登陆vsftpd后提示425 Security: Bad I

cnhnln

机器在一个路由后面。路由上做的NAT，断口已经映射到vsftpd所在服务器
通过路由器的公网IP访问，能登陆，不能列目录、下载
[code:1]
[root@www vsftpd]# ftp 61.52.112.30 2121
Connected to 61.52.112.30.
220 ▒▒ӭ▒▒▒ ▒▒FTP▒▒▒▒▒▒
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (61.52.112.30:root): ftpuser
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,0,9,195,83)
425 Security: Bad IP connecting.
ftp> pwd
257 "/"
ftp> size 1111
213 0
ftp> get 1111
local: 1111 remote: 1111
227 Entering Passive Mode (192,168,0,9,195,83)
425 Security: Bad IP connecting.
ftp> bye
221 Goodbye.
[/code:1]
但是直接在内网连vsftpd所在的服务器可以下载
[code:1]
[root@www vsftpd]# ftp 192.168.0.9 2121
Connected to 192.168.0.9.
220 ▒▒ӭ▒▒▒ ▒▒FTP▒▒▒▒▒▒
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (192.168.0.9:root): ftpuser
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pwd
257 "/"
ftp> ls
227 Entering Passive Mode (192,168,0,9,195,80)
150 Here comes the directory listing.
-rw-rw-rw-    1 ftp      ftp             0 Feb 09 22:52 1111
drwxrwxrwx    2 ftp      ftp          4096 Feb 09 18:12 pub
226 Directory send OK.
ftp> get 1111
local: 1111 remote: 1111
227 Entering Passive Mode (192,168,0,9,195,82)
150 Opening BINARY mode data connection for 1111 (0 bytes).
226 File send OK.
ftp> bye
221 Goodbye.[/code:1]
这是我的vsftpd.conf
[code:1]
[root@www vsftpd]# cat vsftpd.conf
listen=YES
listen_port=2121

port_enable=NO
pasv_enable=YES
pasv_min_port=50000
pasv_max_port=50009

ascii_upload_enable=NO
ascii_download_enable=NO

idle_session_timeout=120
data_connection_timeout=120
accept_timeout=60

max_clients=100
max_per_ip=2

anonymous_enable=NO
anon_upload_enable=NO
anon_mkdir_write_enable=NO
anon_other_write_enable=NO

local_enable=YES
local_root=/home/vsftpdvirtual/

guest_enable=YES
guest_username=vsftpdvirtual

pam_service_name=vsftpd
userlist_enable=YES
userlist_file=/etc/vsftpd.user_list
userlist_deny=NO
tcp_wrappers=NO

#chroot_list_enable=YES
#chroot_list_file=/etc/vsftpd/chroot_list
##chroot_local_users=NO

hide_ids=YES
ls_recurse_enable=NO
write_enable=YES

file_open_mode=0666
local_umask=022

ftpd_banner=▒▒ӭ▒▒▒ ▒▒FTP▒▒▒▒▒▒
banner_file=/etc/vsftpd/vsftpd_banner_file
dirmessage_enable=YES

xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=NO
log_ftp_protocol=NO

setproctitle_enable=NO
#text_userdb_names=YES
use_localtime=YES
[/code:1]
这是我的vsftpd的pam配置文件
[code:1]
[root@www vsftpd]# cat /etc/pam.d/vsftpd
#%PAM-1.0
auth       required     pam_listfile.so item=user sense=deny file=/etc/vsftpd.ftpusers onerr=succeed
#auth       required    pam_stack.so service=system-auth
#auth       required    pam_shells.so
#account    required    pam_stack.so service=system-auth
#session    required    pam_stack.so service=system-auth
#session    required     pam_loginuid.so
auth required /lib64/security/pam_userdb.so db=/etc/vsftpd/account
account required /lib64/security/pam_userdb.so db=/etc/vsftpd/account
[/code:1]
ftp的根目录已经是所有人可读写执行
[code:1]
drwxrwxrwx  3 vsftpdvirtual vsftpdvirtual  4096  2月  9 23:05 vsftpdvirtual
[/code:1]
感觉还是虚拟用户、pam认证这一块出错了，但是不知道该怎么弄了，郁闷阿，谁来帮帮我。谢谢

cnhnln

顺便说一下，公社的帖子标题数限制的太短了

Bluedata

3n 怎么不用 pure-ftpd ，proftpd 呢？配合 MySQL 使用，很强啊。

cnhnln

我就要用vsftpd

dannycat

[quote:3be9a77746="cnhnln"]机器在一个路由后面。路由上做的NAT，断口已经映射到vsftpd所在服务器
通过路由器的公网IP访问，能登陆，不能列目录、下载[/quote]
典型的端口限制问题。
在做路由的机器上加载 ip_nat_ftp 模块。

cnhnln

本来是内网的人也不能登陆（ftp的根目录只有所有者和同组用户可以读写进入），后来把ftp的根目录改成所有人都可读写进入，内网的用户就能登陆了，但是外网的还是不行

cnhnln

而且nat的那台机器是专用的OS，不是pc+linux的

dannycat

专用的 OS …… 也应该有类似于 ip_conntrack_ftp/ip_nat_ftp 这种“有状态连接跟踪”的功能吧？
否则的话那就只能使用主动模式来访问，路由器同时要放开 ftp-data 端口 20。

cnhnln

成功 :-)
[code:1]
pasv_address=61.52.112.30
anon_world_readable_only=NO
[/code:1]
虚拟用户就可以下载也可以ls了

cnhnln

[code:1]
pasv_address=61.52.112.30
anon_world_readable_only=YES（默认值）就不行
[/code:1]
[code:1]
[root@www vsftpd]# ftp 61.52.112.30 2121
Connected to 61.52.112.30.
220 ftpppppppppppppppppppppppppppppppp
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (61.52.112.30:root): aaaaaa
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (61,52,112,30,195,87)
ftp: connect: Connection refused
ftp> size hosts
213 183
ftp> get hosts
local: hosts remote: hosts
227 Entering Passive Mode (61,52,112,30,195,89)
[/code:1]
到这里就卡住鸟。可以登录，但是不能列目录、不能下载

cnhnln

[code:1]
#pasv_address=61.52.112.30（不绑定pasv模式的IP，默认值）
anon_world_readable_only=NO
[/code:1]
也不行
[code:1]
[root@www vsftpd]# ftp 61.52.112.30 2121
Connected to 61.52.112.30.
220 ftpppppppppppppppppppppppppppppppp
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (61.52.112.30:root): aaaaaa
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,0,9,195,84)
425 Security: Bad IP connecting.
ftp> size hosts
213 183
ftp> get hosts
local: hosts remote: hosts
227 Entering Passive Mode (192,168,0,9,195,89)
425 Security: Bad IP connecting.
ftp> bye
221 Goodbye.
[/code:1]
可以登录，但是不能列目录、不能下载

gugong

[quote:196abe5915="cnhnln"][code:1]
#pasv_address=61.52.112.30（不绑定pasv模式的IP，默认值）
anon_world_readable_only=NO
[/code:1]
也不行
[code:1]
[root@www vsftpd]# ftp 61.52.112.30 2121
Connected to 61.52.112.30.
220 ftpppppppppppppppppppppppppppppppp
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (61.52.112.30:root): aaaaaa
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,0,9,195,84)
425 Security: Bad IP connecting.
ftp> size hosts
213 183
ftp> get hosts
local: hosts remote: hosts
227 Entering Passive Mode (192,168,0,9,195,89)
425 Security: Bad IP connecting.
ftp> bye
221 Goodbye.
[/code:1]
可以登录，但是不能列目录、不能下载[/quote]
[quote:196abe5915="dannycat"]专用的 OS …… 也应该有类似于 ip_conntrack_ftp/ip_nat_ftp 这种“有状态连接跟踪”的功能吧？
否则的话那就只能使用主动模式来访问，路由器同时要放开 ftp-data 端口 20。[/quote]