On 12/22/07, Benoy George <bgenix(a)gmail.com> wrote:
> -------- Original Message --------
> Subject: [ILUG-BOM] ftp error: 500 invalid port connection
> From: Agnello George <agnello.dsouza(a)gmail.com>
> To: GNU/Linux Users Group, Mumbai, India <linuxers(a)mm.glug-bom.org>
> Date: Friday 14 December 2007 04:58:39 PM IST
>
> > HI
> > I am trying to access a ftp server . I am able to connect to it with the
> > user name and password. However when i connect to the server and do a dir i
> > get the following error.
> >
> > C:\Documents and Settings\Admin>ftp XXX.XXX.XXX.XXX
> > Connected to XXX.XXX.XXX.XXX
> > 220 Microsoft FTP Service
> > User (XXX.XX.XXX.XXX:(none)): user-name
> > 331 Password required for user-name
> > Password:
> > 230 User user-name logged in.
> > ftp> dir
> > 500 Invalid PORT Command.
> > 150 Opening ASCII mode data connection for /bin/ls.
> > I got a fire wall running and i have opened port 21, The entry in the
> > iptables is as follows .
> >
> > -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j
> > ACCEPT
> >
> > why am i getting the error ?? when i am able to ftp to other ftp site with
> > out authentication ( like ftp://202.96.64.144/pub/ )
> >
> > Thanks !!
>
> Sorry for the late reply, since I am not marking to the list.
> From your previous thread I have noticed that you have not
> added ftp-data port(20) to the policy.
>
> see
> $cat /etc/services | grep -i ^ftp
> on your linux machine.
>
> and try with
> #modprobe ip_conntrack_ftp
>
> But still sometime we are getting errors with ftp service from
> M$ platforms.
>
> best regards
> Benoy
>
Thanks for all the answers but here is what i did
Passive ftp
A PORT command is again issued, but this time it is from the server to
the client. The client connects to the server for data transfer. Since
the connection is in the same sense as the original ftp connection,
passive ftp is inherently more secure than active ftp, but note that
this time we know even less about the port numbers. Now we have a
connection between almost arbitrary port numbers.
Enter the ip_conntrack_ftp module once more. Again, this module is
able to recognize the PORT command and pick-out the port number.
Instead of NEW in the state match for the OUTPUT chain, we can use
RELATED. The following rules will suffice:
iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state
--state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state
--state ESTABLISHED,RELATED -j ACCEPT
add the following to the kernel
modprobe ip_nat_ftp
--
Agnello . G .Dsouza