TR Forums

blitzy · Thu Jul 28, 2011 1:10 am

At work we have an FTP server and one of our customers had a weird problem uploading yesterday, it really had me puzzled because while he couldn't upload anything I was able to upload using the same login from both work and home. I can tell that we both had logged in successfully with the same account because I got him to send me his FTP client message log. I thought that maybe its some issue with firewalling/ports from his end but I don't really have any way to tell. Since there are some networking gurus that lurk around here I thought I'd throw up our client logs to see if anything obvious stands out.

I have sanitized these logs for IP addresses and file names so if you think the original logs would be of more interest to you I can PM them no worries, I just want to avoid getting our server hammered by a bot that stumbles across the info.

Unfortunately I don't have a server log for any of this since the FTP server is on a linux box offsite and at the time logging wasnt enabled and I would have to look up how to enable it since my linux skills are cabbage

First the guy who couldnt upload files

Status:             Resolving address of ftp.workworkzugzug.com
Status:             Connecting to xxx.xxx.xxx.xxx:21...
Status:             Connection established, waiting for welcome message...
Response:       220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
Response:       220-You are user number 3 of 50 allowed.
Response:       220-Local time is now 17:52. Server port: 21.
Response:       220-This is a private system - No anonymous login
Response:       220-IPv6 connections are also welcome on this server.
Response:       220 You will be disconnected after 15 minutes of inactivity.
Command:       USER FatPeon
Response:       331 User FatPeon OK. Password required
Command:       PASS *********
Response:       230-User FatPeon has group access to:  ftpgroup 
Response:       230 OK. Current directory is /
Command:       SYST
Response:       215 UNIX Type: L8
Command:       FEAT
Response:       211-Extensions supported:
Response:       EPRT
Response:       IDLE
Response:       MDTM
Response:       SIZE
Response:       REST STREAM
Response:       MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
Response:       MLSD
Response:       AUTH TLS
Response:       PBSZ
Response:       PROT
Response:       UTF8
Response:       TVFS
Response:       ESTA
Response:       PASV
Response:       EPSV
Response:       SPSV
Response:       ESTP
Response:       211 End.
Command:       OPTS UTF8 ON
Response:       550 Access is denied.
Status:             Connected
Status:             Retrieving directory listing...
Command:       PWD
Response:       257 "/" is your current location
Command:       TYPE I
Response:       200 TYPE is now 8-bit binary
Command:       PORT 192,168,100,45,14,27
Response:       200 PORT command successful
Command:       MLSD
Response:       550 Access is denied.
Error:               Failed to retrieve directory listing
Status:             Resolving address of ftp.workworkzugzug.com
Status:             Connecting to xxx.xxx.xxx.xxx:21...
Status:             Connection established, waiting for welcome message...
Response:       220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
Response:       220-You are user number 4 of 50 allowed.
Response:       220-Local time is now 17:53. Server port: 21.
Response:       220-This is a private system - No anonymous login
Response:       220-IPv6 connections are also welcome on this server.
Response:       220 You will be disconnected after 15 minutes of inactivity.
Command:       USER FatPeon
Response:       331 User FatPeon OK. Password required
Command:       PASS *********
Response:       230-User FatPeon has group access to:  ftpgroup 
Response:       230 OK. Current directory is /
Command:       OPTS UTF8 ON
Response:       550 Access is denied.
Status:             Connected
Status:             Starting upload of C:\Virtual Machines\gold for suppliers\donkey3062003-000001.vmdk
Command:       CWD /
Response:       250 OK. Current directory is /
Command:       PWD
Response:       257 "/" is your current location
Status:             Retrieving directory listing...
Command:       TYPE I
Response:       200 TYPE is now 8-bit binary
Command:       PORT 192,168,100,45,14,29
Response:       200 PORT command successful
Command:       MLSD
Response:       550 Access is denied.
Command:       SIZE donkey3062003-000001.vmdk
Response:       550 Access is denied.
Command:       PORT 192,168,100,45,14,30
Response:       200 PORT command successful
Command:       STOR donkey3062003-000001.vmdk
Response:       550 Access is denied.
Error:               Critical file transfer error
Status:             Retrieving directory listing...
Command:       PORT 192,168,100,45,14,31
Response:       200 PORT command successful
Command:       MLSD
Response:       550 Access is denied.
Error:      Failed to retrieve directory listing

Me connecting from home and uploading files without a problem

Status: Resolving address of ftp.workworkzugzug.com
Status: Connecting to xxx.xxx.xxx.xxx:21...
Status: Connection established, waiting for welcome message...
Response: 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
Response: 220-You are user number 1 of 50 allowed.
Response: 220-Local time is now 19:17. Server port: 21.
Response: 220-This is a private system - No anonymous login
Response: 220-IPv6 connections are also welcome on this server.
Response: 220 You will be disconnected after 15 minutes of inactivity.
Command: USER FatPeon
Response: 331 User FatPeon OK. Password required
Command: PASS *********
Response: 230-User FatPeon has group access to:  ftpgroup  
Response: 230 OK. Current directory is /
Command: SYST
Response: 215 UNIX Type: L8
Command: FEAT
Response: 211-Extensions supported:
Response: EPRT
Response: IDLE
Response: MDTM
Response: SIZE
Response: REST STREAM
Response: MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
Response: MLSD
Response: AUTH TLS
Response: PBSZ
Response: PROT
Response: UTF8
Response: TVFS
Response: ESTA
Response: PASV
Response: EPSV
Response: SPSV
Response: ESTP
Response: 211 End.
Command: OPTS UTF8 ON
Response: 200 OK, UTF-8 enabled
Status: Connected
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/" is your current location
Command: TYPE I
Response: 200 TYPE is now 8-bit binary
Command: PASV
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,xxx,xxx)
Command: MLSD
Response: 150 Accepted data connection
Response: 226-Options: -a -l 
Response: 226 2 matches total
Status: Directory listing successful
Status: Creating directory '/andrew'...
Command: MKD andrew
Response: 257 "andrew" : The directory was successfully created
Status: Retrieving directory listing...
Command: PASV
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,xxx,xxx)
Command: MLSD
Response: 150 Accepted data connection
Response: 226-Options: -a -l 
Response: 226 3 matches total
Status: Directory listing successful
Status: Retrieving directory listing...
Command: CWD /andrew
Response: 250 OK. Current directory is /andrew
Command: PWD
Response: 257 "/andrew" is your current location
Command: PASV
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,xxx,xxx)
Command: MLSD
Response: 150 Accepted data connection
Response: 226-Options: -a -l 
Response: 226 2 matches total
Status: Directory listing successful
Status: Resolving address of ftp.workworkzugzug.com
Status: Connecting to xxx.xxx.xxx.xxx:21...
Status: Connection established, waiting for welcome message...
Response: 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
Response: 220-You are user number 2 of 50 allowed.
Response: 220-Local time is now 19:18. Server port: 21.
Response: 220-This is a private system - No anonymous login
Response: 220-IPv6 connections are also welcome on this server.
Response: 220 You will be disconnected after 15 minutes of inactivity.
Command: USER FatPeon
Response: 331 User FatPeon OK. Password required
Command: PASS *********
Response: 230-User FatPeon has group access to:  ftpgroup  
Response: 230 OK. Current directory is /
Command: OPTS UTF8 ON
Response: 200 OK, UTF-8 enabled
Status: Connected
Status: Starting upload of C:\Users\Andrew\Desktop\doc\New Text Document.txt
Command: CWD /andrew
Response: 250 OK. Current directory is /andrew
Command: TYPE A
Response: 200 TYPE is now ASCII
Command: PASV
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,xxx,xxx)
Command: STOR New Text Document.txt
Response: 150 Accepted data connection
Response: 226-File successfully transferred
Response: 226 0.002 seconds (measured here), 12.78 Kbytes per second
Status: File transfer successful, transferred 27 bytes in 1 second
Status: Retrieving directory listing...
Command: TYPE I
Response: 200 TYPE is now 8-bit binary
Command: PASV
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,xx,xxx)
Command: MLSD
Response: 150 Accepted data connection
Response: 226-Options: -a -l 
Response: 226 3 matches total
Status: Directory listing successful

We have had many other users upload without a hitch so I'm a bit stumped by it really

Thu Jul 28, 2011 8:09 am

You are doing Passive FTP

Command: PASV
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,xxx,xxx)

Your customer is doing Active FTP

Command:       PORT 192,168,100,45,14,27
Response:       200 PORT command successful

Active FTP needs firewalls and NAT boxes that understand FTP, in this case as it is an RFC1918 private IP address in the Port command (assuming this isn't your sanitising it) and assuming that this is a connection across the Internet then this is the problem.
http://slacksite.com/other/ftp.html

You can either go on a hunt making sure all the firewalls and NAT in front of the server understand FTP (typically loading an FTP helper module) and then make sure your customer does the same thing on all their firewalls and NAT, or the easier thing to do is to tell them to use Passive FTP.

It may be easier to offer sftp or scp as that only requires the ssh port to go through all the NAT and FTP, you also gain the benefits of encryption.

bthylafh · Thu Jul 28, 2011 8:34 am

I agree. SFTP is a better solution all around, but passive FTP will do in a pinch.

You could even go with PKI on SFTP instead of passwords and your users won't have to remember (or use) their passwords.

blitzy · Thu Jul 28, 2011 8:17 pm

Thanks for the feedback, the customer was using FileZilla to upload and was using the "default" transfer mode, the other options are active and passive. I thought that it would automatically try a passive transfer if active failed, I'm not sure what the "default" setting actually means in FileZilla though.

I get the feeling we might be better off using some kind of website "dropbox" type of solution, since a lot of people don't understand how to upload files to an FTP server. They try to connect using internet explorer and don't really know what they're doing, and then on top of that their networks can be too locked down for FTP to work anyway. We just need an easy way for people to send us their files that are too big to email, with as little hassle as possible.

Flatland_Spider · Fri Jul 29, 2011 8:44 am

blitzy wrote:
Thanks for the feedback, the customer was using FileZilla to upload and was using the "default" transfer mode, the other options are active and passive. I thought that it would automatically try a passive transfer if active failed, I'm not sure what the "default" setting actually means in FileZilla though.

Passive is the default in Filezilla with fall back to active, so there is definitely something weird going on.

I get the feeling we might be better off using some kind of website "dropbox" type of solution, since a lot of people don't understand how to upload files to an FTP server. They try to connect using internet explorer and don't really know what they're doing, and then on top of that their networks can be too locked down for FTP to work anyway. We just need an easy way for people to send us their files that are too big to email, with as little hassle as possible.

I feel your pain. I'm currently working out how to solve the same problem. I'm tired of clients not reading my instructions, and I just need something that people can minimally screw up without having to download anything.

adam0718 · Mon Aug 01, 2011 12:02 pm

Try Auto FTP Manager. It has an easy to use interface that is perfect for new users, it is free if you use it as just a FTP client. I purchased it because I use the automated transfer features. Works perfect on my Windows 7 64Bit. Recommended: http://www.deskshare.com/ftp-client.aspx

DLHM · Mon Aug 01, 2011 1:55 pm

Is your network numbered with a common small business subnet? 192.168.x.x. How is their's numbered? I know in theory this shouldn't cause a problem but... When all else fails look to what shouldn't cause a problem. FileZilla normallly works for everything I need, I have had problems with sending pics from cheap secuirty camera's to a filezilla server that I couldn't resolve. I think it was the limiting FTP client built in to the Cameras.

TR Forums

FTP upload problems

FTP upload problems

Re: FTP upload problems

Re: FTP upload problems

Re: FTP upload problems

Re: FTP upload problems

Re: FTP upload problems

Re: FTP upload problems

Who is online