12

Why do I get kicked out of a FTP session once I run a command? It seems that once I successfully login into a server is get the following after running a command such as "ls" (I've enclosed the error portion in the "[ERROR]" tags):

allen92@allen92-VirtualBox:~/Videos$ ftp -n ftp.FreeBSD.org
Connected to ftp.FreeBSD.org.
220 beastie.tdk.net FTP server (Version 6.00LS) ready.
ftp> user
(username) anonymous
331 Guest login ok, send your email address as password.
Password: 
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
[ERROR]
421 Service not available, remote server has closed connection
[ERROR]
ftp>

This seems to happen on any remote FTP server. Everything works fine when I login onto the local machine and run FTP commands. If in fact the "421" error is a generic error, is there any way to find out the source of the problem? Any leads on this would be appreciated. I haven't been able to find any support on this particular issue. Anybody with an similar problem please share your thoughts.

NOTE: I have VSFTPD installed.

Improve this question

2 Answers 2

Reset to default
13

There is most likely a NAT-firewall between you and the servers showing the symptom. (NAT-firewalls hide a whole network behind a single IP-number).

The problem is that ftp wants to send the data resulting from the command in a new, separate TCP/IP connection and that cannot go through the firewall because it needs to go from the server to you, and you are hidden behind the firewall which has no clue that the data is intended for your machine. When the FTP protocol was designed, many modern devices like the NAT-router (which became necessary when there were more devices than available IP-addresses) had not been invented yet.

Use the pasv command (may be called something different in your client) to change to a passive connection where data connections go from you to the server.

See http://slacksite.com/other/ftp.html for a more detailed explanation.

Improve this answer
2
  • Thanks, a lot. In the case of VSFTPD, the command for entering passive mode is "passive". That seems to be working for now. I think this whole situation has to do with me running the Linux install on a virtual machine and its not-so-standard settings. I am going to find out how enable "passive" mode by default. Once I find out I'll post for anybody interested. Commented Sep 14, 2013 at 7:12
  • It is not uncommon that the default network for virtual machines is some kind of NAT, so the machine is not exposed. For VirtualBox changing to Bridged makes it show up like any other machine on the local network. Commented Dec 5, 2017 at 19:05
1

Add or enable this line in /etc/vsftpd.conf

seccomp_sandbox=NO

Improve this answer
2
  • This answer solved my issue but I still have questions about this undocumented configuration. Commented Nov 11, 2018 at 13:46
  • Why seccomp_sandbox=NO is the right answer under certain circumstances is documented in the /etc/vsftpd.conf file: ``` # seccomp_sanbox add an aditional security layer limiting the number of a # syscalls can be performed via vsftpd. However it might happen that a # whitelist don't allow a legitimate call (usually indirectly triggered by # third-party library like pam, or openssl) and the process is being killed by kernel. # # Therefor if your server dies on common situations (file download, upload), # uncomment following line and don't forget to open bug at # bugzilla.novell.com se Commented Apr 17, 2019 at 20:30

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.