Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

501 Sorry, but I won't connect to ports < 1024

What does this mean? All of a sudden I can't FTP to anything.

share|improve this question

migrated from stackoverflow.com Sep 4 '09 at 20:31

This question came from our site for professional and enthusiast programmers.

2 Answers 2

This sounds to me like your local sysadmin has just locked down your proxy.

share|improve this answer

The server you are connecting to is running Pure-FTPd, and your FTP client is in active mode. This means your client connects to the server on port 21, and the server connects back to your client for data transfers. In active mode, the client specifies the port for the server to connect to. Historically this has been port 20, but there's nothing really requiring that. Pure-FTPd is hard-coded to refuse to connect to clients that specify a port number less than 1024:

/* from src/ftpd.c */
void doport2(struct sockaddr_storage a, unsigned int p)
{
    /* ... */
    if (p < 1024U) {
        addreply_noformat(501, MSG_BAD_PORT);
        return;
    }

/* from src/messages_en.h */
#define MSG_BAD_PORT "Sorry, but I won't connect to ports < 1024"

TCP/UDP ports below 1024 are considered privileged, which on Unix/Linux means only root can bind to them. This code is probably an attempt to prevent users from connecting as root, since current best practices are to do as little as possible as the root user.

Best guess is the FTP site you had been connecting to has changed FTP server software from something else to Pure-FTPd. You can deal with it on your end in one of two ways:

  • Change to passive (PASV) mode. How you do this depend on your client, but just about every FTP client out there supports it. In passive mode, the client establishes the connection to the server both for control and data. The server never establishes a connection back to the client.
  • Change the data port that your client provides to the server to 1024 or higher for active mode connections. I suspect fewer clients will support this than those that do passive, but I'm sure some do.

If you have no outbound access restrictions, or if the server is in your local network, using passive mode is usually easier. If you do have outbound access restrictions, neither mode is really easier to use than the other, and your best bet would be to consult whoever handles your network security.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.