Pure-ftpd Connection Error on Google Cloud Computer

selcukv · Sep 21, 2018

I can't connect FTP, tried everything:

1. Forwarded ports on Google Cloud
2. Stopped CSF
3. Created new user with : pure-pw useradd newftpuser -u nginx -g nginx -D /home/nginx/domains/mydomain.com/public/
3. Read other threads regarding connection problem

Yet, no way. I'm stuck.

What else can I try?

Thank you so much for your help in advance.

CentOS Version: CentOS 7 64bit

Centmin Mod Version Installed: 123.09beta01

Nginx Version Installed: 1.15.3

PHP Version Installed: 7.2.9

MariaDB MySQL Version Installed: 10.1.13

When was last time updated Centmin Mod code base ? : Clean install, Ran centmin.sh menu option 22 submenu, Got Letsencrypt SSL certificate Nginx vhost, Selected #4 to issue live cert with HTTPS default (trusted).

Persistent Config:
NGXDYNAMIC_NGXPAGESPEED='y'
NGINX_PAGESPEED='y'
EMAIL='[email protected]'
PUSHOVER_EMAIL='[email protected]'
LETSENCRYPT_DETECT='y'

eva2000 · Sep 21, 2018

DO NOT Stop CSF Firewall, doing so disables CSF Firewall passive FTP firewall whitelisting and other whitelisted auto configured setups. The problem you have is with Google Cloud's own Firewall

Centmin Mod installs CSF Firewall and auto configures all the ports whitelisting required for Centmin Mod installed software to function. You can see the outline of ports at CSF - Centmin Mod LEMP stack CSF Firewall default port listing - particularly passive FTP port range whitelisting etc.

Google Cloud Compute like Amazon EC2 have their own Firewall in front of their virtual machine servers which is locked down tight by default see Firewall Rules Overview | VPC | Google Cloud. You need to configure Google Cloud's Firewall to open up and whitelist ports matching CSF Firewall's port list at CSF - Centmin Mod LEMP stack CSF Firewall default port listing

More info

Firewall Rules Overview | VPC | Google Cloud

Using Firewall Rules | VPC | Google Cloud

With Google Cloud Compute watch your bandwidth costs as bandwidth is expensive at US$120-230/TB. Meaning if you have a traffic spike to 10TB, bandwidth costs alone will be 10x-120-230 = US$1,200-2,300 !

selcukv · Sep 22, 2018

Thank you for your reply honestly.

I opened even all the ports and tried in that way too: https://goo.gl/FfMtWJ

It might be something else, that's why I wanted to dig it more.

After the installation, my ftp login was provided as:

FTP hostname : 10.164.0.3
FTP port : 21
FTP mode : FTP (explicit SSL)
FTP Passive (PASV) : ensure is checked/enabled
FTP username created for mydomain.com : username
FTP password created for mydomain.com : password

The hostname is the internal IP of my Google Cloud instance, I guess it should be external.

I searched Google and could not find information regarding how to change it after doing CMM option 22. Although I had deleted it initially from /etc/hosts file and locked it with chattr +i - because no matter what when you restart network google adds its own configuration as well to your hosts file -, added my xternal IP and domain before adding the website with option 22.

It's OK for now, my using FTP as STFP with root, but for security reasons I want to disable it in the future.

Any further ideas?

selcukv · Sep 22, 2018

I know Google Compute costs a lot, I just want to stick to it a couple of months since they gave free credits 5 months ago. After that time I want to transfer to DO.

In the meantime I can use root with SFTP for file transfers and a plugin like Sendgrid for SMTP emails (yes my CMM has a Postfix problem as well - I guess because of this hostname with internal IP issue), because apart from these two all seems fast and fine, very fine with good bechmarks indeed. Previously I used EE for a client website but no proper documentation mainly regarding webp support made me to choose CMM this time.

eva2000 · Sep 22, 2018

selcukv said: ↑

The hostname is the internal IP of my Google Cloud instance, I guess it should be external.
Click to expand...

what's output for
Code (Text):
ifconfig -a
you can replace internel/externel IP actual values with dummy replacements just denote which is internel and which is external

selcukv · Sep 22, 2018

Thank you for your reply.

Here is the output:

Code (Text):

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1460
        inet 10.164.0.3  netmask 255.255.255.255  broadcast 10.164.0.3
        inet6 fe80::4001:aff:fea4:3  prefixlen 64  scopeid 0x20<link>
        ether 42:01:0a:a4:00:03  txqueuelen 1000  (Ethernet)
        RX packets 556812  bytes 438886510 (418.5 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 998622  bytes 2396376274 (2.2 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 9567  bytes 67164521 (64.0 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 9567  bytes 67164521 (64.0 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Reconfiguring it with that change then reinstalling to make everything work smoothless is what I want actually, as a newbie. Thank you!

P.S. What's the shortcode for codes, [ICODE] doesntt work? Edit: Found it.

eva2000 · Sep 22, 2018

I never used Google Cloud, but looks like you're missing a step to assign an external IP to your Google Cloud Computer VM IP Addresses | Compute Engine Documentation | Google Cloud

External IP addresses
You can assign an external IP address to an instance or a forwarding rule if you need to communicate with the Internet, with resources in another network, or need to communicate with a resource outside of Compute Engine. Sources from outside a GCP VPC network can address a specific resource by the external IP address, as long as firewall rules allow the connection. Only resources with an external IP address can send and receive traffic directly to and from outside the network. Communicating with a resource using an external IP address can cause additional billing charges, even if the sender is in the same VPC network. See a list of Compute Engine IP ranges in the Frequently Asked Questions.

Compute Engine supports two types of external IP addresses:

Static external IP addresses

Static external IP addresses are assigned to a project long term until they are explicitly released, and remain attached to a resource until they are explicitly detached.

For VM instances, static external IP addresses remain attached to stopped instances until they are removed.

Ephemeral external IP addresses

Ephemeral external IP addresses are available to VM instances and forwarding rules. Ephemeral external IP addresses remain attached to a VM instance only until the VM is stopped and restarted or the instance is terminated. If an instance is stopped, any ephemeral external IP addresses assigned to the instance are released back into the general Compute Engine pool and become available for use by other projects. When a stopped instance is started again, a new ephemeral external IP address is assigned to the instance.

To assign multiple external IP addresses to a single instance, you can set up multiple forwarding rules to point to a single target instance using protocol forwarding.

Static external IP addresses
You can reserve a static external IP address, which assigns the address to your project indefinitely until you explicitly release it. This is useful if you are dependent on a specific IP address for your service and need to prevent others from being able to use the address. You can reserve a new static external IP address or promote an existing ephemeral external IP address to a static external IP address.

Static external IP addresses can be either a regional or global resources. A regional static IP address allows resources of that region or resources of zones within that region to use the IP address. In this case, VM instances and regional forwarding rules can use a regional static IP address.

Global static external IP addresses are available only to global forwarding rules, used for global load balancing. You cannot assign a global IP address to a regional or zonal resource.

Ephemeral external IP addresses
An ephemeral external IP address is an IP address that does not persist beyond the life of the resource. When you create an instance or forwarding rule without specifying an IP address, the resource is automatically assigned an ephemeral external IP address.

Ephemeral external IP address are released from a resource if you delete the resource. For VM instances, if you stop the instance, the IP address is also released. Once you restart the instance, it is assigned a new ephemeral external IP address. If you have an existing VM that doesn't have an external IP address, you can assign one. Forwarding rules always have an IP address, whether external or internal, so you should not need to assign an IP address to a forwarding rule after it is created.
Click to expand...

selcukv · Sep 22, 2018

I had assigned it after 3 failed installs, before my last install. I assigned it then installed CMM and created the website with option 22.

Now my last instance/droplet/server has a special static IP but the problem exists.

This is what I have from as I read from another post.
Code (Text):
nano /etc/sysconfig/network-scripts/ifcfg-eth0
Code (Text):
# Generated by parse-kickstart
DHCP_HOSTNAME="localhost"
BOOTPROTO="dhcp"
DEVICE="eth0"
ONBOOT="yes"
UUID="d215aefd-9127-4949-8449-cd367355a866"
MTU=1460
PERSISTENT_DHCLIENT="y"
Should I add IP address here, what do you think?

selcukv · Sep 22, 2018

I have read on other posts that you don't have an experience with Google Cloud and I totally understand George but maybe I thought this could a reference for many GCE users like me, since Google provides a credit of 300$ for 12 months.

eva2000 · Sep 22, 2018

Well if you use Google Cloud, you'd need to know how to use it i.e. firewall and external IP setup etc Reserving a Static External IP Address | Compute Engine Documentation | Google Cloud and possible need to configure/add/setup external IP in CentOS 7 networking.

Also $300 12 month credit isn't really enough to properly test and ensure Centmin Mod works on Google Cloud.

selcukv · Sep 23, 2018

It was a firewall issue, I sorted it out by adding rules via SSH:

Code (Text):

gcloud compute firewall-rules create <custom-rule-name-up-to-you> --allow tcp:20,tcp:21,tcp:22,tcp:25,tcp:53,tcp:80,tcp:110,tcp:143,tcp:161,tcp:443,tcp:465,tcp:587,tcp:993,tcp:995,tcp:1110,tcp:1186,tcp:1194,tcp:81,tcp:9418,tcp:30001-50011 --source-tags=<list-of-your-instance-names> --source-ranges=0.0.0.0/0 --description="<any-description-here>" --direction=INGRESS


gcloud compute firewall-rules create <custom-rule-name-up-to-you> --allow udp:67,udp:68,udp:1110,udp:33434-33534,udp:20,udp:21,udp:53,udp:113,udp:123 --source-tags=<list-of-instance-names> --source-ranges=0.0.0.0/0 --description="<any-description-here>" --direction=INGRESS

Thank you so much for enlightening me!

eva2000 · Sep 23, 2018

selcukv said: ↑

It was a firewall issue, I sorted it out by adding rules via SSH:

Code (Text):

gcloud compute firewall-rules create <custom-rule-name-up-to-you> --allow tcp:20,tcp:21,tcp:22,tcp:25,tcp:53,tcp:80,tcp:110,tcp:143,tcp:161,tcp:443,tcp:465,tcp:587,tcp:993,tcp:995,tcp:1110,tcp:1186,tcp:1194,tcp:81,tcp:9418,tcp:30001-50011 --source-tags=<list-of-your-instance-names> --source-ranges=0.0.0.0/0 --description="<any-description-here>" --direction=INGRESS


gcloud compute firewall-rules create <custom-rule-name-up-to-you> --allow udp:67,udp:68,udp:1110,udp:33434-33534,udp:20,udp:21,udp:53,udp:113,udp:123 --source-tags=<list-of-instance-names> --source-ranges=0.0.0.0/0 --description="<any-description-here>" --direction=INGRESS

Thank you so much for enlightening me!

Click to expand...

Great to see you figured it out. Will be useful to others too

selcukv · Sep 25, 2018

Thank you once again! Sorry for the headache

Log in / Register

Forums

Join the community today

Pure-ftpd Connection Error on Google Cloud Computer

selcukv New Member

eva2000 Administrator Staff Member

selcukv New Member

selcukv New Member

eva2000 Administrator Staff Member

selcukv New Member

eva2000 Administrator Staff Member

selcukv New Member

selcukv New Member

eva2000 Administrator Staff Member

selcukv New Member

eva2000 Administrator Staff Member

selcukv New Member

.

Log in / Register

Useful Searches

Join the community today

Pure-ftpd Connection Error on Google Cloud Computer

selcukv New Member

eva2000 Administrator Staff Member

selcukv New Member

selcukv New Member

eva2000 Administrator Staff Member

selcukv New Member

eva2000 Administrator Staff Member

selcukv New Member

selcukv New Member

eva2000 Administrator Staff Member

selcukv New Member

eva2000 Administrator Staff Member

selcukv New Member

.