Rootadminacc: /* From command line */

2013-03-01T11:11:58Z

From command line

@@ Line 202: / Line 202: @@
 To upload, use put.<br>
 To download, use get.
 === Timeouts ===

Rootadminacc: /* SFTP */

2013-03-01T10:39:45Z

SFTP

@@ Line 190: / Line 190: @@
 ls -ld /homedirectory
 service sshd restart</pre>
 === Timeouts ===

Rootadminacc: /* FTP Logs */

2013-01-22T14:08:50Z

FTP Logs

← Older revision		Revision as of 15:08, 22 January 2013
Line 68:		Line 68:

	Always check iptables for DROP rules.		Always check iptables for DROP rules.

			== FTP over TLS ==

			If you get the following message in an FTP client or Telnet test:

			''550 SSL/TLS required on the control channel''

			Do the following:

			* Download Filezilla from here: http://filezilla-project.org/download.php?type=client
			* Install it to your PC and run it, then go to:
			* File > Site Manager
			* New Site, call it something like "My FTP"
			* Use the following settings:

			- Host: IP address<br>
			- Encryption: Require explicit over TLS<br>
			- Logon Type: Normal<br>
			- Username: username<br>
			- Password: password<br>

			* Click OK
			* Then next to the button underneath File, click the drop down menu arrow and select "My FTP"

	== FTP Timeout ==		== FTP Timeout ==

Rootadminacc: Created page with "== Connecting == Once these have been set and they have propagated you will be able to connect with the server IP address as the hostname, us..."

2013-01-15T11:28:10Z

Created page with "== Connecting == Once these have been set and they have propagated you will be able to connect with the server IP address as the hostname, us..."

New page

== Connecting ==

Once these have been set and they have propagated you will be able to connect with the server IP address as the hostname, username and the password. The best way to connect via FTP is via a client such as [http://filezilla-project.org/download.php?type=client/ Filezilla]. You will need to use the port 21. Check ports 20 and 21 are not blocked using:

<pre>netstat -ant | grep LISTEN
iptables -A INPUT -p tcp --dport <port> -j ACCEPT </pre>

tcp6 for IPv6. Alternate syntax in between tcp and --dport: -d 0/0 -s 0/0

If they are blocked these can be allowed through Virtuozzo.

== Display accounts ==

To show FTP accounts in MySQL via SSH:

mysql -uadmin -p`cat /etc/psa/.psa.shadow` 
use psa

Below command applies to SSH and Command Prompt:

SELECT login AS FTP_USER,password AS FTP_PASS,home AS DOMAIN_ROOT,accounts.id,sys_users.account_id FROM accounts, sys_users WHERE accounts.id=sys_users.account_id;

=== Change account password in SSH ===

To change the username you log into FTP with if Plesk does not let you to change it go to:

<pre>mysql -uadmin -p`cat /etc/psa/.psa.shadow`
use psa
show tables;
select * from sys_users
select * from accounts;
update sys_users set login = 'inserthere' where id = 'X'</pre>

=== Change FTP password in Plesk 9 ===

Main Menu - Domains > Click the Domain > Website - Web Hosting Settings > Account Preferences

=== Change FTP password in Plesk 10 ===

Hosting Services - Domains (or Subscriptions) > Open in Control Panel (or Manage Hosting) > Websites and Domains tab > FTP Access

== DNS Records required ==

To FTP over a domain name you may need these records:

@ A ServerIPaddress 
Astrix A ServerIPaddress 
ftp CNAME www 
www A ServerIPaddress

== [http://kb.mediatemple.net/questions/28/Using+Dreamweaver+for+FTP%7B47%7DSFTP#gs Dreamweaver for FTP/SFTP] ==

== File upload goes to 0kb ==

If you get the following error when uploading via FTP and the file is 0kb once done:

<pre>Disk Quota exceeded error</pre>

And you have a Plesk 10.4.4 server, apply the latest Micro Updates using the auto-installer/upgrade section, guide [[UpgradingPlesk#Updating.2FUpgrading_Plesk | here]].

== FTP Logs ==

<pre>/opt/psa/var/log/xferlog (or /usr/local/var/log/xferlog
/var/www/vhosts/DomainName/statistics/logs/xferlog
/var/log/secure
/var/log/syslog
/var/log/daemon.log</pre>

Always check iptables for DROP rules.

== FTP Timeout ==

If clients are disconnected from FTP by a timeout, and if the server is using Pro FTP or xinetd super server for FTP the configuration files are located in /etc/proftpd.conf and /etc/xinetd.conf and should be able to configured with TimeoutNoTransfer 1200

'''Notes'''

/usr/sbin/proftpd

"Socket operation on non-socket" , change config according to [http://www.javathinking.com/2007/08/proftpd-fatal-socket-operation-on-non-socket this].

<pre>Failed binding to ::, port 21: Address already in use</pre>

Check the ServerType directive to ensure you are configured correctly in /etc/proftpd.conf:

Change standalone to inetd

<pre>#ServerType standalone
ServerType inetd</pre>

== Permissions ==

If you cannot upload files to the server you will need to check the user:group the folder you are uploading to has. Normally needs ftpuser:psacln for files and ftpuser:psaserv for folders (or just httpdocs).

To allow FTP access to files outside the home directory via chroot: http://www.ducea.com/2006/07/27/allowing-ftp-access-to-files-outside-the-home-directory-chroot/ .

== [http://kb.parallels.com/en/2207 ProFTPd to use TLS/SSL] ==

== Setting up FTP ==

Before you can upload anything to a Plesk server, you will need to add a domain. This can be done in Plesk 10 by pressing Subscriptions down the left-hand side, then Add New Subscription. Fill in the required fields and press OK. The username and password you entered here is the username and password you need to use on an FTP client.

[http://wiki.filezilla-project.org/Network_Configuration Filezilla Network Configuration]

== SFTP ==

SFTP accesses FTP over a Secure Shell, therefore using Port 22. Your server will do this by default if you have SSH access. In Filezilla just use port 22 or sftp://VPS_IP

<pre>netstat -ant | grep LISTEN
/etc/init.d/ssh start
/etc/init.d/sshd start
iptables -L</pre>

If it is not listening on 0.0.0.0:22, SSH is not started. Use IPTables to check that all connections are allowed including port 22.

If you cannot access the server via SFTP, go into Plesk > Domains > (Plesk 10 - Control Panel > Websites and Domains) > Web Hosting Access and allow the FTP user Shell access, as SFTP uses port 22 so it needs this ability. If Plesk is not allowing you to set it and keeps reverting do: vim /etc/passwd and set the users to /bin/bash

If the following error message is in /var/log/syslog: "init: Failed to spawn ssh pre-start process: unable to set oom adjustment: Operation not permitted" do:

<pre>vim /etc/init/ssh.conf
#oom never
:wq
/etc/init.d/ssh start</pre>
https://www.intovps.com/client/knowledgebase.php?action=displayarticle&id=16

'''If you change the default SSH port from 22, when you want to sftp you need to put in the host field sftp:// before the IP address.''' Otherwise you may get the error message:

<pre>Response: SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7
Error: Cannot establish FTP connection to an SFTP server. Please select proper protocol.
Error: Critical error
Error: Could not connect to server</pre>

An example of an SFTP server that can run alongside MSFTP server is SiverSHielD SFTP server. This can allow Dreamweaver to upload directly.

Note: A symlink may appear as a directory in FTP/SFTP.

=== [http://www.fuschlberger.net/programs/ssh-scp-sftp-chroot-jail Chroot SFTP] ===

[http://www.fuschlberger.net/programs/ssh-scp-sftp-chroot-jail/make_chroot_jail.sh.html HTML page] for the link above.

<pre>groupadd chrootsftpusers</pre>

[http://www.thegeekstuff.com/2012/03/chroot-sftp-setup/ For internal use without a password]:

<pre>useradd -g chrootsftpusers -d /homedirectory -s /sbin/nologin username</pre>

For external use with a password:

<pre>useradd -g chrootsftpusers -d /homedirectory -s /bin/bash username
passwd username</pre>

Then:

<pre>grep username /etc/passwd
vim /etc/ssh/sshd_config</pre>

Set the following in the file:

<pre>#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

Match Group chrootsftpusers
ChrootDirectory /sftp/username
ForceCommand internal-sftp</pre>

<pre>grep sftp /etc/ssh/sshd_config
chown username:chrootsftpusers /var/www/d
ls -ld /homedirectory
service sshd restart</pre>

=== Timeouts ===

General timeouts:

vim /etc/ssh/ssh_config 
ClientAliveInterval 60

Connection timed out:

<pre>Error: Connection timed out
Error: File transfer failed after transferring 183,599,104 bytes in 130 seconds</pre>

Test with SCP and see if you get the same error. If you get this error in Filezilla:

<pre>disconnected from server
Error: Connection timed out
Error: File transfer failed after transferring bytes in seconds when file complete</pre>

Edit > Settings > Connection - Set "Timeout in seconds" to 200 or over the limit of what it errors with.

Then Add it in File > Site Manager and set "Maximum number of connections" to 1 in the Transfer Settings tab

Also see these links: [http://superuser.com/questions/433152/filezilla-times-out-when-transferring-large-file 1], [http://trac.filezilla-project.org/ticket/7935 2]

== [http://linux.about.com/od/commands/l/blcmdl1_ftp.htm SSH FTP command] ==

== Telnet test ==

telnet ipaddress port

user username
pass password

== Notes ==

* [http://slacksite.com/other/ftp.html Active vs Passive FTP]

* [http://www.eukhost.com/web-hosting/kb/how-to-create-ftp-accounts-in-plesk-web-hosting-control-panel Setting up FTP accounts in Plesk] (Needs Plesk 9.5.4!)

* [http://kb.parallels.com/415 Create FTP accounts to go to certain directory]

* Windows FTP is handled through IIS under Default FTP site. Of note is that IP's may be blocked here. Also the FTP Publishing Service via Virtuozzo System Services can be started too.

* If in Windows 2008 task manager via RDP you setup scheduled tasks but they only seem to upload empty files the scripts/batch files normally need to be an open directory such as cgi-bin, httpdocs or public_html and if you get:

425 Unable to build data connection: Connection timed out
disconnect

A Plesk and Windows Firewall may have locked it down so try to add the passive dynamic port range into Windows Firewall to allow MS DOS FTP command to send and receive.

== Windows FTPS ==

<pre>ftps-data 989/tcp ftp protocol, data, over TLS/SSL
ftps-data 989/udp ftp protocol, data, over TLS/SSL
ftps 990/tcp ftp protocol, control, over TLS/SSL
ftps 990/udp ftp protocol, control, over TLS/SSL</pre>

Versus the usual:

<pre>ftp-data 20/tcp File Transfer [Default Data]
ftp-data 20/udp File Transfer [Default Data]
ftp 21/tcp File Transfer [Control]
ftp 21/udp File Transfer [Control]</pre>

Using Plesk:

Server > IP Address > click on IP > Tick FTP over SSL

Manually:

IIS by default should allow FTPS (FTP over SSL). You normally get an SSL first to do this.

You need to also make sure you:

* allow Inbound connections in Windows Firewall in the Public Profile
* the IP has an SSL assigned to it
* right click the site in IIS and Add FTP Publishing, from here you can select the SSL certificate you want to use (probably the domain itself) and define the port (likely 990). A guide to this is here: http://www.iis.net/learn/publish/using-the-ftp-service/adding-ftp-publishing-to-a-web-site-in-iis-7

You'll need to setup an FTP user and grant it ownership on the virtual directory for the website - this user's credentials will be used to login to the FTPS.

You will then connect with ftpes://ipaddressofthewebsite

Username 
Password 
FTPS port

On a Plesk box if you can telnet to port 21, but cannot connect to FTP with the correct credentials, and get the following errors:

331 Password required for username. 
PASS *************** 
530 User cannot log in, home directory inaccessible.

331 Password required for username. 
PASS ***************** 
530 User cannot log in.

Check the permissions for each user in the Security tab for the FTP user's home directory, ensure the domain is associated to the right IP in Plesk and DNS pointing to the server, ensure there is not an issue with Firewall trying to connect to internal IPs, check Plesk quota's/subscription limits and finally you can try to run the following commands to rebuild the IIS/Plesk FTP configuration:

\Plesk\admin\bin>ftpmng.exe --remove-all 
\Plesk\admin\bin>ftpmng.exe --reconfigure-all

FTP - Revision history

Rootadminacc: /* From command line */

Rootadminacc: /* SFTP */

Rootadminacc: /* FTP Logs */

Rootadminacc: Created page with "== Connecting == Once these have been set and they have propagated you will be able to connect with the server IP address as the hostname, us..."