No ftp login for ispconfig-webuser

Discussion in 'Installation/Configuration' started by agri, Mar 7, 2007.

  1. agri

    agri New Member

    I searched different forums to shed light on my problem - no solution yet, so I have the heart to ask:

    I want to connect to a VMware virtual machine via ftp. This does not work:

    I use
    • a server with SUSE 10 (no FTP-server on the host!)
    • VMware - only one VM at the moment
    • Network: nat
    • virtual machine: ISPConfig-appliance (Debian)

    ISPConfig is running.
    I have set up one client and one web with just one user for mail/ftp.
    Within ISPConfig FTP is set to "on" for the created web.

    What I CAN do:
    I can access my VM from 'outside' via http and https using the host IP, i.e.
    I can access serverconsole, config-panel, "shared-IP-adress"-page and the user's page at ../~webx_user/.

    From the shell of ISPConfig I get ftp at localhost running ok.
    Login to config-panel as admin: I can use WebFTP.

    What I CANNOT do:
    if I try to get FTP-access to my VM with an ftp-client (such as WinFTP) from outside, I get "connection refused" - no access possible.

    This seems not to be due to firewall settings, because I get the same, when I switch off the firewalls (host and guest).

    I tried to solve it by setting port 8887 in /etc/vmware/vmnet8/nat/nat.conf (8887 = 192.168.77.10:21) and connecting to port 8887 with my ftp-client as well as by activating ports under 1024 in /usr/lib/vmware/configurator/vmnet-nat.conf manually:
    > [privilegedTCP]
    > autodetect = 1
    > port = 21

    Negative :(

    Any ideas?

    Regards
    agri
     
    Last edited: Mar 7, 2007
  2. falko

    falko Super Moderator

    Does your SuSE firewall allow connections on port 21?

    Did you try both active and passive transfers in your FTP client?
     
  3. agri

    agri New Member

    Hi Falko!

    Yes, it does. But it does not even work, if I switch off the firewall...

    Yes, I did.

    BTW: the user in question is NOT administrator - nonetheless he should be able to access his own webspace at .../~webx_username, shouldn't he?

    Regards
    agri
     
  4. till

    till Super Moderator

    Yes.

    Please post the output of:

    nestat -tap

    and:

    iptables -L
     
  5. agri

    agri New Member

    netstat -tap (rather long ...)

    Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
    tcp 0 0 *:vmware-authd *:* LISTEN 7483/xinetd
    tcp 0 0 *:5801 *:* LISTEN 7483/xinetd
    tcp 0 0 *:mysql *:* LISTEN 7578/mysqld
    tcp 0 0 *:8333 *:* LISTEN 7624/httpd.vmware
    tcp 0 0 *:5901 *:* LISTEN 7483/xinetd
    tcp 0 0 *:sunrpc *:* LISTEN 7326/portmap
    tcp 0 0 *:http-alt *:* LISTEN 8004/python
    tcp 0 0 *:ndmp *:* LISTEN 7557/perl
    tcp 0 0 *:6001 *:* LISTEN 16385/Xvnc
    tcp 0 0 *:intu-ec-client *:* LISTEN 8004/python
    tcp 0 0 *:ipp *:* LISTEN 8002/cupsd
    tcp 0 0 *:radan-http *:* LISTEN 8004/python
    tcp 0 0 localhost:smtp *:* LISTEN 7705/master
    tcp 0 0 *:8222 *: * LISTEN 7624/httpd.vmware
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.k:imgames VERBUNDEN 16385/Xvnc
    tcp 0 0 localhost:10274 localhost:5901 VERBUNDEN 16377/0
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-:fastechnologlm VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.ku:cardax VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell:cplscrambler-lg VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850:webobjects VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-185:ansoft-lm-2 VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-185:ansoft-lm-1 VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-18:amt-esd-prot VERBUNDEN 16385/Xvnc
    tcp 0 36 eo-dell-1850f.ku-e:6001 eo-dell-1850f: pvuniwien VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.ku-:socks VERBUNDEN 16385/Xvnc
    tcp 0 0 localhost:5901 localhost:10274 VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e: 6001 eo-dell-1:gmrupdateserv VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f:syscomlan VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.:nicelink VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.ku-:rootd VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.ku: proofd VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.ku-: obrpd VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.ku-:ff-sm VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.ku:ff-fms VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.ku-e:9792 VERBUNDEN 16385/Xvnc
    tcp 32 0 eo-dell-1850f.ku-e:9792 eo-dell-1850f.ku-e:6001 VERBUNDEN 16392/-eo-dell-1850
    tcp 0 32 eo-dell-1850f.ku-e:6001 eo-dell:cplscrambler-al VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-1850f.ku-e:mctp VERBUNDEN 16385/Xvnc
    tcp 0 0 eo-dell-1850f.ku-e:6001 eo-dell-185:rmiregistry VERBUNDEN 16385/Xvnc
    tcp 0 0 localhost:exosee localhost:sunrpc TIME_WAIT -
    tcp 0 0 localhost:cap localhost:sunrpc TIME_WAIT -
    tcp 0 0 localhost:blackjack localhost:sunrpc TIME_WAIT -
    tcp 0 0 localhost:iad2 localhost:sunrpc TIME_WAIT -
    tcp 0 0 localhost:iad1 localhost:sunrpc TIME_WAIT -
    tcp 0 0 localhost:solid-mux localhost:sunrpc TIME_WAIT -
    tcp 0 0 localhost:1028 localhost:sunrpc TIME_WAIT -
    tcp 0 0 eo-dell-1850f.ku:ff-fms eo-dell-1850f.ku-e:6001 VERBUNDEN 16553/konqueror [kd
    tcp 0 0 eo-dell-1850f.ku-:ff-sm eo-dell-1850f.ku-e:6001 VERBUNDEN 16554/konqueror [kd
    tcp 0 0 eo-dell:cplscrambler-al eo-dell-1850f.ku-e:6001 VERBUNDEN 16552/konsole [kdei
    tcp 0 0 eo-dell-1850f.ku-:rootd eo-dell-1850f.ku-e:6001 VERBUNDEN 16564/kwrite [kdein
    tcp 0 0 eo-dell-1850f.:nicelink eo-dell-1850f.ku-e:6001 VERBUNDEN 16565/konqueror [kd
    tcp 0 0 eo-dell-1850f.ku-:eek:brpd eo-dell-1850f.ku-e:6001 VERBUNDEN 16555/konqueror [kd
    tcp 0 0 eo-dell-1850f.ku:proofd eo-dell-1850f.ku-e:6001 VERBUNDEN 16563/kate [kdeinit
    tcp 0 0 eo-dell-1:rmiactivation eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-185:rmiregistry eo-dell-1850f.ku-e:6001 VERBUNDEN 16573/knotify [kdei
    tcp 0 0 eo-dell-185:cnrprotocol eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-1:sunclustermgr eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-1850f.ku-e:mctp eo-dell-1850f.ku-e:6001 VERBUNDEN 16518/klauncher [kd
    tcp 0 0 eo-dell-18: pt2-discover eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-1: kyoceranetdev eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-1850f.k:fpo-fns eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-185:instl_boots eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-1850f.ku-: jstel eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-1850f:syscomlan eo-dell-1850f.ku-e:6001 VERBUNDEN 16482/dbus-launch
    tcp 0 0 eo-dell-1: gmrupdateserv eo-dell-1850f.ku-e:6001 VERBUNDEN 16521/kded [kdeinit
    tcp 0 0 eo-dell-18: bsquare-voip eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-185:instl_bootc eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-: cognex-insight eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-:fastechnologlm eo-dell-1850f.ku-e:6001 VERBUNDEN 16526/kaccess [kdei
    tcp 0 0 eo-dell-1850f.k:rdrmshc eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-1850f.ku:cardax eo-dell-1850f.ku-e:6001 VERBUNDEN 16513/kdeinit Runni
    tcp 0 0 eo-dell-1: bridgecontrol eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-1:avocent-proxy eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-185:asprovatalk eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-1850f:dab-sti-c eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-1850f.k:imgames eo-dell-1850f.ku-e:6001 VERBUNDEN 16521/kded [kdeinit
    tcp 0 0 eo-dell-18:amt-esd-prot eo-dell-1850f.ku-e:6001 VERBUNDEN 16539/kdesktop [kde
    tcp 0 0 eo-dell-185:ansoft-lm-1 eo-dell-1850f.ku-e:6001 VERBUNDEN 16541/kicker [kdein
    tcp 0 0 eo-dell-1850f.ku-:socks eo-dell-1850f.ku-e:6001 VERBUNDEN 16536/ksmserver [kd
    tcp 0 0 eo-dell-1850f: pvuniwien eo-dell-1850f.ku-e:6001 VERBUNDEN 16537/kwin [kdeinit
    tcp 0 0 eo-dell: cplscrambler-lg eo-dell-1850f.ku-e:6001 VERBUNDEN 16549/suseplugger [
    tcp 0 0 eo-dell: cplscrambler-in eo-dell-1850f.ku-e:6001 TIME_WAIT -
    tcp 0 0 eo-dell-185:ansoft-lm-2 eo-dell-1850f.ku-e:6001 VERBUNDEN 16543/kpowersave [k
    tcp 0 0 eo-dell-1850:webobjects eo-dell-1850f.ku-e:6001 VERBUNDEN 16546/klipper [kdei
    tcp 0 0 192.168.77.1:26791 192.168.77.10:hosts2-ns VERBUNDEN 16575/konquerorJW4L
    tcp 0 0 *:www-http *:* LISTEN 7925/httpd2-prefork
    tcp 0 0 *:6001 *:* LISTEN 16385/Xvnc
    tcp 0 0 *:ssh *:* LISTEN 7469/sshd
    tcp 0 0 localhost:smtp *:* LISTEN 7705/master
    tcp 0 0 *:https *:* LISTEN 7925/httpd2-prefork
    tcp 0 0 eo-dell-1850f.ku-ei:ssh ashb-009-02.ku:ncpm-hip VERBUNDEN 16377/0
     
  6. agri

    agri New Member

    iptables -L (oops!)

    Chain INPUT (policy DROP)
    target prot opt source destination
    ACCEPT all -- anywhere anywhere
    ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
    input_ext all -- anywhere anywhere
    input_ext all -- anywhere anywhere
    input_ext all -- anywhere anywhere
    LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-IN-ILL-TARGET '
    DROP all -- anywhere anywhere

    Chain FORWARD (policy DROP)
    target prot opt source destination
    TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
    forward_ext all -- anywhere anywhere
    forward_ext all -- anywhere anywhere
    LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWD-ILL-ROUTING '
    DROP all -- anywhere anywhere

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination
    ACCEPT all -- anywhere anywhere
    ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED
    LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-OUT-ERROR '

    Chain forward_ext (2 references)
    target prot opt source destination
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp echo-reply
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp destination-unreachable
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp time-exceeded
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp parameter-problem
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp timestamp-reply
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp address-mask-reply
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp protocol-unreachable
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp redirect
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT '
    LOG icmp -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT '
    LOG udp -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT '
    LOG all -- anywhere anywhere limit: avg 3/min burst 5 state INVALID LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT-INV '
    DROP all -- anywhere anywhere

    Chain input_ext (3 references)
    target prot opt source destination
    DROP all -- anywhere anywhere PKTTYPE = broadcast
    ACCEPT icmp -- anywhere anywhere icmp source-quench
    ACCEPT icmp -- anywhere anywhere icmp echo-request
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp echo-reply
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp destination-unreachable
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp time-exceeded
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp parameter-problem
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp timestamp-reply
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp address-mask-reply
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp protocol-unreachable
    ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp redirect
    ACCEPT esp -- anywhere anywhere
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:ftp-data flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
    ACCEPT tcp -- anywhere anywhere tcp dpt:ftp-data
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:ftp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
    ACCEPT tcp -- anywhere anywhere tcp dpt:ftp
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:ssh flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
    ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:https flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
    ACCEPT tcp -- anywhere anywhere tcp dpt:https
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:http flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
    ACCEPT tcp -- anywhere anywhere tcp dpt:http
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:8333 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
    ACCEPT tcp -- anywhere anywhere tcp dpt:8333
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:8887 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
    ACCEPT tcp -- anywhere anywhere tcp dpt:8887
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:ideafarm-chat flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
    ACCEPT tcp -- anywhere anywhere tcp dpt:ideafarm-chat
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:vmware-authd flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
    ACCEPT tcp -- anywhere anywhere tcp dpt:vmware-authd
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:ssh flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
    ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
    ACCEPT udp -- anywhere anywhere udp dpt:ipsec-nat-t
    ACCEPT udp -- anywhere anywhere udp dpt:isakmp
    reject_func tcp -- anywhere anywhere tcp dpt:ident state NEW
    LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT '
    LOG icmp -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT '
    LOG udp -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT '
    LOG all -- anywhere anywhere limit: avg 3/min burst 5 state INVALID LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT-INV '
    DROP all -- anywhere anywhere

    Chain reject_func (1 references)
    target prot opt source destination
    REJECT tcp -- anywhere anywhere reject-with tcp-reset
    REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
    REJECT all -- anywhere anywhere reject-with icmp-proto-unreachable
     
  7. falko

    falko Super Moderator

    I don't see FTP in your netstat output. Make sure it's running.
     
  8. agri

    agri New Member

    Ok, I did not see the obvious - thanks!

    I now installed an ftp-server on my host. But seems I don't get forwarded to my virtual machine ...
     
  9. falko

    falko Super Moderator

    Did you enable FTP for that web site in ISPConfig? Did you create an admin user for that web site in ISPConfig? Please use this admin user to connect to your document root with FTP.
     
  10. agri

    agri New Member

    Yes, I did.

    No, I didn't.

    Does this mean, that _any_ user, that wants to upload files to his/her "/web"-directory has to be admin? So anybody who is user with mailaccess, but is not admin cannot upload anything to his/her /web-directory?

    Regards
    agri
     
  11. falko

    falko Super Moderator

  12. agri

    agri New Member

    Ok, got that.

    Still: I fiddled around a bit and found out the following:

    if I connect to my server via ftp, I get logged into the ftp-root of my host! How can I target to my virtual machine instead (I had hoped ISPConfig would do that for me ;-) ?
     
  13. till

    till Super Moderator

    I guess you logged in with the wrong username or your FTP doemon does not allo chrooting of users. If you use a user that has been created within ISPConfig, you will login to the home directory of this user. If the user has the "administrator" checkbox enabled, th home directory of this user is the root directory of the website the user belongs to.
     

Share This Page