FTPS server unreachable with Internet Facing

0

I have set up an FTPS Server using AWS Server Family but cannot connect.

My Identity Provider is Custom Lambda and Endpoint Type is VPC/Internet Facing. During configuration, I selected Public Subnet and Elastic IP.

I probably misconfigured the network components:

  • VPC
  • Subnets (1 public and 1 private)
  • Elastic IP

I am using the WINSCP client configured this way:

  • File Protocol: FTP
  • Encryption: TLS/SSL Explicit encryption
  • Port number: 21
  • Username / Password
Connection failed.
Login with USER first

Thanks L

luk3tt0
asked 2 months ago52 views
4 Answers
0

@luk3tt0 Difficult to diagnose with the information provided, but this error message would suggest you sent a PASS command with the password before sending a USER <user id> command.

answered 2 months ago
0

How can I do a complete troubleshooting? I changed VPC configuration. Now I can connect but I can't show files. Probably there is a permission issue

This is policy attached to role.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ],
            "Effect": "Allow",
            "Sid": "ReadWriteS3"
        },
        {
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObjectVersion",
                "s3:GetObjectACL",
                "s3:PutObjectACL"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ],
            "Effect": "Allow",
            "Sid": ""
        }
    ]
}
luk3tt0
answered 2 months ago
0

This is FTP Client Log

Enter image description here

luk3tt0
answered 2 months ago
0

@luk3tt0,

As per the FTP client log that you shared, it seems there might be an issue in Security Groups not allowing traffic through required DataChannel ports. User is able to login to the server implies that Security Group allows ControlChannel traffic. However, a subsequent timeout for an ls might indicate that Data Channel traffic is blocked.

AWS Transfer Family uses Port 21 for Control Channel and Port Range [8192-8200] for Data Channel for FTP/FTPS protocols. Would you be able to update your Security Group associated to the server endpoint and allow inbound traffic through these ports and retry ?

Also, the permissions you shared above for accessing S3 seem correct and grant defined permissions to all S3 buckets. However, do note that if your HomeDirectory is explicitly set to / and you are not using Logical Directories for your User, you are basically at the root of S3 - implying that an ls operation at this level would return all S3 buckets in your account. If you intend to do that, you would require additional permissions for s3:ListAllMyBuckets for the Resource: *.

Let me know if you have further questions.

-- Sagar

EXPERT
answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions