FTP Port

[vwgtiturbo]

I have been trying to connect to my webserver via FTP and the connection is always refused by the server. I am not sure if I have the port forwarding on the router set correctly (25??). Also, I know that ftp is installed on the server (I did a full installtion), but am not sure if it is running. I looked at the services configuration, and saw gssftp was setup to run, but I am not sure if that is a server or just client. I need to learn something about iptable (or chains, whichever acts as a firewall) and make sure I have the correct ports open....

[SkyNet]

If you're trying to access the FTP server from your LAN then unless you use that machines local IP it won't work. If you're trying access the FTP server from a remote machine, then yes I'd say either there is a problem with your IPTABLES or the FTP Server isn't configured correctly.

iptables -A PREROUTING -t nat -p tcp -i $EXTIF --dport 25 -j DNAT --to $PORTFWIP:25

The -i might should be -o I can't remember.

[vwgtiturbo]

Yeeeeaahh... well, since that looks like complete jibberish to me, I will do some reading... LOL I have never gotten into that, as I never had the need to (and didn't want to bring the box down just diddling around...). Thanks for the insight though.

[vwgtiturbo]

What I was doing was entering "ftp www.xxxxxxx.xxx 21" and I was getting all of these weird messages... I will post a sample.

[SkyNet]

Maybe this will help you a little better.

iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 25 -j DNAT --to 192.168.0.x:25

eth0 is your external interface, while 192.168.0.x is you internal interface.

What this is saying is: in the prerouting phase (the phase before anything else happens) requests coming in on TCP from eth0 on port 25 need to be sent (DNAT == Destination Network Address Translation) to this LAN (192.168.0.x) machine.

In english, all requests coming in from the internet on port 25 need to be sent to the FTP server on the LAN.

[vwgtiturbo]

Here is the sample

[ron@hell ron]$ ftp xxx.xxxxxx.xx 21
Connected to xxxxx.xx.
220 hell FTP server (Version 5.60) ready.
334 Using authentication type GSSAPI; ADAT must follow
GSSAPI accepted as authentication type
GSSAPI error major: Miscellaneous failure
GSSAPI error minor: No credentials cache found
GSSAPI error: initializing context
GSSAPI authentication failed
334 Using authentication type KERBEROS_V4; ADAT must follow
KERBEROS_V4 accepted as authentication type
Kerberos V4 krb_mk_req failed: You have no tickets cached
Name (xxx.xxxxxxx.xx:ron): ron MY INPUT
530 Must perform authentication before identifying USER.
Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> quit
221 Goodbye.
[ron@hell ron]$

Then, I tried again, using my name and password on the same line (not sure how it is supposed to be done...), received the same error.

I did try to use gftp (gui) and entered in 'anonymous' for the user and it worked. So, for some reason, my user can't get on, but someone anonymous can? Also, even when I did get on with anonymous, I couldn't view anything. I always received the error "No such file or directory". I am trying to learn FTP (among 9000 other things) because I have never done it via command line, so I may not even be doing it right... Is there a sort of 'document root' or something similar (as httpd) for ftp?

[trommaster]

take a look at the errors further up. I'd say you have some problems in your configuration file, or don't have some sory of authentication set up properly

[SkyNet]

Well, you've got me on FTP servers. I don't run one. I have before a long time ago, but asking me to remember that well..... It was proftpd btw.

[paradox]

We need to do some kind of collabrative omp on iptables. I haven't ever even bothered with them, so I guess it will be a learning process for me as well.

Aragorn

[vwgtiturbo]

It's really odd because my error seem to concern authentication. I opened up redhat-config-services and the only two entries that look like they might affect this were both off: krb524, krb5kdc. I don't know if they are responsible for this task or not, but... Anyways, I enabled them on runlevel 3 and 5 (that way, if I needed to reboot the machine remotely, I would still be able to use these services when the machine came back up, as I wouldn't be able to get it to 5), but still getting the errors.

Another odd thing... when I look at the services list, I see the following, as far as ftp:

GSSFTP is enabled (checked)
"The kerberized FTP server accepts FTP connections that can be authenticated with Kerberos 5. You must enable xinetd to use this service."
... and it's status says "xinetd service"

TFTP is enabled (checked)
"The tftp server serves files using the trivial file transfer protocol. The tftp protocol is often used to boot diskless workstations, download configuration files to network-aware printers, and to start the installation process for some operating systems. You must enable xinetd to use this service."
... and it's status says "xinetd service"

VSFTP is enabled (checked)
"Vsftpd is a ftp daemon, which is the program that answers incoming ftp service requests."
... and it's status says "vsftpd dead but subsys locked"

And finally, xinetd is running.

The weird thing is that none of these show up under 'ps -e' or 'top'. Geez...

I was so excited yesterday to FINALLY get my LinBox printing (WinBox is the print server, until I buy a dedicated print server to connect to the router), and this just kind of levelled me out...
I don't know which of these I need (I don't really want to run the unnecessary ones, of course), or if I am missing something for ftp authentication. Oh, one more thing... when I go to the k-menu, it has a submenu for 'Server Settings' and ftp is not listed as one. I wonder if, even though I have them enabled, if there is someother configuration I need to do...