ftp: connection closed by remote host" error

[Debbie Fleith]

After working fine for months, all of a sudden we can't "mget" files from our Red Hat ES 2.1 server running wu-ftpd without getting the error message "Connection closed by remote host" on the client side session and "FTP Session closed" in the /var/log/messages file.

To our knowledge, nothing has changed on the firewall, LAN, etc. We can still "mput" files without any errors, just can't retrieve files.

We have no problem connecting to the host. Its after we are logged in, and issue an "mget *" command, that it seems to hang for a minute, then gives the "connection closed by remote host" error.

I can "mget" just fine when doing a test from and to the Linux box itself.

What could be causing this?

[Ivan Ferreira]

>>> o our knowledge, nothing has changed on the firewall

Probably something did change. Try with passive mode, before using mget or mput, type "pass", you should see "passive mode on".

[Debbie Fleith]

Can you give me more details about why passive mode may make a difference and what would possibly cause the need to set that parameter now?

[Ivan Ferreira]

Very detailed explanation is here:

http://slacksite.com/other/ftp.html#passive

A firewall blocking access to port 20 will cause this behaviour.

[Debbie Fleith]

Neither "pass", nor "pasv", nor "passive" are available commands for me to try with this version of wu-ftpd. Is that a command that can be configured to be available?

[Ivan Ferreira]

Wu-ftpd should provide passive mode. Probably, is your ftp client what does not support passive mode. What is the client operating system? Try from the linux box itself as before and run the pass command, the linux ftp client supports passive mode.

[Matti_Kurkela]

Some Linux distributions have two separate command-line FTP client programs: "ftp" for active mode and "pftp" for passive mode.

If your distribution has the "pftp" command, try using it instead of the "ftp" command. It is used just like the regular "ftp" command, but automatically uses FTP passive mode.

(I think this ftp/pftp implementation was created to make it easier to adapt existing FTP scripts to use passive mode: instead of changing the script logic to use the PASV command, only a simple change of the ftp client command name is needed.)

MK

[Debbie Fleith]

Our client is a Win2003 server, which doesn't appear to have "passive" mode or "pftp". Is there anything that can be done to allow passive mode toggling with Windows 2003 server clients?

[Ivan Ferreira]

You can try this ftp client:

http://sourceforge.net/projects/hftp/

Or you might want to allow active ftp through your firewall.

[Debbie Fleith]

What would need to be changed to allow active mode through the firewall? What port or ports needs to be allowed?

[Debbie Fleith]

Does wu-ftpd default to active or passive mode with the same setting each time a connection is established? Or, could it have changed its default mode somehow. I'm trying to figure out why this problem just came up now. Is there a setting in a configuration file which would show me how it defaults?

[Ivan Ferreira · Accepted solution]

As described in the previous link I posted, what you need to allow in the firewall is:

FTP server's port 20 from ports > 1023 (Client sends ACKs to server's data port)

[skt_skt]

check if the iptables is on which could also create ftp problem .

service iptables status

[Debbie Fleith]

This server uses ipchains, not iptables and it has not changed in 4 years.

There is one rule for ftp that I can see in the ipchains file:
-A input -s 0/0 -d 0/0 21 -p tcp -y -j ACCEPT

Are the firewall rules you recommend something that should be put in place in the ipchains config on this Linux server itself? If so, can someone explicitly tell me the entry necessary to add to this file?

[skt_skt]

Enabling ftp logging in Linux which can give more verbose information when u look at /var/log/vsftpd.log

Update /etc/vsftpd/vsftpd.conf with xferlog_std_format=NO from xferlog_std_format=YES


When enabled, all FTP requests and responses are logged, providing the option xferlog_std_format is not enabled. Useful for debugging.

Default: NO

Add log_ftp_protocol=YES at the end of /etc/vsftpd/vsftpd.conf

Uncomment xferlog_file=/var/log/vsftpd.log on /etc/vsftpd/vsftpd.conf

Default log file is /var/log/xferlog


Restart the vsftpd service