ProFTPD Issue

[James Heller]

Hello, i just have installed plesk panel and when i get to the "Firewall" tool, then clicked on "Enable Firewall Rules Management", proftpd has stopped working properly.

Here are some screenshots:

http://i.gyazo.com/e5731f362df9dd8d104f2f639538097e.png
http://i.gyazo.com/13ffea392878c548788c9d6d108358f8.png
http://i.gyazo.com/d9c22f75a43d2fca0cfc35e285603bf3.png

I have preinstalled the server 2 times, and every time i try to edit the firewall rules, proftpd got broken.

 

[UFHH01]

Hi James Heller,

I assume that this is still a CentOS related issue, please see KB - article 125 519 ( proftpd: PAM adding faulty module: /lib64/security/pam_stack.so ) for a solution provided in the Odin Knowledge-Base.

 

[James Heller]

By the way, i have preinstalled again, and havent touched the "Firewall" option yet and the ftp is working fine. Could you assure me that if i follow the steps from the article you gave me it wont break again?

 

[UFHH01]

Hi James Heller,

as stated in the KB - article, you should make a backup of your "/etc/pam.d/proftpd" - file, if you experience issues after the provided steps, please use the backup, in order to restore your own settings!

 

[James Heller]

The problem is that i already have tried this method. It does not work. When i try to modify the firewall rules, this issue appears and all these methods to fix it, they don't work. Today i tried like 20 times and reinstalled 4 times plesk.

 

[RuslanT]

Hello,
Make sure that ip_conntrack_ftp module is loaded - see details in KB article: My server is behind a firewall. How do I configure a passive ports range for ProFTPd?

 

[James Heller]

Hello,
Make sure that ip_conntrack_ftp module is loaded - see details in KB article: My server is behind a firewall. How do I configure a passive ports range for ProFTPd?

I am talking about the Plesk's Firewall. Even if i dont change any settings, if i click to modify the firewall rules, this issue appears. It is not blocking the ftp port or anything else..

 

[RuslanT]

Plesk Firewall is just a wrapper for iptables. If conntrack_ftp module isn't loaded then passive ftp will be blocked by iptables.
For example (no conntrack_ftp module is loaded):
active ftp works:

~$ ftp 10.52.53.101
Connected to 10.52.53.101.
220 ProFTPD 1.3.5 Server (ProFTPD) [10.52.53.101]
Name (10.52.53.101:ruslant): ftpuser
331 Password required for ftpuser
Password:
230 User ftpuser logged in
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful
150 Opening BINARY mode data connection for file list
drwxr-xr-x   2 ftpuser  psacln       4096 Jun 24 18:38 error_docs
drwxr-x---   6 ftpuser  psaserv      4096 Jun 24 18:38 httpdocs
drwx------   2 ftpuser  root         4096 Jun 26 17:21 logs
226 Transfer complete
ftp> quit
221 Goodbye.

passive ftp doesn't work:

~$ ftp -p 10.52.53.101
Connected to 10.52.53.101.
220 ProFTPD 1.3.5 Server (ProFTPD) [10.52.53.101]
Name (10.52.53.101:ruslant): ftpuser
331 Password required for ftpuser
Password:
230 User ftpuser logged in
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (10,52,53,101,228,120).
ftp: connect: Connection timed out
ftp>

after loading the module:

[root@a10-52-53-101 ~]# modprobe ip_conntrack_ftp
[root@a10-52-53-101 ~]# lsmod | grep conntrack_ftp
nf_conntrack_ftp       12913  0
nf_conntrack           79758  6 nf_conntrack_ftp,iptable_nat,nf_nat,nf_conntrack_ipv6,nf_conntrack_ipv4,xt_state

it works:

~$ ftp -p 10.52.53.101
Connected to 10.52.53.101.
220 ProFTPD 1.3.5 Server (ProFTPD) [10.52.53.101]
Name (10.52.53.101:ruslant): ftpuser
331 Password required for ftpuser
Password:
230 User ftpuser logged in
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (10,52,53,101,192,180).
150 Opening BINARY mode data connection for file list
drwxr-xr-x   2 ftpuser  psacln       4096 Jun 24 18:38 error_docs
drwxr-x---   6 ftpuser  psaserv      4096 Jun 24 18:38 httpdocs
drwx------   2 ftpuser  root         4096 Jun 26 17:21 logs
226 Transfer complete
ftp> quit
221 Goodbye.

 

[James Heller]

Im trying to say that i havent changed any firewall settings. I just click to modify the firewall settings (without changing any settings) and i get these errors that you can see at the screenshots from my first post.

I just click that button and proftpd fails with the pem errors.

I can give an access to my server and plesk's acp to the plesk developers, but i need you to contact with me by email first.

 

[RuslanT]

Ok. I understand what do you mean now. There is no "Enable" or "Activate" button because iptables is allways working and Plesk Firewall gives only GUI to manage its rules. Enabling Firewall Management actually applies the listed rules to iptables which are by default works in "allow all" mode. And the default Plesk rules blocks passive ftp on systems where conntrack_ftp module isn't loaded.

 

[James Heller]

Oh, i did everything the both of you said, then i modified the firewall rules and now the ftp works! Thank you so much!