Ubuntu-fr

Mtyrop

Problème de connexion FTP sur serveur Ubuntu

Bonjour à tous,

j'ai un serveur dédié (chez online.net) sous ubuntu 16.04 LTS, j'ai installé proFTPd pour obtenir une connexion FTP vers ce serveur, les ports 20 21 sont bien ouverts dans le firewall mais je n'arrive pas à m'y connecter depuis FileZilla ou Cyberduck.

Message d'erreur sur filezilla :

Statut :         	Connexion à 'server IP':21...
Statut :         	Connexion établie, attente du message d'accueil...
Statut :         	Initialisation de TLS...
Statut :         	Vérification du certificat...
Statut :         	Connexion TLS établie.
Statut :         	Connecté
Statut :         	Récupération du contenu du dossier...
Commande :	PWD
Réponse :     	257 "/" is the current directory
Commande :	TYPE I
Réponse :     	200 Type set to I
Commande :	PORT 10,127,0,238,194,68
Réponse :     	200 PORT command successful
Commande :	MLSD
Erreur :         	Connection interrompue après 20 secondes d'inactivité
Erreur :         	Impossible de récupérer le contenu du dossier

(le 'server IP' correspond bien entendu à l'IP du serveur dédié)

Sur cyberduck, ca bloque sur "Obtention de la liste des fichiers du répertoire /"

Auriez-vous une idée ?
Merci

Dernière modification par Mtyrop (Le 03/01/2019, à 16:43)

bruno

Re : Problème de connexion FTP sur serveur Ubuntu

Bonjour,

Il est impossible de te répondre sans connaître la configuration de ton serveur proftpd.
Pour le pare-feu il faut avoir activé le module nf_conntrack, autoriser les connexions sur les ports 20 et 21 avec ce module et pour les ports > 1024 (cf. la config de proftpd) pour le ftp passif.

Mtyrop

Re : Problème de connexion FTP sur serveur Ubuntu

Bonsoir,

Veuillez m'excuser pour ma réponse tardive, les ports 20 et 21 sont bien entendus ouverts dans mon script firewall, concernant le module nf_conntrack, il est bien activé par défaut ?

Voici mon ficihier proftpd.conf :

#
# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.
# To really apply changes, reload proftpd after modifications, if
# it runs in daemon mode. It is not required in inetd/xinetd mode.
#

# Includes DSO modules
Include /etc/proftpd/modules.conf

# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
UseIPv6                         on
# If set on you can experience a longer connection delay in many cases.
IdentLookups                    off

ServerName                      "Debian"
ServerType                      standalone
DeferWelcome                    off

MultilineRFC2228                on

UseIPv6                         on
# If set on you can experience a longer connection delay in many cases.
IdentLookups                    off

ServerName                      "Debian"
ServerType                      standalone
DeferWelcome                    off

MultilineRFC2228                on
DefaultServer                   on
ShowSymlinks                    on

TimeoutNoTransfer               600
TimeoutStalled                  600
TimeoutIdle                     1200

DisplayLogin                    welcome.msg
DisplayChdir                    .message true
ListOptions                     "-l"

ShowSymlinks                    on

TimeoutNoTransfer               600
TimeoutStalled                  600
TimeoutIdle                     1200

DisplayLogin                    welcome.msg
DisplayChdir                    .message true
ListOptions                     "-l"

DenyFilter                      \*.*/

# Use this to jail all users in their homes
DefaultRoot                     ~

# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
# RequireValidShell             off

DenyFilter                      \*.*/

# Use this to jail all users in their homes
DefaultRoot                     ~

# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
# RequireValidShell             off

# Port 21 is the standard FTP port.
Port                            21

# In some cases you have to specify passive ports range to by-pass
# firewall limitations. Ephemeral ports can be used for that, but
# feel free to use a more narrow range.
# PassivePorts                  49152 65534

# If your host was NATted, this option is useful in order to
# allow passive tranfers to work. You have to use your public

Port                            21

# In some cases you have to specify passive ports range to by-pass
# firewall limitations. Ephemeral ports can be used for that, but
# feel free to use a more narrow range.
# PassivePorts                  49152 65534

# If your host was NATted, this option is useful in order to
# allow passive tranfers to work. You have to use your public
# address and opening the passive ports used on your firewall as well.
# MasqueradeAddress             1.2.3.4

# This is useful for masquerading address with dynamic IPs:
# refresh any configured MasqueradeAddress directives every 8 hours
<IfModule mod_dynmasq.c>
# DynMasqRefresh 28800
</IfModule>

# To prevent DoS attacks, set the maximum number of child processes

# MasqueradeAddress             1.2.3.4

# This is useful for masquerading address with dynamic IPs:
# refresh any configured MasqueradeAddress directives every 8 hours
<IfModule mod_dynmasq.c>
# DynMasqRefresh 28800
</IfModule>

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances                    30

# Set the user and group that the server normally runs at.
User                            proftpd
Group                           nogroup

# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances                    30

# Set the user and group that the server normally runs at.
User                            proftpd
Group                           nogroup

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask                           022  022
# Normally, we want files to be overwriteable.
AllowOverwrite                  on

# Uncomment this if you are using NIS or LDAP via NSS to retrieve passwords:
# PersistentPasswd              off

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask                           022  022
# Normally, we want files to be overwriteable.
AllowOverwrite                  on

# Uncomment this if you are using NIS or LDAP via NSS to retrieve passwords:
# PersistentPasswd              off

# This is required to use both PAM-based authentication and local passwords
# AuthOrder                     mod_auth_pam.c* mod_auth_unix.c

# Be warned: use of this directive impacts CPU average load!
# Uncomment this if you like to see progress and transfer rate with ftpwho
# in downloads. That is not needed for uploads rates.
#
# UseSendFile                   off

TransferLog /var/log/proftpd/xferlog

 AuthOrder                     mod_auth_pam.c* mod_auth_unix.c

# Be warned: use of this directive impacts CPU average load!
# Uncomment this if you like to see progress and transfer rate with ftpwho
# in downloads. That is not needed for uploads rates.
#
# UseSendFile                   off

TransferLog /var/log/proftpd/xferlog
SystemLog   /var/log/proftpd/proftpd.log

# Logging onto /var/log/lastlog is enabled but set to off by default
#UseLastlog on

# In order to keep log file dates consistent after chroot, use timezone info
# from /etc/localtime.  If this is not set, and proftpd is configured to
# chroot (e.g. DefaultRoot or <Anonymous>), it will use the non-daylight
# savings timezone regardless of whether DST is in effect.
#SetEnv TZ :/etc/localtime

# Logging onto /var/log/lastlog is enabled but set to off by default
#UseLastlog on

# In order to keep log file dates consistent after chroot, use timezone info
# from /etc/localtime.  If this is not set, and proftpd is configured to
# chroot (e.g. DefaultRoot or <Anonymous>), it will use the non-daylight
# savings timezone regardless of whether DST is in effect.
#SetEnv TZ :/etc/localtime

<IfModule mod_quotatab.c>
QuotaEngine off
</IfModule>

<IfModule mod_ratio.c>
Ratios off
</IfModule>

Mtyrop

Re : Problème de connexion FTP sur serveur Ubuntu

Voici les règles dans le script firewall concernant le FTP :

# FTP Out
iptables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT

# FTP In
modprobe ip_conntrack_ftp # ligne facultative avec les serveurs OVH
iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# FTP Out
ip6tables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT

# FTP In
ip6tables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT
ip6tables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Dernière modification par Mtyrop (Le 24/01/2019, à 23:04)

bruno

Re : Problème de connexion FTP sur serveur Ubuntu

Il faut essayer sans le pare-feu (qui, par ailleurs, est probablement inutile) pour voir si c'est cela qui bloque.

Par ailleurs le fichier proftpd.conf semble être celui fourni par défaut. Tel quel ce fichier permet a tout utilisateur du système de se connecter à son dossier personnel.

Mtyrop

Re : Problème de connexion FTP sur serveur Ubuntu

Merci pour votre retour