Resolved Additional FTP account shutting right down after opening (via FTP client)

[muckaveli]

Server operating system version

CentOS 7

Plesk version and microupdate number

18.05.54

My Goal

I want to create multiple working FTP accounts.

What works

Domains > Domain > FTP > Add an FTP Account

I can create a very first user that I have no trouble successfully connecting via FTP client (FileZilla) with the Settings:

• Protocol: SFTP - SSH File Transfer Protocol
• Server: my server
• Port: 22
• User
• Pass

The problem

Every additional user after that will connect very briefly and then get kicked out, like this log states:

Status:    Connecting to IP...
Response:    fzSftp started, protocol_version=11
Command:    open "user@IP" 22
Status:    Using username "username".
Command:    Pass: *********
Status:    Connected to IP
Error: Failed to connect to server

Maybe Interesting
In FTP Accounts of domain , if I hover over the first username, the URL behind it is

https://ip/smb/web/edit

, but every additional user has

https://ip/smb/ftp/edit-user/id/4

Do you have any advice on what's going on here?

 

[Peter Debik]

Additional FTP user accounts are only FTP user accounts, not SSH accounts. But you are trying to connect using SFTP to an account that only supports FTP or FTPS. SFTP (on port 22) connects using SSH, then puts the FTP protocol on top. This cannot work. You need to connect using FTP (port 21). Please enter the Port 21 instead of 22 in your FTP client's configuration.

 

[muckaveli]

Additional FTP user accounts are only FTP user accounts, not SSH accounts. But you are trying to connect using SFTP to an account that only supports FTP or FTPS. SFTP (on port 22) connects using SSH, then puts the FTP protocol on top. This cannot work. You need to connect using FTP (port 21). Please enter the Port 21 instead of 22 in your FTP client's configuration.

Thank you for your explanation.

Using FTP via port 21 results in "Connection timed out after 20 seconds of inactivity" followed by "Failed to connect to server". I tried active, passive and standard.

According to my firewall settings, port 21 is open.

Any recommendations how to continue from here on out? Thank you

 

[Peter Debik]

Some datacenters have a firewall in front of the server. It is thinkable that port 21 is closed there and needs to be opened.

 

[trialotto]

Thank you for your explanation.

Using FTP via port 21 results in "Connection timed out after 20 seconds of inactivity" followed by "Failed to connect to server". I tried active, passive and standard.

According to my firewall settings, port 21 is open.

Any recommendations how to continue from here on out? Thank you

@muckaveli

It might be the case that you have one of the FileZilla versions that contains a bug.

Please update to the latest version or - even better - please install FileZilla PRO ...... the paid-for version of FileZilla is less buggy.


If you have the latest FileZilla version, then connection should not be an issue, if and only if you are using the right FTP credentials AND if you are using the correct server settings.


Nevertheless, it is very likely that there is a firewall related issue!

Even if port 21 is open, then a FTP connection might be blocked via the firewall if the passive ports are not allowed to accept connections.

For that reason, you should add the 49152-65535 port range to the firewall and add the IPs that are allowed to connect via FTP.

I am pretty sure that this additional firewall could solve your issue.


Kind regards....

PS Always use the "Passive FTP" settings, for many reasons!

 

[muckaveli]

Some datacenters have a firewall in front of the server. It is thinkable that port 21 is closed there and needs to be opened.

We are customers of IONOS and their tech support said something along the lines of "port 21 is open but there seems to be no service installed behind it". Do you have any idea what that could mean practically?

 

[muckaveli]

@muckaveli

It might be the case that you have one of the FileZilla versions that contains a bug.

Please update to the latest version or - even better - please install FileZilla PRO ...... the paid-for version of FileZilla is less buggy.


If you have the latest FileZilla version, then connection should not be an issue, if and only if you are using the right FTP credentials AND if you are using the correct server settings.


Nevertheless, it is very likely that there is a firewall related issue!

Even if port 21 is open, then a FTP connection might be blocked via the firewall if the passive ports are not allowed to accept connections.

For that reason, you should add the 49152-65535 port range to the firewall and add the IPs that are allowed to connect via FTP.

I am pretty sure that this additional firewall could solve your issue.


Kind regards....

PS Always use the "Passive FTP" settings, for many reasons!

Thank you for your detailed answer.

I am currently running FileZilla v. 3.65.0, which should be the latest. I always keep it up to date and never had issues with any other FTP connection thus far.
The connection has been set to "passive" already (and still is) but unchecking it doesn't change anything either.

The firewall I use is the extension "Firewall" (v. 2.1.5.-412) opening it via Home > Extensions > Firewall gives a lot of options like "FTP server passive ports" and "FTP server" both are set to "Allow incoming from all". I added "Allow incoming from all on port 49152-65535/tcp" but it doesn't change anything.

Do you have any other recommendations? I am very lost at this point.

 

[Peter Debik]

Maybe let Plesk support staff check it on the server? https://support.plesk.com

 

[afuego]

Plesk rule only 1 SFTP user per domain. https://support.plesk.com/hc/en-us/articles/12377932751255

In default configuration it is possible to have only one user that could access domain via SFTP.

 

[muckaveli]

Plesk rule only 1 SFTP user per domain. https://support.plesk.com/hc/en-us/articles/12377932751255

In default configuration it is possible to have only one user that could access domain via SFTP.

So no Plesk user is EVER allowed to use more than one SFTP account? I can't believe there is no solution to this.

 

[muckaveli]

Maybe let Plesk support staff check it on the server? https://support.plesk.com

If I remember correctly they won't help me since my license is not directly purchased from them but via my server-host. My server-host says "this is a root server, so we can't assist you with that". Nobody feels responsible really, that's why I had to come to this forum and bother you guys

 

[afuego]

So no Plesk user is EVER allowed to use more than one SFTP account? I can't believe there is no solution to this.

You can do it but is not supported (the customization). I had a Plesk server on Media Temple with multiple SFTP accounts however I didn't implement this.

 

[afuego]

If I remember correctly they won't help me since my license is not directly purchased from them but via my server-host. My server-host says "this is a root server, so we can't assist you with that". Nobody feels responsible really, that's why I had to come to this forum and bother you guys

Wish you the best luck, you can vote for this feature here Enable chrooted sftp for more than one user per account

 

[Peter Debik]

So no Plesk user is EVER allowed to use more than one SFTP account? I can't believe there is no solution to this.

If you would like to have that feature, please vote for it here:

Enable chrooted sftp for more than one user per account

If I use FTP, I can make as many users as I want. For various reasons, using FTP is not optimal at my workplace. I'd like to be able to let each ftp user I create log in with chrooted sftp. I'm able to modify /etc/passwd and /var/www/vhosts/example.org/etc/passwd to make it work, but doing that...

plesk.uservoice.com

 

[Peter Debik]

If I remember correctly they won't help me since my license is not directly purchased from them but via my server-host. My server-host says "this is a root server, so we can't assist you with that". Nobody feels responsible really, that's why I had to come to this forum and bother you guys

When you bought your license from a reseller, it is cheaper than buying it from Plesk directly, but your reseller is responsible to deliver support. If your reseller does not abide by these terms and does not fulfill that obligation, you can still get support from Plesk directly. Please see this article, how it works:
https://support.plesk.com/hc/en-us/articles/12388090147095-How-to-get-support-directly-from-Plesk-

 

[muckaveli]

Thanks to everyone who contributed to solving my problem.
I actually did manage to create another SFTP account (with separated login credentials) that will work, using this simple tutorial.

New problem
However, the new user will be directed to the directory I'd like him to go BUT he is not chrooted there. Instead, he can navigate through all other directories as well. Any idea how to fix this last problem?

 

[Peter Debik]

That's exactly the point why Enable chrooted sftp for more than one user per account exists.

 

[muckaveli]

That's exactly the point why Enable chrooted sftp for more than one user per account exists.

True. My vote is in.

 

[trialotto]

@muckaveli

Please note that I am a bit lost here, since I see SFTP and FTP(S) mixed in most posts.

What do you exactly want to do? SFTP? or FTPS?

That seems to be a "question after the solution", but it is a relevant question.

In essence, SFTP and FTPS are totally different and both have their advantages and disadvantages.

It is not about "Enable chrooted SFTP for multiple accounts" - which implies a bigger security risk : the attack surface increases.

It is all about performance in daily usage.

In essence, SFTP seems to be more secure, but one can safely doubt this "advantage" in the modern age.

Both FTPS and SFTP use some kind of encryption, but the true advantage of FTPS over SFTP is that FTPS can use multiple connections, as opposed to SFTP (that uses one connection and creates a big overhead, which reduces performance considerably).

This is only a (very) brief summary, but it should give you sufficient "food for thought" - whenever possible, I would opt for FTPS.

In addition, it has to be duly noted that any SFTP client provided with Plesk can be deemed to be "unstable" (and insecure) at this moment.

Again, it is not clear to me what we are talking about ...... FTPS or SFTP.

But answer the question yourself by using FileZilla to the full extent and transfer 20 individual test files of 1 GB to your remote server : once with SFTP and once with FTPS ........ and you will probably conclude that it is just as easy to use FTPS.

It is just a consideration.

Kind regards....

 

[muckaveli]

@muckaveli

Please note that I am a bit lost here, since I see SFTP and FTP(S) mixed in most posts.

What do you exactly want to do? SFTP? or FTPS?

That seems to be a "question after the solution", but it is a relevant question.

In essence, SFTP and FTPS are totally different and both have their advantages and disadvantages.

It is not about "Enable chrooted SFTP for multiple accounts" - which implies a bigger security risk : the attack surface increases.

It is all about performance in daily usage.

In essence, SFTP seems to be more secure, but one can safely doubt this "advantage" in the modern age.

Both FTPS and SFTP use some kind of encryption, but the true advantage of FTPS over SFTP is that FTPS can use multiple connections, as opposed to SFTP (that uses one connection and creates a big overhead, which reduces performance considerably).

This is only a (very) brief summary, but it should give you sufficient "food for thought" - whenever possible, I would opt for FTPS.

In addition, it has to be duly noted that any SFTP client provided with Plesk can be deemed to be "unstable" (and insecure) at this moment.

Again, it is not clear to me what we are talking about ...... FTPS or SFTP.

But answer the question yourself by using FileZilla to the full extent and transfer 20 individual test files of 1 GB to your remote server : once with SFTP and once with FTPS ........ and you will probably conclude that it is just as easy to use FTPS.

It is just a consideration.

Kind regards....

What I am trying to archive is setting up whatever working access for a third party developer to help me maintain my website. At this point, I really don't care if it's SFTP or FTP (yes, I am aware it's outdated) as long as it works. I just need to grant somebody a QUICK and RESTRICTED (as in not being able to view the root directory but being locked to a staging version of my project) access to the files on my server, that's it. Trying to make that happen is starting to become a bigger issue than the one I needed the developer to solve for me in the first place

Do you see any way I could get this done?