Skip to main content

CentOS 6 : Problem with FTP login - 500 OOPS cannot change directory


CentOS 6 : Problem with FTP login - 500 OOPS cannot change directory


Yesterday I get a problem when I want to make an FTP connection to one of our web server (operating with CentOS 6). It's a bit strange, because usually it works normally.

The problem described as below (the IP address below is only an example, for security reasons):

?
1
2
3
4
5
6
7
8
9
10
11
[root@optiflex ~]# ftp 10.10.10.10
Connected to 10.10.10.10.
220 (vsFTPd 2.2.2)
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (10.10.10.10:root): golduser
331 Please specify the password.
Password:
500 OOPS: cannot change directory:/home/golduser
Login failed.

As we can see above, the FTP login failures occur because FTP can not change directory to the user's home directory (in this case it is /home/golduser).

To fix this problem, then here's how i done it. First, I do log on to the web server through an SSH connection with user 'root'.

Once the login is successful, then I need to see the booleans value of SELinux policy, filtering on whom containing the word 'ftp':

?
1
2
3
4
5
6
7
8
9
10
11
12
13
[root@goldsrv ~]# getsebool -a | grep ftp
allow_ftpd_anon_write --> off
allow_ftpd_full_access --> off
allow_ftpd_use_cifs --> off
allow_ftpd_use_nfs --> off
ftp_home_dir --> off
ftpd_connect_db --> off
httpd_enable_ftp_server --> off
sftpd_anon_write --> off
sftpd_enable_homedirs --> off
sftpd_full_access --> off
sftpd_write_ssh_home --> off
tftp_anon_write --> off

As we can see above, the ftp_home_dir boolean is set to off,  that's  preventing the FTP daemon (vsftpd) from reading and writing to files in user home directories.

To change the boolean value to on, perform the following steps (the '-P' parameter means permanent):

?
1
[root@goldsrv ~]# setsebool -P ftp_home_dir on

Please check back if ftp_home_dir values ​​have changed:

?
1
2
3
4
5
6
7
8
9
10
11
12
13
[root@goldsrv ~]# getsebool -a | grep ftp
allow_ftpd_anon_write --> off
allow_ftpd_full_access --> off
allow_ftpd_use_cifs --> off
allow_ftpd_use_nfs --> off
ftp_home_dir --> on
ftpd_connect_db --> off
httpd_enable_ftp_server --> off
sftpd_anon_write --> off
sftpd_enable_homedirs --> off
sftpd_full_access --> off
sftpd_write_ssh_home --> off
tftp_anon_write --> off

Aaah, the ftp_home_dir already set to on :-) After doing the steps above, I can log into my web server with FTP connection without any problems. Hope this article helps those of you who encountered similar problems.

Comments

Post a Comment

Popular posts from this blog

Nginx startup script

#!/bin/sh # # nginx - this script starts and stops the nginx daemon # # chkconfig:   - 85 15 # description:  NGINX is an HTTP(S) server, HTTP(S) reverse \ #               proxy and IMAP/POP3 proxy server # processname: nginx # config:      /etc/nginx/nginx.conf # config:      /etc/sysconfig/nginx # pidfile:     /var/run/nginx.pid # Source function library. . /etc/rc.d/init.d/functions # Source networking configuration. . /etc/sysconfig/network # Check that networking is up. [ "$NETWORKING" = "no" ] && exit 0 nginx="/usr/local/nginx/sbin/nginx" prog=$(basename $nginx) NGINX_CONF_FILE="/usr/local/nginx/conf/nginx.conf" [ -f /etc/sysconfig/nginx ] && . /etc/sysconfig/nginx lockfile=/var/lock/subsys/nginx make_dirs() {    # make required directories    user=`$nginx -V 2>&1 | grep "configure arguments:.*--user=" | sed...
Post a Comment
Read more

Tomcat NIO Connector and How to Configure It

In  HTTP 1.1 , all connections between the browser and the server are considered persistent unless declared otherwise. Persistence, in this context, means to use a single TCP connection to send and receive multiple HTTP requests/responses, as opposed to opening a new connection for every single request/response pair. In tomcat, the default HTTP connector is blocking and follows a one thread per connection model. This means that in order to serve 100 concurrent users, it requires 100 active threads. We end up wasting resources (the thread) because connections may not be used heavily, but just enough to avoid a timeout. Opposed to this is the relatively new NIO or non blocking connector. This connector has a couple of poller threads used to keep the connection alive for all connected users while worker threads are called whenever data (a new HTTP request) is available. This model leads to a much better sharing of resources (threads) and a larger number of concurrent users can ...
Post a Comment
Read more

Java + HTTPS: Unable to Find Valid Certification Path to Requested Target

Run  InstallCert.java , with your hostname and https port, and press “ 1 ” when ask for input. It will add your “localhost” as a trusted keystore, and generate a file named “ jssecacerts “. C : \ > java InstallCert localhost : 8443 Loading KeyStore C : \Program Files\Java\jre6\lib\security\cacerts . . . Opening connection to localhost : 8443 . . . Starting SSL handshake . . . javax . net . ssl . SSLHandshakeException : sun . security . validator . ValidatorException : PKIX path building failed : sun . security . provider . certpath . SunCertPathBuilderException : unable to find valid certification path to requested target at com . sun . net . ssl . internal . ssl . Alerts . getSSLException ( Unknown Source ) at com . sun . net . ssl . internal . ssl . SSLSocketImpl . fatal ( Unknown Source ) at com . sun . net . ssl . internal . ssl . Handshaker . fatalSE ( Unknown Source ) at com . sun . net . ssl . internal . ssl . Handshaker...
Post a Comment
Read more