☰

proftpd 终止会话并显示 421 超时错误消息

tag-icon • tag-icon linux ftp proftpd
proftpd 终止会话并显示 421 超时错误消息

问题

Proftpd 1.3.6（从 1.3.1 更新，具有相同问题）上的连接在传输带有消息的数据时被终止：

421 无传输超时（3600 秒）：关闭控制连接

登录后到出现错误的时间各不相同，可能从 5 秒到几分钟不等。我们检查了日志（下面列出的摘录），但找不到该行为的明确原因。如果仅连接一个用户并且打开来自同一用户的并发会话，则可能会发生此错误。

Wireshark显示“421：无传输超时”是从服务器发送给客户端的回复。

Proftpd 运行在 ESXi 4.1 上相当旧的虚拟 openSuse 系统上。仅该ftpusr帐户用于 FTP 传输。

提前感谢您的帮助。

日志摘录

FTP客户端日志：

{snip}
150 Opening ASCII mode data connection for xyz_XML_Interface-Rawdata_20171124_16
1300_43864.tmp (597 bytes)
226 Transfer complete
ftp: 611 bytes received in 0.00Seconds 611000.00Kbytes/sec.
200 PORT command successful
150 Opening ASCII mode data connection for xyz_XML_Interface-Rawdata_20171209_06
5800_63895.tmp (443 bytes)
226 Transfer complete
ftp: 456 bytes received in 0.00Seconds 456.00Kbytes/sec.
200 PORT command successful
150 Opening ASCII mode data connection for xyz_XML_Interface-Rawdata_20171230_09
2000_93119.tmp (277 bytes)
226 Transfer complete
ftp: 288 bytes received in 0.00Seconds 288000.00Kbytes/sec.
421 No transfer timeout (3600 seconds): closing control connection
Connection closed by remote host.
ftp> mget *
Not connected.

Proftpd 调试输出：

使用以下命令启动 proftpd 时，从屏幕输出中获取以下日志proftpd -d 5 -c /etc/proftpd.conf -n：

{snip}
2018-02-07 16:25:11,407 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): dispatching PRE_CMD command 'PORT 10,1,70,112,229,162' to mod_core
2018-02-07 16:25:11,407 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): dispatching PRE_CMD command 'PORT 10,1,70,112,229,162' to mod_core
2018-02-07 16:25:11,407 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): dispatching CMD command 'PORT 10,1,70,112,229,162' to mod_core
2018-02-07 16:25:11,407 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): dispatching LOG_CMD command 'PORT 10,1,70,112,229,162' to mod_log
2018-02-07 16:25:11,454 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): dispatching PRE_CMD command 'RETR xyz_XML_Interface-Rawdata_20171129_064100_50277.tmp' to mod_core
2018-02-07 16:25:11,454 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): dispatching PRE_CMD command 'RETR xyz_XML_Interface-Rawdata_20171129_064100_50277.tmp' to mod_core
2018-02-07 16:25:11,454 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): dispatching PRE_CMD command 'RETR xyz_XML_Interface-Rawdata_20171129_064100_50277.tmp' to mod_auth
2018-02-07 16:25:11,454 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): dispatching PRE_CMD command 'RETR xyz_XML_Interface-Rawdata_20171129_064100_50277.tmp' to mod_xfer
2018-02-07 16:25:11,454 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): dispatching CMD command 'RETR xyz_XML_Interface-Rawdata_20171129_064100_50277.tmp' to mod_xfer
2018-02-07 16:25:11,505 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): active data connection opened - local  : 10.15.87.17:20
2018-02-07 16:25:11,505 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): active data connection opened - remote : 10.1.70.112:58786
2018-02-07 17:38:29,580 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): Data transfer stall timeout: 3600 seconds
2018-02-07 16:25:11,566 Oracle2db proftpd[15663] 10.15.87.17 (10.1.70.112[10.1.70.112]): notice: user ftpusr: aborting transfer: Data connection closed

Wireshark 截图：

记录的请求和响应

配置

proftpd.conf：

# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use.  It establishes a single server
# and a single anonymous login.  It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.

ServerName                      "3.0 Linux-FTP"
ServerType standalone
DefaultServer                   on
RequireValidShell off
ExtendedLog /var/log/ftp.log
UseReverseDNS off
IdentLookups off
TimeoutLogin 120
TimeoutIdle 3600
TimeoutNoTransfer 3600
TimeoutStalled 3600
MaxClientsPerHost 2 "Two clients by hostname max"
MaxClientsPerUser 5 "Only one connection per user allowed"
MaxClients 4 "Too many users, please try again later"
MaxHostsPerUser 5 "Only one host per user allowed"
MaxLoginAttempts 2 "You've reached the max. login attempts"
UseSendfile off

# Port 21 is the standard FTP port.
Port                            21

# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask                           022

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd).
MaxInstances                    30

# Set the user and group under which the server will run.
User                            ftpusr
Group                           ftpusers

# To cause every FTP user to be "jailed" (chrooted) into their home
# directory, uncomment this line.
DefaultRoot /home/ftpusr/xml-export
# DefaultRoot ~

# Normally, we want files to be overwriteable.
AllowOverwrite          on

<Directory /home/ftpusr/xml-export>
Umask 022 022
</Directory>

答案1

查看您的wireshark，您似乎在客户端中使用FTP主动模式。我建议使用被动模式的 FTP。

被动模式可以更好地配合防火墙规则。

看主动 FTP 与被动 FTP，权威解释

也可以看看如何检查被动和主动 FTP

在主动模式连接中，当客户端建立初始连接并发送 PORT 时，服务器会发起第二个连接。在被动连接中，客户端连接并发送 PASV 命令，该命令充当对要连接的端口号的请求。

相关内容