Re: FreeBSD FTP problem

From: Ryan Thompson (ryan_at_sasknow.com)
Date: 07/07/03

  • Next message: Brian Astill: "Re: Mounting extended dos partition"
    Date: Sun, 6 Jul 2003 22:36:36 -0600 (CST)
    To: "Arcadius A." <ahouans@sh.cvut.cz>
    
    

    Arcadius A. wrote to Ryan Thompson and FreeBSD Questions:

    > > > but nothing more.... just the same arror as the one you've described:
    > > > "... 425 can't build data connection: operation timed out ..." :-(((
    > > >
    > > > Do you have any idea about how to get around this?
    > >
    > > Well, in my case, it turned out to be pilot error... FTP is a tricky
    > > protocol to allow through default-deny firewalls, and I had simultaneous
    > > bugs in my firewall config *and* FTPd config, with respect to passive
    > > transfers. It took me a while to spot.
    > >
    > > Check your firewall config carefully, and make sure you have a good
    > > understanding of how the FTP protocol works (in active and passive
    > > modes). Completely open your firewall temporarily (i.e., ipfw add 201
    > > allow ip from any to any) and verify that things work there. If things
    > > work there (or fail differently), the problem is with your firewall (and
    > > possibly FTPd configuration, if you're using the ephemeral port range
    > > for PASV). If your tests fail in *exactly* the same manner as before,
    > > including the same timeout delays, you can ignore your firewall for the
    > > time being (but leave it open until you get FTP working, and *then*
    > > restrict it, so you're only testing one unknown at a time). Try running
    > > tcpdump and sockstat on the server to see what's coming and going for
    > > FTP traffic. /ports/net/trafshow might be helpful, too.
    > >
    >
    > Hello!
    > Thanks for the reply!
    > But I'm not running any firewall on my server...

    Ahh. So you're *not* having exactly the same problem. :-)

    > So, my problem shouldn't be with the firewall on my server...
    >
    > About the configuration of FTPd, I cannot find the config file
    > (ftpd.conf or ftpd.config or ftpd.cf )on my server(FreeBSD4.8 stable,
    > built yesterday).

    >From ftpd(8):
    FILES
         /etc/ftpusers List of unwelcome/restricted users.
         /etc/ftpchroot List of normal users who should be chroot'd.
         /etc/ftphosts Virtual hosting configuration file.
         /etc/ftpwelcome Welcome notice.
         /etc/ftpmotd Welcome notice after login.
         /var/run/nologin
                          Displayed and access refused.
         /var/log/ftpd Log file for anonymous transfers.

    > Note that I'm trying to connect to FreeBSD from a windows
    > workstation.... both the workstation and the FreeBSD server are in
    > the same LAN.... From my Windows box, I can easilly connect via FTP to
    > other Linux sercers in my LAN or even out of the LAN.. But when I
    > connect to my FreeBSD server, it connecs well... but I cannot do
    > anything useful on the server.... I get the error "...425 can't build
    > data connection: operation timed out..."

    Try both active and passive modes for transfer. If you really have no
    firewall between the client and the server (remember the entire path
    from application to application is important), and there is no address
    translation going on, you should have no issues either way with the
    stock configurations of Windows and FreeBSD.

    If, on the other hand, you're running any sort of packet filter or
    "Personal Firewall" on the Windows machine, or using "Internet
    Connection Sharing", or if your "LAN" is more than an unmanaged link
    layer switch/hub, you're no longer running a stock config, and the
    results may be unpredictable. From your description, your problems do
    seem to point to a misconfiguration of FreeBSD, but I wouldn't bet my
    server farm on that quite yet.

    I'd highly recommend you take my earlier advice and run tcpdump and/or
    trafshow on the server to see what's really going on... and, if
    possible, compare with similar output from the client. Try connecting
    with different clients, too. If you aren't familiar with analysis using
    tcpdump, try some Googling on the subject, or ask for help. Equivalent
    output from a complete FTP client session would also be extremely
    helpful in diagnosing your problem.

    At this point, nobody here will be able to do more than go on a hunch as
    to what's causing the problem. There is probably a simple answer, but I
    can think of dozens of ways to reproduce the error message you've
    reported.

    > My server was running FreeBSD4.6 before and I didn't have any trouble
    > with FTPd .... I just upgraded yesterday.... and still, I haven't
    > noticed this problem.... I start getting this error just a while
    > ago... :-( ... I've rebooted the server... but it didn't help

    Assuming you kept backups of your config, check the diffs carefully.
    Don't suppose you can revert back to your old config and verify that
    this is still an issue?

    - Ryan

    -- 
      Ryan Thompson <ryan@sasknow.com>
      SaskNow Technologies - http://www.sasknow.com
      901-1st Avenue North - Saskatoon, SK - S7K 1Y4
            Tel: 306-664-3600   Fax: 306-244-7037   Saskatoon
      Toll-Free: 877-727-5669     (877-SASKNOW)     North America
    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"
    

  • Next message: Brian Astill: "Re: Mounting extended dos partition"

    Relevant Pages

    • Re: Forcing RPC over HTTP instead of TCP
      ... They don't support it, but we're trying to eliminate some things. ... config is as follows on the same side of the firewall: ... Back-end Exchange Server ... On the hostile side of the firewall is our outlook client. ...
      (microsoft.public.exchange.admin)
    • Re: FreeBSD FTP problem
      ... Subject: FreeBSD FTP problem ... > including the same timeout delays, you can ignore your firewall for the ... But I'm not running any firewall on my server... ... Note that I'm trying to connect to FreeBSD from a windows workstation.... ...
      (freebsd-questions)
    • Re: FreeBSD - Secure by DEFAULT ?? [hosts.allow]
      ... > I've recently decommisioned a Linux SendMail Server to a FreeBSD Exim ... but with no Firewall yet. ... > I've seen OpenBSD Servers using hosts.deny and hosts.allow files, ...
      (freebsd-questions)
    • Weird situation
      ... My last questions here helped me get a firewall to help our network. ... windows 2000 server. ... But the freebsd firewall server can ping the router no problem. ...
      (freebsd-net)
    • RE: Mapping problem
      ... > I've got annoying issue with Routing and Remote access on one of my win2k3 ... > config and chosen only NAT/basic firewall component. ... > of inbound filtering mean only connections that established from the server ...
      (microsoft.public.windows.server.networking)