Skip to content

Latest commit

 

History

History
126 lines (92 loc) · 2.62 KB

ftp.md

File metadata and controls

126 lines (92 loc) · 2.62 KB
Raw

lifecycle

ftp x.x.x.x
Name: anonymous
cd incoming
dir
get foo
put /home/foo/bar
help
quit

kernel support

grep FTP /boot/config-5.6.12-300.fc32.x86_64

# Output:
# CONFIG_NF_CONNTRACK_FTP=m
# CONFIG_NF_CONNTRACK_TFTP=m
# CONFIG_NF_NAT_FTP=m
# CONFIG_NF_NAT_TFTP=m
# CONFIG_IP_VS_FTP=m

issues

ftp.exe does not support passive mode

dir
put /usr/share/empty/bbb bbb

[pid 1188431] connect(4, {sa_family=AF_INET, sin_port=htons(24653), sin_addr=inet_addr("192.168.1.3")}, 16) = -1 EACCES (Permission denied)

[pid 1190688] openat(AT_FDCWD, "bbb", O_WRONLY|O_CREAT|O_EXCL|O_APPEND, 0666) = -1 EACCES (Permission denied)

ps aux | grep 1188431
# => user: ftp

chroot location

[pid 1174219] chdir("pub") = 0

[pid 1191143] chdir("/usr/share/empty") = 0
[pid 1191143] chroot(".") = 0

ls -la /proc/1174219/cwd

# Output:
# lrwxrwxrwx. 1 root root 0 May 23 14:03 /proc/1174219/cwd -> /var/ftp/pub

server configuration

dnf -y install vsftpd

/etc/vsftpd/vsftpd.conf

allow_writeable_chroot=YES
anon_upload_enable=YES
anonymous_enable=YES
listen_address=0.0.0.0
listen=YES
no_anon_password=YES
pasv_enable=YES
pasv_max_port=40001
pasv_min_port=40000
write_enable=YES
xferlog_enable=NO

mkdir -p /var/ftp/pub/incoming
# need executable permissions for client to change directory
chmod a+rwx /var/ftp/pub/incoming
firewall-cmd --add-service=ftp
firewall-cmd --add-port=40000-40001/tcp
setsebool -P ftpd_use_passive_mode on
systemctl start vsftpd

# Validation

curl -T /tmp/foo ftp://192.168.1.4/tmp/bar --user foo

sudo su -s /bin/bash -c 'touch /var/ftp/pub/incoming/foo' ftp

sudo su -s /bin/bash -c 'strace nc -z 192.168.1.3 25075 2>&1 | grep connect' ftp

# Output:
# connect(5, {sa_family=AF_INET, sin_port=htons(25075), sin_addr=inet_addr("192.168.1.3")}, 16) = -1 EINPROGRESS (Operation now in progress)
# Followed by: select() or poll()
# Reference: man connect

https://fedoramagazine.org/how-to-setup-an-anonymous-ftp-download-server/ https://www.getpagespeed.com/server-setup/firewalld-ftp-rule-allow-access-ftp-service-centos-7 https://serverfault.com/questions/38398/allowing-ftp-with-iptables https://stackoverflow.com/questions/19516263/200-port-command-successful-consider-using-pasv-425-failed-to-establish-connec

specification

http://slacksite.com/other/ftp.html

maximum connections

max in total vs. max per ip / user https://help.directadmin.com/item.php?id=491 http://www.proftpd.org/docs/directives/linked/config_ref_MaxClientsPerUser.html

ambiguous error codes

550 https://kb.globalscape.com/KnowledgebaseArticle10305.aspx?Keywords=mix+error