FTPS server unreachable with Internet Facing

0

I have set up an FTPS Server using AWS Server Family but cannot connect.

My Identity Provider is Custom Lambda and Endpoint Type is VPC/Internet Facing. During configuration, I selected Public Subnet and Elastic IP.

I probably misconfigured the network components:

  • VPC
  • Subnets (1 public and 1 private)
  • Elastic IP

I am using the WINSCP client configured this way:

  • File Protocol: FTP
  • Encryption: TLS/SSL Explicit encryption
  • Port number: 21
  • Username / Password
Connection failed.
Login with USER first

Thanks L

luk3tt0
preguntada hace 2 años389 visualizaciones
4 Respuestas
0

@luk3tt0 Difficult to diagnose with the information provided, but this error message would suggest you sent a PASS command with the password before sending a USER <user id> command.

AWS
EXPERTO
AWS
respondido hace 2 años
0

How can I do a complete troubleshooting? I changed VPC configuration. Now I can connect but I can't show files. Probably there is a permission issue

This is policy attached to role.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ],
            "Effect": "Allow",
            "Sid": "ReadWriteS3"
        },
        {
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObjectVersion",
                "s3:GetObjectACL",
                "s3:PutObjectACL"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ],
            "Effect": "Allow",
            "Sid": ""
        }
    ]
}
luk3tt0
respondido hace 2 años
0

This is FTP Client Log

Enter image description here

luk3tt0
respondido hace 2 años
0

@luk3tt0,

As per the FTP client log that you shared, it seems there might be an issue in Security Groups not allowing traffic through required DataChannel ports. User is able to login to the server implies that Security Group allows ControlChannel traffic. However, a subsequent timeout for an ls might indicate that Data Channel traffic is blocked.

AWS Transfer Family uses Port 21 for Control Channel and Port Range [8192-8200] for Data Channel for FTP/FTPS protocols. Would you be able to update your Security Group associated to the server endpoint and allow inbound traffic through these ports and retry ?

Also, the permissions you shared above for accessing S3 seem correct and grant defined permissions to all S3 buckets. However, do note that if your HomeDirectory is explicitly set to / and you are not using Logical Directories for your User, you are basically at the root of S3 - implying that an ls operation at this level would return all S3 buckets in your account. If you intend to do that, you would require additional permissions for s3:ListAllMyBuckets for the Resource: *.

Let me know if you have further questions.

-- Sagar

AWS
EXPERTO
respondido hace 2 años

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas