2

I want to connect to an FTP using PHP to upload the reports generated. As per the remote server, the FTP needs to be in ACTIVE mode.

this is my code:

ini_set('display_errors', '1');
error_reporting(E_ALL);

$conn_id = ftp_connect('myftpserver.com', 21);

if($conn_id)
{
    // login with username and password
    $login_result = ftp_login($conn_id, 'mysuer', 'password');

    $passive = ftp_pasv($conn_id,FALSE);

    echo "is active?<br/>";
    var_dump($passive);

    echo 'Login Result:';
    var_dump($login_result);

    $files_list = ftp_nlist($conn_id, '/MyFolder/');

    echo "<br/>files list ";

    var_dump($files_list);
}
else
{
    var_dump('Unable to connect to FTP Server');
}

When I am running it from the local machine or a normal shared server, I am able fetch the list, but I am unable to run the script from my AWS AMI instance. For testing purpose, I have even opened all inbound traffic too. Still no luck. Also, the point is that if I try with some other ftp details, I am able to get the response of ftp_nlist. But not for this one. I tried it on 3 AWS instances till yet. Yielded the same result.

All I can say is that this is somewhere the issue at my server security group/firewall. But unable to figure it out. Please help.

The response I get from the server:

is active
bool(true) 
Login Result:bool(true)
files list bool(false)
Akshit Arora
  • 428
  • 3
  • 15
  • Maybe related: https://stackoverflow.com/questions/8219322/php-ftp-ftp-nlist-not-working-returning-boolean-false. In passive mode, data connections are initiated by the client, rather than by the server. It may be needed if the client is behind a firewall. – jarmod Sep 11 '18 at 13:42
  • Hi @jarmod, thanks for the reply. I am bound to use the active mode. The fact is that I am able to run it properly on my local ubuntu (LAMP) and Windows system (XAMPP). But not on AWS. So, I feel that code is correct. I am missing something in security settings or firewall. – Akshit Arora Sep 11 '18 at 13:49
  • `telnet myftpserver.com 21` from problem server. Usually outbound connections are completely allowed unless the VPC doesn't have a gateway connection. If no gateway connection, `ping google.com` should fail as well. Then add "Internet gateway" to your VPC with appropriate route table. [route table](https://imgur.com/gallery/zoHAQe1) – Kyle Parisi Sep 11 '18 at 14:20
  • `[ec2-user@ip-172-31-40-119 ~]$ telnet myftpserver.com 21` `Trying xxx.xx.xx.xx...` `Connected to myftpserver.com.` `Escape character is '^]'.` `220 Marketplace ready...` The response I received using telnet command. Let me check my route table. – Akshit Arora Sep 11 '18 at 14:32
  • Your network seems good then. Not sure what the problem is then. – Kyle Parisi Sep 11 '18 at 14:37

1 Answers1

3

Using FTP Active Mode is problematic with AWS Security Groups.

For active mode to work, you will have to open all inbound ports above 1023. If your client supports restricting the range, do so. You will also need to open both port 20 and port 21 inbound and outbound.

The problem is that the FTP client selects a port that it will listen on. Then the FTP client informs the FTP Server of this port number. The FTP Server then connects to this port. This goes against normal AWS Security Group designs meaning only allow specific ports to be open. You can verify this by opening all ports temporarily, test your FTP client and then closing all the ports.

Active Mode is not secure for the FTP client. Passive Mode is not secure for the FTP server (but the better choice).

NOTE: Rotate your FTP credentials often. Your login and password is sent in the clear and are not encrypted.

FTP is a legacy technology, which is still very popular, that should be stored away in the attic.

John Hanley
  • 74,467
  • 6
  • 95
  • 159
  • Thanks John! Totally agree to what you've said. I have tested by opening all the ports from my Security group. As per some more research on the topic, It may have something to do with NAT. It changes private IP address to Public IP so, unable to get the response. I am more into programming and just can't figure out what is this all. :) – Akshit Arora Sep 12 '18 at 09:35
  • Depending on the client software you may never get this to work for Active Mode. There is one important difference between an AWS NAT Gateway and home style Internet routers. The home style devices will look at FTP packets and modify them with the correct public IP address and make note of the FTP ports being used. The AWS NAT Gateway does NOT. – John Hanley Sep 12 '18 at 15:40