[Nagiosplug-help] Problem with check_ftp and iptables
nagios at pgmail.net
Wed Oct 22 16:14:16 CEST 2008
I have an issue with check_ftp and iptables that I am sure of, that a lot of you already ran into it,
but I seem to be unable to find the right search keywords. My problem is, that check_ftp always returns a timeout.
I am using check_ftp v1729 (nagios-plugins 1.4.11) with iptables v1.3.6 (Debian).
I have iptables fed with a bunch of pretty simple port access rules and a DROP default rule.
Of course I have a problem with active ftp in this scenario,
because the ftp server cannot establish a connection to the client (My monitoring server, in this case).
I managed to remove this problem with the following firewall rule in place:
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
and the kernel module ip_conntrack_ftp loaded:
# lsmod | grep conntrack_ftp
ip_conntrack_ftp 13136 0
Now I am able to establish active ftp sessions FROM the monitoring server to any other server:
# ftp backup-fra1.XXXXXXX
Connected to backup-fra1.XXXXXXX
220 (vsFTPd 2.0.5)
Name (backup-fra1.XXXXXX:root): xxxxx
331 Please specify the password.
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
200 PORT command successful. Consider using PASV. <--- connection is in active mode
150 Here comes the directory listing.
-rwxrwx--- 1 1001 34 104857600 Mar 24 2008 100MB.DAT
-rwxrwx--- 1 1001 34 1048576000 Mar 24 2008 1GB.DAT
-rwxrwx--- 1 1001 34 524288000 Mar 24 2008 500MB.DAT
-rw------- 1 1001 65534 3609118720 Oct 20 11:29 rhel-5.2-server-x86_64-dvd.iso
drwxrwx--- 2 1001 34 4096 Feb 20 2008 test
226 Directory send OK.
Unfortunately I am unable to use check_ftp on that server. It exits with a timeout every time I use it:
# /usr/local/nagios/libexec/check_ftp -H mirror.XXXXXX -v
Using service FTP
Quit string: QUIT
CRITICAL - Socket timeout after 10 seconds
netstat showing an established connection on port 21:
tcp 0 0 nagios.XXXXX:42974 xxx.xxx.xxx.xxx:ftp ESTABLISHED
So I guess the problem is in the connection to the ftp data port, but I never realized, that check_ftp needs a data connection?
The 220 message usually comes on the control connection (which is established).
Did anybody run into this yet? What exactly is the problem, and how can I make it work?
Any hint is appreciated!
More information about the Help