Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Arch Linux with kernel 2.6.35-ec2. I've got the most recent version of VSFTPD installed and running. Here is its log file:


This isn't my final config, but it's what I've cut it down to to get it working.

The server is on Amazon EC2, and ports 20 and 21 are open to it. There is no other firewall enabled.

I try to connect on OSX with /usr/bin/ftp and with the Transmit client. The former hangs for a long time and eventually says the connection timed out. The latter only takes about ten seconds to say that the connection timed out. I've tried specifying ports 20 and 21.

There's nothing in any of the normal Arch Linux log files such as auth.log and everything.log. /var/log/vsftpd.log doesn't even exist.

Can anyone help me figure out where to even begin with this? The Arch Linux wiki and what other reading I have done suggest that this is a de facto standard lightweight FTP server.

share|improve this question
Is it running? ps auwx | grep ftp - or are you running it via xineted? Is anything listening on port 21: netstat -pant | grep 21 – Paul Jan 10 '12 at 3:53
Hmm, it looks like it's not running, based on ps auwx. If I start it with /etc/rc.d/vsftpd start, and try to stop, it fails. If I start then start immediately again, it works. I guess it's crashing. I can't see why.. – Cera Jan 10 '12 at 3:56
Does it run from the command line? sudo vsftpd. It is most likely an error in /etc/vsftpd.conf or it cannot write to /var/log/vsftp.log. What user does it run as normally? – Paul Jan 10 '12 at 4:01
It does run from the command line, and then I can see it listening: tcp 0 0* LISTEN -. However, I still can't connect, and there's still no log. I'm running it as root at the moment; I don't know what user it runs as by default. – Cera Jan 10 '12 at 4:07
Does it work if you try locally: ftp (from EC2) – Paul Jan 10 '12 at 4:36

After seeing the other response and comments it might be due to vsftp doesn't want to run as root (because it's very secure ftp, :-)).

My recollection is that it wants to run as the user ftp (or that's how I recall setting it up).

share|improve this answer
As I mentioned, I have no Firewall enabled aside from the thing that EC2 puts all systems behind, and I have opened what I understand to be the relevant ports on there. – Cera Jan 10 '12 at 4:35
Sorry about the firewall comment. – PatS Jan 14 '12 at 15:27

There are two FTP modes - port mode and passive mode. The difference is how the server attempts to set up the data connection (the initial connection is the command connection where you send commands through to the server, and the data connection is a secondary connection used to transfer the files).

Port Mode is where the server will attempt to connect to port 20 on the client. So this is an incoming connection from the server to the client. In order for this to work, you would need port 20 open at the client end, and forwarding to the originator of the ftp session. This is usually not feasible in a non-business to business setting.

Passive Mode is where the server opens a secondary port to itself in addition to port 21. This port is negotiated during the transfer part of the session, and instructs the client to connection on a port above 1024 to download or upload the data. This mode is far better suited to client server transactions where NAT devices are in between.

In order for this to work, the firewall protecting the server must allow connections on the passive port. With many firewalls, they are ftp-aware and so observer the negotiated port and allow the connection. However, this is not always feasible and so the range must be opened manually.

The best way to set this up is to define a port range in the vsftpd configuration:

pasv_min_port = 31000
pasv_max_port = 32000

Then you can open the range defined in the firewall configuration, and instruct your ftp client to use passive mode. This is done with the pasv command for some command line clients, or in the server settings for a GUI client.


These two files provide an overarching control over what can connect to the server. Please make sure they are both present and hosts.deny specifically should not have any deny statements in it.

share|improve this answer
@Cerales Note that this does not address your issue entirely, I am just putting this here for reference as I think you'll find that your EC2 open port config is not quite there yet. – Paul Jan 10 '12 at 9:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.