connecting to ftp w/ proftpd

[ixthus]

Hello,


I have Proftpd functioning to an extent. I can connect to the ftp server from a networked computer in the same workgroup by typing ftp://my.ip.address :)

Initially I had the concern that I am not getting a logon prompt when connecting to the ftp server from the networked computer. :(

Now to my consternation :confused: I have learned that no one is able to connect to the ftp server [ftp://my.ip.address] from outside of my network. In the security log I can see entries of a successful [their.ip.address] ANON anonymous sessions starting. Yet eventually the contacting browser returns an "host not found" message.

I am using the basic proftpd.conf file ~

# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use. It establishes a single server
# and a single anonymous login. It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.

ServerName "ProFTPD Default Installation"
ServerType standalone
DefaultServer on

# Port 21 is the standard FTP port.
Port 21
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022

# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 30

# Set the user and group that the server normally runs at.
User nobody
Group nogroup

# Normally, we want files to be overwriteable.
<Directory /*>
AllowOverwrite on
</Directory>

# A basic anonymous configuration, no upload directories.
<Anonymous ~ftp>
User ftp
Group ftp
# We want clients to be able to login with "anonymous" as well as "ftp"
UserAlias anonymous ftp

# Limit the maximum number of anonymous logins
MaxClients 10

# We want 'welcome.msg' displayed at login, and '.message' displayed
# in each newly chdired directory.
DisplayLogin welcome.msg
DisplayFirstChdir .message

# Limit WRITE everywhere in the anonymous chroot
<Limit WRITE>
DenyAll
</Limit>

</Anonymous>

Any ideas??? Suggestion?? [Linux related suggestions :D ]

[HighOrbit]

Do you have IPtables running locally to block outside addresses on that port?

If you are in a corporate environment, perhaps the router or bridge between your subnet and the other subnets is configured to block ftp connection requests.

Webmin is a browser based gui tool that makes setupup and administering ProFTPd (and other servers) easy. It can be found at www.webmin.com

[Hayl]

Originally posted by HighOrbit
Do you have IPtables running locally to block outside addresses on that port?

If you are in a corporate environment, perhaps the router or bridge between your subnet and the other subnets is configured to block ftp connection requests.

Webmin is a browser based gui tool that makes setupup and administering ProFTPd (and other servers) easy. It can be found at www.webmin.com

they are getting though so it isn't a firewall or anything blocking.

tell them (the peopel trying to connect) to try turning off PASV (passive)

[ixthus]

Originally posted by HighOrbit
Webmin is a browser based gui tool that makes setupup and administering ProFTPd (and other servers) easy. It can be found at www.webmin.com

Originally posted by Hayl
tell them (the peopel trying to connect) to try turning off PASV (passive)

I have been using webmin [I should be able to really mess things up with this :D]

And I've tried from myself, from work both with and without PASV. This may be a mute point do to firewall issues at work. I'll check with the others, they will have been at their homes.

[ixthus]

yup yup, PASV issue here is the workaround for it.


The passive FTP connections will use ports from 1024 and up, which means that you must forward all ports 1024-65535 from the NAT to the FTP server! And you have to allow lots of (possibly) dangerous ports in your firewalling rules!

Have no fear, simply use the PassivePorts directive in your etc/proftpd.conf to control what ports ProFTPD uses:

PassivePorts 60000 65535 # These ports should be safe...