501 Sorry, but I won't connect to ports < 1024

Question

501 Sorry, but I won't connect to ports < 1024

What does this mean? All of a sudden I can't FTP to anything.

Answer 1

This sounds to me like your local sysadmin has just locked down your proxy.

Answer 2

The server you are connecting to is running Pure-FTPd, and your FTP client is in active mode. This means your client connects to the server on port 21, and the server connects back to your client for data transfers. In active mode, the client specifies the port for the server to connect to. Historically this has been port 20, but there's nothing really requiring that. Pure-FTPd is hard-coded to refuse to connect to clients that specify a port number less than 1024:

/* from src/ftpd.c */
void doport2(struct sockaddr_storage a, unsigned int p)
{
    /* ... */
    if (p < 1024U) {
        addreply_noformat(501, MSG_BAD_PORT);
        return;
    }

/* from src/messages_en.h */
#define MSG_BAD_PORT "Sorry, but I won't connect to ports < 1024"

TCP/UDP ports below 1024 are considered privileged, which on Unix/Linux means only root can bind to them. This code is probably an attempt to prevent users from connecting as root, since current best practices are to do as little as possible as the root user.

Best guess is the FTP site you had been connecting to has changed FTP server software from something else to Pure-FTPd. You can deal with it on your end in one of two ways:

• Change to passive (PASV) mode. How you do this depend on your client, but just about every FTP client out there supports it. In passive mode, the client establishes the connection to the server both for control and data. The server never establishes a connection back to the client.
• Change the data port that your client provides to the server to 1024 or higher for active mode connections. I suspect fewer clients will support this than those that do passive, but I'm sure some do.

If you have no outbound access restrictions, or if the server is in your local network, using passive mode is usually easier. If you do have outbound access restrictions, neither mode is really easier to use than the other, and your best bet would be to consult whoever handles your network security.