Error: Failed to retrieve directory listing

How to configure vsftpd to work with passive mode

up vote        22        down vote        favorite         11

Whenever I install vsftpd on centos, I only setup the jail environment for the users and rest is default configuration of vsftpd. I create user and try to connect with filezila ftp client but I could not connect with passive mode. I always change the "transfer settings" to active mode to successfully connect to the ftp server otherwise I get  Error: Failed to retrieve directory listing So is there a way to change any directive in vsftp.conf file and we can connect with passive mode to the server? Update: Thanks to all working well with the answers given. centos ftp     shareimprove this question edited Aug 25 '12 at 23:43                 asked Aug 25 '12 at 16:22         Toqeer        5101416

add a comment

4 Answers

active        oldest        votes

   

up vote        38        down vote        accepted

To configure passive mode for vsftpd you need to set some parameters in vsftpd.conf. pasv_enable=Yes pasv_max_port=10100 pasv_min_port=10090 This enables passive mode and restricts it to using the ten ports for data connections. This is useful as you need to open these ports on your firewall. iptables -I INPUT -p tcp --destination-port 10090:10100 -j ACCEPT If after testing this all works then save the state of your firewall with service iptables save which will update the /etc/sysconfig/iptables file. To do this is CentOS 7 you have to use the new firewalld, not iptables: Find your zone: # firewall-cmd --get-active-zones public   interfaces: eth0 My zone is 'public', so I set my zone to public, add the port range, and after that we reload: # firewall-cmd --permanent --zone=public --add-port=10090-10100/tcp # firewall-cmd --reload What happens when you make a connection Your client makes a connection to the vsftpd server on port 21. The sever responds to the client telling it which port to connect to from the range specified above. The client makes a data connection on the specified port and the session continues. There is a great explanation of the different ftp modes here. shareimprove this answer edited Mar 23 at 7:21         Mark Hughes        33     answered Aug 25 '12 at 16:48         Iain        75k784161

add a comment

up vote        14        down vote

To enable passive mode, set the following configuration options in your vsftp.conf: pasv_enable=YES pasv_min_port=41361 pasv_max_port=65534 pasv_address=xxx.xxx.xxx.xxx You can of course change the start and end port, and should replace the xxx's with the public IP of your server. In addition, you should open the passive mode port range in your firewall. On centos, you can load the ip_conntrack_ftp module to handle ftp connections in your firewall. Edit /etc/sysconfig/iptables-config and add ip_conntrack_ftp to the IPTABLES_MODULES option. Afterwards restart iptables: /sbin/service iptables restart     shareimprove this answer edited Aug 25 '12 at 16:56                 answered Aug 25 '12 at 16:47         brain99        1,352416

add a comment

up vote        2        down vote

Beside the pasv_enable=YES, specify a port range in which VSFTP will run PASV mode: pasv_min_port=50000 pasv_max_port=50999 port_enable=YES Don't forget to configure iptables allows packet transmission on these ports: iptables -I INPUT -p tcp --dport 50000:50999 -j ACCEPT     shareimprove this answer edited Aug 25 '12 at 16:59         Iain        75k784161     answered Aug 25 '12 at 16:47         quanta        33.7k567140

On a standard CentOS system there is a blanket DROP that causes rules added with iptables -A INPUT ... to be ignored                    �C Iain                Aug 25 '12 at 16:59                                                                                                 add a comment

                       

up vote        1        down vote

Usually, it's not the ftp server, vsftpd, but the firewall like iptable that prevents passive mode from being used (blocking tcp connection needed for data transfert). shareimprove this answer answered Aug 25 '12 at 16:40