topic Re: ftp setup - help in Operating System - Linux

ftp setup - help

pete b — Thu, 18 Jul 2002 06:38:32 GMT

I've newly installed Red Hat 7.3 and wish to set up the wu-ftp server for local ftp access. I can open a connection on the machine itself (open localhost) and ftpaccess rules are enforced correctly. However, when I try to connect from another machine with the same loggin details, I get a "connection refused" error. Any ideas about why this might be happening, or advice on where ftp access logs might be written to. This newbie greatly appreciates any help.

Re: ftp setup - help

I_M — Thu, 18 Jul 2002 06:45:48 GMT

Hi

Have you checked packet filter such as # ipchains -L ?

if you want to control ipchains, you may use #lokkit command.

Good luck

Re: ftp setup - help

pete b — Thu, 18 Jul 2002 07:53:11 GMT

Thanks for that, but I'm not sure how the firewall is configured. I've installed Red Hat 7.3 out of the box and I'm sure I configured the firewall during installation. Forgive me, I'm new to this, but how can I check whether there is a firewall and assuming that there is, how would I congfigure it?

Re: ftp setup - help

pete b — Thu, 18 Jul 2002 08:38:18 GMT

Follow-up: I've disabled the firewall (for testing) using lokkit on my linux box. I can still connect to the ftp server on that same box. I can ping the linux box from my remote machine (and the remote machine from my linux box). I've added the IP of the remote machine to hosts.allow, just in case tcp wrappers was causing a problem. But I still get a "connection refused" error.

I'm about to throw my laptop out the window and set fire to the office. Where do I go from here?

Re: ftp setup - help

Peter Kloetgen — Thu, 18 Jul 2002 08:46:53 GMT

Hi Pete,

did you try to telnet as a normal user, or as root? Telnetting as root is disabled by default on Redhat Linux, you would first have to enable it. Do you have a /etc/securetty file? --> mv securetty securetty.save
Then change the telnet cofiguration file:

disable = yes

to

disable = no

Allways stay on the brigtht side of life!

Peter

Re: ftp setup - help

Paul Mancillas — Fri, 19 Jul 2002 18:26:19 GMT

There are 2 things you have to do to make ftp work. First, edit the /etc/xinetd.d/wu-ftpd file and change the line "disable=yes" to "disable=no". Second, you need to check the firewall rules with "ipchains -L". If you get any lines that say "DENY" then just disable all firewall rules with "ipchains -F". This will flush all of the chains until the next reboot. This should allow ftp to work now.

Paul Mancillas

Re: ftp setup - help

A Ottenheimer — Tue, 30 Jul 2002 00:54:08 GMT

Check /var/log/messages for error messages
related to login. Type "tcpdump -n port 20 or port 21 -i any" to watch for the login process. Turn on logging in your iptables firewall scripts (-l) and watch /var/log/messages for any DENY statements that pop up. Lastly - look at proftpd - I like it much better.

A

Re: ftp setup - help

Steven E. Protter — Tue, 20 Aug 2002 19:43:03 GMT

You might not know it but your ipchains -F command fixed MY problem with allowing DNS queries.

THANKS.

Re: ftp setup - help

Steven E. Protter — Fri, 23 Aug 2002 17:59:38 GMT

I've stopped using the GUI tool on the firewall. It had no option for openning or closing port 53 anyway.

Here are the contents of my /etc/sysconfig/ipchains file.

Pretty secure, though more ports are going to have to be openned up.

:input ACCEPT
:forward ACCEPT
:output ACCEPT
-A input -s 66.92.143.194/0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -s 66.92.143.195/0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -s 66.92.143.196/0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -s 66.92.143.197/0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -s 66.92.143.198/0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -s 66.92.143.194/0 -d 192.168.0.30/0 25 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 22 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 23 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 53 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 53 -p udp -j ACCEPT
-A input -s 0/0 -d 0/0 -i lo -j ACCEPT
-A input -s 0/0 -d 0/0 -i eth1 -j ACCEPT
-A input -p tcp -s 0/0 -d 0/0 0:1023 -y -j REJECT
-A input -p tcp -s 0/0 -d 0/0 2049 -y -j REJECT
-A input -p udp -s 0/0 -d 0/0 0:1023 -j REJECT
-A input -p udp -s 0/0 -d 0/0 2049 -j REJECT
-A input -p tcp -s 0/0 -d 0/0 6000:6009 -y -j REJECT
-A input -p tcp -s 0/0 -d 0/0 7100 -y -j REJECT