CentOS - Oct 2011 - VSFTPD passive mode is not working

I have Centos 5.7 64bit; I have installed vsftpd as standalone service and using
it for two years now with no problem. Suddenly; only it works with active mode.
The passive mode stops working and gives time out. Firewall is disabled and
SELinux is set to permissive.

I ran tcpdump and I noticed that only first three packets reached the FTP for
passive mode and no more packets on other ports

# lsmod | grep conntrack

ip_conntrack_ftp?????? 41361? 1 ip_nat_ftp
ip_conntrack_netbios_ns??? 36033? 0
ip_conntrack?????????? 91621? 5
ip_nat_ftp,ip_nat,ip_conntrack_ftp,ip_conntrack_netbios_ns,xt_state
nfnetlink????????????? 40457? 2 ip_nat,ip_conntrack

Any suggestion? 


Eng. Fawzy Ibrahim
Linux Systems Administrator

On Wed, Oct 26, 2011 at 04:37:37AM -0700, Fawzy Ibrhim
wrote:
> I have Centos 5.7 64bit; I have installed vsftpd as standalone service and
using it for two years now with no problem. Suddenly; only it works with active
mode. The passive mode stops working and gives time out. Firewall is disabled
and SELinux is set to permissive.
> 
> I ran tcpdump and I noticed that only first three packets reached the FTP
for passive mode and no more packets on other ports
> 
> # lsmod | grep conntrack
> 
> ip_conntrack_ftp?????? 41361? 1 ip_nat_ftp
> ip_conntrack_netbios_ns??? 36033? 0
> ip_conntrack?????????? 91621? 5
ip_nat_ftp,ip_nat,ip_conntrack_ftp,ip_conntrack_netbios_ns,xt_state
> nfnetlink????????????? 40457? 2 ip_nat,ip_conntrack
> 
> Any suggestion? 
possibly:
https://bugzilla.redhat.com/show_bug.cgi?id=740399

Tru
-- 
Tru Huynh (mirrors, CentOS i386/x86_64 Package Maintenance)
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xBEFA581B
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL:
<http://lists.centos.org/pipermail/centos/attachments/20111026/8d788a6d/attachment-0002.sig>

>> Any suggestion?
> possibly:
> https://bugzilla.redhat.com/show_bug.cgi?id=740399
>
I believe I've run into this problem/that bug as well.

As a workaround, I found that adding the following helped.

pasv_enable=YES
pasv_min_port=35000
pasv_max_port=36000
pasv_address=xxx.xxx.xxx.xxx

If you are NAT'ing, however, it will break passive connections from your
private network.

Hope that helps,
Matt

Yes; it was an issue with Linux kernel?2.6.18-274.*.el5.centos.plus ; so I
switched back to Linux kernel? 2.6.18-238.19.1.el5.centos.plus and it's
working now.