1

I'm trying to add ftp service to firewalld, and every time I run firewall-cmd --add-service=ftp (this is with out the permanent flag) I get Error: COMMAND_FAILED.
If I run firewall-cmd --permanent --add-service=ftp (this is with the permanent flag), it returns success.

However after I reload the service I can't connect via ssh until I disable firewalld over rescue mode.

I'm not trying to open ssh's port. I'm just stating that I lose access to the server after running firewall-cmd --permanent --add-service=ftp and then reload with firewall-cmd --reload.

84104
  • 12,905
  • 6
  • 45
  • 76
ben
  • 11
  • 1
  • 3
  • What makes you think `--add-service=ftp` for port `21` would open port `22` used by SSH? – Esa Jokinen Jun 11 '17 at 10:20
  • that's not at all what im trying to do, im saying after i run firewall-cmd --permanent --add-service=ftp and reload firewalld i get locked out of ssh – ben Jun 11 '17 at 14:32
  • and if i run the command without the --permanent flag i get Error: COMMAND_FAILED any time i try to add a service to firewalld i was using ftp as an example – ben Jun 11 '17 at 14:39

1 Answers1

-1

Indeed this happens with grs kernel on Centos 7. Actually, your question includes the answer. In order to eliminate the problem you need to avoid using the command firewall-cmd --permanent --zone=public --add-service=ftp when opening firewalld ports, or remove it if it is already there with firewall-cmd --permanent --remove-service=ftp. This solves the issue!

You can use the command firewall-cmd --permanent --zone=public --add-port=21/tcp though, so you can have port 21 open if you want.

The explanation is that firewalld tries to load the nf_conntrack_ftp kernel module, even when module support is disabled, and in grs kernel this module is disabled indeed.

I can guess that even if you don't use a grs kernel, you have the nf_conntrack_ftp kernel module disabled. If you reverse this reasoning, you could enable this module, but I am not sure if you can, and I have not tried this solution that looks obvious to me.

This also solves the problem of being locked out after firewall-cmd --reload when service=ftp is added in firewalld, which in fact is the problem I had with the grs kernel.

John K. N.
  • 2,055
  • 1
  • 17
  • 28
philanthropygr
  • 1
  • 2