FTP failing - Passive mode refused

[C. Cellucci]

I am running RHAS 2.1 kernel 57. wu-ftpd is 2.6.1-23.2. I have a user who is executing a script via sqlplus. That script ftps a file to another server. The failure is being reported once the PASV is executed. The script was modified to turn off passive - that did not change the situation. The ftp script works perfectly when it is executed from the command line. The ftp as been executed as various users including Oracle, each test of the ftp as a different user worked. The ftp failure only occurs when the script is run through sqlplus.

The following is the debug information from the ftp (the site specific information has been changed to xx).

Started: Wed Jul 13 16:05:27 EDT 2005
Begin tranfer of file /home/dpsdz93/CS_OUTFILE_20050713160526.dat to rsd
Connected to rsd (XXX.xx.xx.62).
220 rsd.com FTP server (Version wu-2.6.1-23.2) ready.
---> SYST
530 Please login with USER and PASS.
---> USER xyz
331 Password required for dpsdz93.
---> PASS XXXX
230 User xyz logged in. Access restrictions apply.
---> SITE UMASK 000
200 UMASK set to 000 (was 022)
local: /home/dpsdz93/CS_OUTFILE_20050713160526.dat remote: /home/dpsdz93/CS_OUTFILE_20050713160526.dat
---> PASV
500 'FTP: setsockopt (ignored): Permission denied': command not understood.
Passive mode refused.
---> QUIT
227 Entering Passive Mode (xxx,xx,xx,62,223,168)
Tranfer of file /home/dpsdz93/CS_OUTFILE_20050713160526.dat to rsd was NOT successful
******************
Any suggestions would be appreciated.

[Ivan Ferreira]

When you run the script from sqlplus in ftp active mode, what is the debug output? Where do you get the error in this case?. I want to know if the error is in the pasv command or with any other command, try issuing and ls before anything, in passive and active mode and post the results.

[C. Cellucci]

The script always fails executing the put command. The ftp command from the script -
ftp -v -n -d $RemoteHost << % >> $TmpFile
user $2 $3
umask 000
put $LocalFile $RemoteFile
quit

Debug output with passive mode off. I added the ls before the umask.

Started: Fri Jul 15 08:56:59 EDT 2005
Begin tranfer of file /home/dpsdz93/CS_OUTFILE_20050715085659.dat to rsd
Connected to rsd (xxx.xx.xx.62).
220 rsd FTP server (Version wu-2.6.1-23.2) ready.
---> SYST
530 Please login with USER and PASS.
---> USER
331 Password required for .
---> PASS XXXX
230 User logged in. Access restrictions apply.
Passive mode off.
---> PORT xxx,xx,xx,54,207,90
500 'FTP: setsockopt (ignored): Permission denied': command not understood.
---> SITE UMASK 000
200 PORT command successful.
local: /home/dpsdz93/CS_OUTFILE_20050715085659.dat remote: /home/dpsdz93/CS_OUTFILE_20050715085659.dat
---> PORT xxx,xx,xx,54,207,91
500 'FTP: bind: Address already in use': command not understood.
---> QUIT

ls test with passive on

Connected to rsd (xxx.xx.xx.62).
220 rsd FTP server (Version wu-2.6.1-23.2) ready.
---> SYST
530 Please login with USER and PASS.
---> USER
331 Password required for .
---> PASS XXXX
230 User logged in. Access restrictions apply.
---> PASV
500 'FTP: setsockopt (ignored): Permission denied': command not understood.
Passive mode refused.
---> SITE UMASK 000
227 Entering Passive Mode (xxx,xx,xx,62,175,72)
local: /home/dpsdz93/CS_OUTFILE_20050715084641.dat remote: /home/dpsdz93/CS_OUTFILE_20050715084641.dat
---> PASV
200 UMASK set to 000 (was 022)
---> QUIT
500 'FTP: setsockopt (ignored): Permission denied': command not understood.

[Ivan Ferreira]

You said you added the ls before the umask and you get "permission denied". Can you try set the permissions for the destination directory wide open 777, just for test, if this works, may be a directory/file permission problem.

[C. Cellucci]

Changing permissions to 777 did not change anything.

[C. Cellucci]

Tried passive and non passive. No change in either.

[Ivan Ferreira]

In the script that is runned through sqlplus, before anything put the command:

id > /tmp/id.out

So you will find out the real user that is executing the script, i believe it should be oracle. Then verify that the oracle user can read the file you want to send, and the destination directory has write permissions, and there is no other file with the same name.

[C. Cellucci]

Permissions are 777 on files and the originating and destination directory trees.

Output of the id is -
uid=500(oracle) gid=501(dba) groups=501(dba)

[Ivan Ferreira]

Remember that 777 must be the directory, not the file. Running the script as oracle outside sqlplus works, right?

I don't know what can be the problem. Sorry.

[C. Cellucci]

Works perfectly outside of sqlplus. This has us stumped here also.

Thanks for looking at it.

[Ivan Ferreira · Accepted solution]

Did you verify the /var/log/messages and the /var/log/xferlog on the ftp server to see if there are any clues? Verify that you have the following lines on your configuration file:

port-allow all 0.0.0.0/0
pasv-allow all 0.0.0.0/0
passive address server_ip 0.0.0.0/0

log commands anonymous,real
log security anonymous,real
log transfers anonymous,real inbound,outbound

[C. Cellucci]

Nothing in messages or xferlog.

Variations of these parameters were in ftpaccess, but the 1st & 2nd octets were IP specific instead of all 0. I changed them to be as you listed. A test after applying the new settings still failed. On a whim I removed the -d option from the ftp. The script completed successfully when I ran another test.

Your help was greatly appreciated.
Thanks.