Changed FTP port but doesn't allow to connect, or list files on any FTP program

[cre8gr]

Hey guys,

Recently I had a major attempt on port 21 and I thought to change the FTP port for more security.

I use Pure FTP and I changed the port in the /etc/pure-ftpd.conf file from 21 to 10290 like this:

Code: Select all

Bind 10290

Also I allowed port 10290 in csf in both TCP_IN and TCP_OUT. Basically where port 21 was mentioned at the csf config, I changed it with port 10290.

I tried to login using FIlezilla which I succesfully did, but then Filezilla wouldn't list the directory contents and then it would timeout.

So I went to check the /var/log/messages log to see if for some reason I was being denied, and saw that indeed I was.

Here's the log:

Code: Select all

Oct  8 19:25:26 s175193 pure-ftpd: (?@MY IP) [INFO] New connection from MY IP
Oct  8 19:25:26 s175193 pure-ftpd: (?@MY IP) [INFO] user is now logged in
Oct  8 19:25:27 s175193 kernel: [3717696.414436] Firewall: *TCP_IN Blocked* IN=venet0 OUT= MAC= SRC=MY IP DST=SERVER IP LEN=52 TOS=0x00 PREC=0x00 TTL=116 ID=11427 DF PROTO=TCP SPT=52453 DPT=48156 WINDOW=65535 RES=0x00 SYN URGP=0
Oct  8 19:25:30 s175193 kernel: [3717699.425447] Firewall: *TCP_IN Blocked* IN=venet0 OUT= MAC= SRC=MY IP DST=SERVER IP LEN=52 TOS=0x00 PREC=0x00 TTL=116 ID=11429 DF PROTO=TCP SPT=52453 DPT=48156 WINDOW=65535 RES=0x00 SYN URGP=0
Oct  8 19:25:36 s175193 kernel: [3717705.410865] Firewall: *TCP_IN Blocked* IN=venet0 OUT= MAC= SRC=MY IP DST=SERVER IP LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=11432 DF PROTO=TCP SPT=52453 DPT=48156 WINDOW=65535 RES=0x00 SYN URGP=0

Funny thing is that it denies different ports than the 1029 port I specified... So, what's going on?

[cre8gr]

OK I found it. I had to enable the PassivePortRange option and add a port range there, as long as allow those ports in the TCP_IN section of csf. After that it worked OK.

[sawbuck]

Assuming a cPanel server I would try changing the port in /etc/chkserv.d/ftpd and restarting ftp and cPanel.

Guess I assumed you had already added the Passive Port range entries.