HOWTO : Create a FTP server with user access (proftpd)

[mssm]

I have success at last

I can ftp from the machine itself and from another computer inside home on the same network. The actual test whether I can access it from outside, will be done tomorrow. But I am hopeful that I shall succeed. (Update : Now I can access it from outside; see my next post below).

Thanks Frodon and everybody else in this forum. I am a longtime reader of this great howto thread and this my first post. For my research collaboration I made a plan to run a ftp server on my home laptop. Since I using a cable modem(Motorola SBG 900E), I am behind the firewall of the router. I faced all kind of problems similar to Steve_250 of this thread. Initially I had 530 error related to password, I had error 500 for invalid port etc etc. I would like to share how I did overcome all of these problems.

1. I followed Frodon's how-to in toto. I didn't use gproftpd. I just copied and pasted his proftpd.conf with few exceptions, e.g. I put AuthAliasOnly to ``off''. Since I am behind a firewall of the router and my ISP provided me with dynamic IP address, I had to install ddclient first and registered my computer at dyndns.com. Then I had to add two lines related to MasqueradeAddress and PassivePorts, as Frodon mentioned, at the end of the file. Finally, I attached two lines as jinc1 suggested. I attached the copy of my proftpd.conf.

2. Next I added the users from the command line but their passwords were added NOT from the command line but from the tool Ubuntu provided : Kmenu --> System --> User Groups(I'm running Kubuntu. Under Gnome I think it's under System). This is fairly easy to do. I checked that everything is consistent with other commands that Frodon's guide provided, e.g. no users get a shell(/bin/false). If I issue the passwd of the users from command line, somehow all the time I got 530 error.

3. Next thing was to configure my router. First, I made sure that my ISP do not block the ports 1980 and the ports 60000-65535. The former is used by proftpd and the latter are the passive ports. Now the firewall and port forwarding config. of my router looks like this :

Firewall
--------

Port ID : proftpd
Enable : yes(tick)
Allowed Protocol : TCP
Allowed Range : 1980:1980
Allow Inbound : Yes
Allow Outbound : Yes
Protocol # : 0

Similarly I defined another Port ID : proftpd-passive. For this, the allowed range is 60000:65535 and all other parameters remaining exactly the same.

The names of the Port ID can be anything.

Port Forwarding
-----------------

Name : proftpd
Port Start : 1980
Port End : 1980
LAN IP Address : 192.168.0.10
Enable : yes

Similarly, I define another port called profptd-passive for which Port Start =60000 and Port End = 65535, and all other parameters remaining the same.
Here 192.168.0.10 is the internal LAN IP address assigned to my laptop by the router dynamically(using DHCP). Since my laptop remains on all the time I didn't go for a static address, though I recommend others to do so.

That's it. If I don't forward all the ports including the passive one I shall get error 500 or the infinite time loop which Steve_250 experienced. I can access it from a Windows machine within the same network, using WS_FTP.

[frodon]

Hey mssm

A BIG BIG thank you for this post, really useful, i will put a link to this post in the guide.
Thanks for sharing your experience

[mssm]

Hey mssm

A BIG BIG thank you for this post, really useful, i will put a link to this post in the guide.
Thanks for sharing your experience

Thanks Frodon. It's working from browser(e.g. firefox) also. I can also access it from outside.

[t0bb3]

I'm having problems accessing my ftp server from outside the lan. I always get this error: "500 Illegal PORT command".
I have forwarded the neccessary ports in my router. I confirmed this by setting Apache to listen to one of the ports in the interval, and I could access it.

I have also added the MasqueradeAddress, PassivePorts, UseReverseDNS and IdentLookups options to proftpd.conf

What else should I do?

The ftp server works great inside the lan, both in active and in passive mode

[mssm]

I'm having problems accessing my ftp server from outside the lan. I always get this error: "500 Illegal PORT command".
I have forwarded the neccessary ports in my router. I confirmed this by setting Apache to listen to one of the ports in the interval, and I could access it.

I have also added the MasqueradeAddress, PassivePorts, UseReverseDNS and IdentLookups options to proftpd.conf

What else should I do?

The ftp server works great inside the lan, both in active and in passive mode

Hi t0bb3, did you opened all the relevant ports like 1980 and passive ones in your firewall? Allow both incomin and outgoing and the protocol should be TCP. Make sure your ISP do not block any of these ports. Many ISPs block some of them in order that nobody can run server from home.

Did you create password for the user using the GUI ubuntu provide?

Another point : did you put AuthAliasOnly to off, like mine? Can you do one thing? Just back up your copy of proftpd.conf and use mine instead and tell me whether you are getting the same result? I am telling you all these since I got this 500 error:illegal ports infinite number of times before getting it working. Good luck

[t0bb3]

Hi t0bb3, did you opened all the relevant ports like 1980 and passive ones in your firewall?

What is port 1980? Yes, I have all the passive ports open.

Allow both incomin and outgoing and the protocol should be TCP. Make sure your ISP do not block any of these ports. Many ISPs block some of them in order that nobody can run server from home.

They are open both ways, and if I run my webserver on one of the ports I can connect to it, so they aren't blocked by my ISP

Did you create password for the user using the GUI ubuntu provide?

Another point : did you put AuthAliasOnly to off, like mine?

I don't think there is anything wrong with the passwords. All accounts work when I try them in my lan, and they work if I connect to them in active mode from the outside.

Can you do one thing? Just back up your copy of proftpd.conf and use mine instead and tell me whether you are getting the same result? I am telling you all these since I got this 500 error:illegal ports infinite number of times before getting it working.

Yes, I will try that.

Good luck

Thanks, I will need it

[t0bb3]

I saw in your config file that you use port 1980 as your ftp port... I use another port, but yeah, that port is open and forwarded in my router.

I have also tried your config file (with the needed changes). Got the same 500 error

[mssm]

t0bb3, just to make sure :
1) Did you check that your internal IP address didn't change meanwhile?
2) If your ISP provide you with a dynamic IP address, your fwding to some dynamic dns host like dyndns.org by some client and that client is running?
3) Did you try to ftp on the same machine and still you are getting 500 error?
4) If you turn on logging, what do they say?

I am sure this has to do with your router's firewall and port forwarding config.

[t0bb3]

1) I have static IPs in my lan, so it didn't change
2) Yes, I get a dynamic IP from my ISP, and yes I use dyndns.com. My router has built in support for updating dyndns, so it is always up to date. Everyone can connect to the webserver I've got running on the same machine as the ftp server, so the address isn't a problem
3) What do you mean? I can connect to the ftp server from all computers in my lan, and active connections from internet works.
4) I've got logging on. What should I look for?

First I could only connect to the ftp server from the other computers in my lan using the internal IP, but when I added "AllowForeignAddress on" I could also connect to the server using my dyndns.com address from within my lan. (I used to get the 500 error when I tried that). But other ppl can't connect over the internet. But they don't get error 500 any more, now they get "Unknown error"...

Thanks for helping

[t0bb3]

A little more info on what is going on now when I try to connect... (I actually got a real error message this time)

ftp> open address port
Connected to address
220 ProFTPD 1.2.10 Server (t0bb3's ftp) [Ip.address]
Name (address:local user): ftp login name
331 Password required for ftp login name.
Password:
230 User ftp login name logged in.
ftp> dir
200 PORT command successful
425 Unable to build data connection: Connection timed out