 3000: 3010-j ACCEPT Restart service to make it take effect

# Service vsftpd rstart

# Service iptables restart