For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Devlin_T_149357's avatar
Devlin_T_149357
Apr 22, 2014

FTP Monitor Help

Hello all

 

Pulling my hair on this one.

 

I'm trying to setup some FTP servers behind my LTM. I have followed this guide:

 

http://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-1-0/20.html

 

But no matter what I do I cannot get the VS or pools up. They are failing the monitor check presumably.

 

The FTP server(s) are on a couple of Lunix Ubuntu 12.0.4 servers. I am using passive mode, the default. I have configured my VSFTPD configuration file for the following:

 

local_enable=YES

 

write_enable=YES

 

Logging into the FTP server locally works just fine.

 

In the FTP monitor config section I have correctly specified the username, password and path/filename. I have ticked the 'Inherit Parent Profile' check box in the profile section and kept the data port to 20.

 

Looking at a Wireshark output I can the various exchanges between the LTM and the FTP server as the LTM is sending the username/password combo and logging in successfully. It changes the directory successfully and following that there are the subsequent upload of the file (I think). This is showed as 'FTP Data' on Wireshark, with the direction from FTP server -> LTM.

 

One thing I did notice is the following on Wireshark:

 

FTP -> LTM:

 

Response: 426 Failure writing network stream

 

Response: 500 OOPS:

 

Response: vsf_sysutil_recv_peek: no data

 

Response: 220 (VSFTPD 2.3.5)

 

Response: 500 OOPS:

 

Response: priv_sock_get_cmd

 

Any ideas?

 

Many thanks

 

application delivery
deployment
LTM

4 Replies

  • yoni_100721's avatar
    yoni_100721
    Icon for Nimbostratus rankNimbostratus
    Apr 22, 2014

    Do you need this to post an FTP file or from a health perspective would it be ok if you are just able to login?

     

  • Devlin_T_149357's avatar
    Devlin_T_149357
    Apr 23, 2014

    Hello yoni

     

    I guess I could live without getting an FTP file, a login would suffice. How do you suggest I go about this?

     

    Thanks

     

  • yoni_100721's avatar
    yoni_100721
    Icon for Nimbostratus rankNimbostratus
    Apr 23, 2014

    Setup a custom external monitor. add a file with the contents of "SUCCESS" make sure you chmod +x the .sh file in /usr/bin/monitors/ftp.tools.sh

    monitor ftp.tools { defaults from external FILENAME "filename.txt" PASSWORD "****" run "/usr/bin/monitors/ftp.tools.sh" USER "" }

    external monitor:

    !/bin/sh These arguments supplied automatically for all external monitors: $1 = IP (nnn.nnn.nnn.nnn notation) $2 = port (decimal, host byte order) This script expects the following Name/Value pairs: USER = the username associated with a mailbox PASSWORD = the password for the user account FILENAME = File Name/Path to get from FTP Server Remove IPv6/IPv4 compatibility prefix (LTM passes addresses in IPv6 format)

    NODE=

    echo ${1} | sed 's/::ffff://'
    PORT=${2} RECV='SUCCESS'

    PIDFILE="/var/run/

    basename ${0}
    .${NODE}_${PORT}.pid"

    kill of the last instance of this monitor if hung and log current pid

    if [ -f $PIDFILE ] then echo "FTP-Tools exceeded runtime needed to kill ${NODE}:${PORT}" | logger -p local0.error kill -9 

    cat $PIDFILE
    > /dev/null 2>&1 fi echo "$$" > $PIDFILE

    curl ftp://${USER}:${PASSWORD}@${NODE}/${FILENAME} | grep -i "${RECV}" 2>&1 > /dev/null

    if [ $? -eq 0 ] then echo "Node ${NODE}:${PORT} Status is UP" | logger -p local0.error /bin/rm -f $PIDFILE echo "Removed $PIDFILE" | logger -p local0.error echo "up" fi

    exit

  • Devlin_T_149357's avatar
    Devlin_T_149357
    Apr 25, 2014

    Hi yoni

     

    I won't lie. I am lost. But I think for now I will continue without a health monitor for the FTP pool.

     

    Thanks again.