Elastic Compute Service:FAQ about instance connections

Symptom

The FTP service on a Windows ECS instance cannot be connected to or accessed from the Internet.

Cause

This issue may occur for the following reasons:

• FTP security group rules are not configured to allow access: For more information, see Solution 1: Add security group rules for FTP.

• The firewall blocks the FTP process: For more information, see Solution 2: Configure firewall support for FTP.

Solutions

Choose one of the following solutions based on your requirements.

Solution 1: Add security group rules for FTP

After you set up an FTP site on a Windows ECS instance, you must add an inbound rule to the security group of the instance. This rule must allow access to port 21. The rule must also allow access to the port range from 1024 to 65535, which may be used by the FTP server in passive mode. For more information, see Add a security group rule.

Solution 2: Configure firewall support for FTP

If the firewall is enabled, you must configure IIS Manager to allow the FTP service to use TCP port 21 and the port range from 1024 to 65535. To do so, perform the following steps:

1. Remotely connect to the Windows instance.

   For more information, see Log on to a Windows instance using a password or key.

2. Open IIS Manager. Double-click FTP Firewall Support to open its configuration page.

3. Configure the parameters and click Apply.

   Note

   The parameters are described as follows:

   • External IP Address of Firewall: Enter the public IP address of the Windows ECS instance.

   • Data Channel Port Range: The range of ports for passive connections. The valid port range is 1025 to 65535. Set the range based on your requirements. In this example, the port range is set to 1024 to 65535.

4. Open the command line and run the following command to restart the FTP service. This ensures that the new configuration overwrites the existing configuration for each FTP site.

   net stop ftpsvc&net start ftpsvc

5. (Optional) If you can access the FTP server from the local machine but not from other machines after the FTP server is configured, the issue is caused by an incorrect firewall configuration. Perform the following steps to configure the firewall:

   1. First, check the inbound rules in Server Manager to ensure that the FTP server is enabled.

   2. Add the Windows Service host process to the firewall rules.

      1. Open Control Panel > Windows Firewall. In the left pane, click Allow an App or Feature Through Windows Firewall.

      2. In the new window, click Allow Another App.... Click Browse, locate and open C:\Windows\System32\svchost.exe to add the Service host process.

      3. A Windows Service Host Process item appears. Select the Private and Public checkboxes, and then click OK.

Symptom

When you connect to the FTP server on a Windows ECS instance, the following error message is displayed.

Response: 331 Please specify the password.
Command: PASS ************
Response: 530 Login incorrect.
Error: Critical error: Could not connect to server

Cause

This issue may occur for the following reasons:

• The FTP password is incorrect: For more information, see Solution 1: Change the FTP password.

• The FTP user permissions are configured incorrectly: For more information, see Solution 2: Add FTP user permissions.

Solutions

Choose one of the following solutions based on your requirements.

Solution 1: Change the FTP password

1. Remotely connect to the Windows instance.

   For more information, see Log on to a Windows instance using a password or key.

2. On the desktop, right-click Computer and select Manage to open Server Manager.

3. In the navigation pane on the left, click Local Users and Groups > Users. Right-click the FTP account and select Set Password.

Solution 2: Add FTP user permissions

1. Remotely connect to the Windows instance.

   For more information, see Log on to a Windows instance using a password or key.

2. Check whether the directory for the FTP user exists.

   1. If the directory does not exist, see Step 3: Set permissions for shared files to re-create the directory for the FTP user and add the required permissions.

   2. If the file exists, right-click the folder and select Properties > Security. Then, select the FTP account and add the required permissions.

Symptom

After you attach a domain name to an FTP site that is configured in IIS 7.5, a "530 valid hostname is expected" or "503 Login with USER first" error is reported when you connect to the FTP server on the Windows ECS instance using an IP address or other methods.

Cause

This issue occurs because the logon format is incorrect after you attach a domain name to an FTP site that is configured in IIS 7.5.

Solution

If the domain name attached to the FTP site is www.example.com and the username is user, you must use the www.example.com|user format to log on.

Symptom

When you upload a file to FileZilla Server using FTP on a Windows ECS instance, a "550 Permission denied" error is reported.

Cause

The FTP account in FileZilla Server does not have the write permission.

Solution

1. Remotely connect to the Windows instance.

   For more information, see Log on to a Windows instance using a password or key.

2. Run the FileZilla Server software. On the Users page, select Shared folders.

3. Select the user and directory. Select the Write check box and click OK to grant the permission.

Symptom

When a user uploads a file to an FTP site on a Linux ECS instance, a "425 Security:Bad IP connection" error is reported.

Cause

This issue usually occurs because the client is in a Network Address Translation (NAT) network that is associated with more than one public IP address. This causes the source IP address to be inconsistent between the control connection and the data connection, which results in the error.

Solution

Perform the following steps to disable the IP security check in passive mode.

1. Remotely connect to the Linux instance.

   For more information, see Log on to a Linux instance using a password or key.

2. Edit the FTP configuration file.

   vi /etc/vsftpd/vsftpd.conf

3. Press the i key to enter edit mode. Add the following content to the configuration file.

   pasv_promiscuous=yes

4. After you finish editing, press the Esc key to exit edit mode. Then, enter :wq and press the Enter key to save the changes and exit.

5. Restart the FTP service.

   systemctl restart vsftpd

Symptom

Uploading a file using vsftp on a Linux ECS instance fails with a "553 Could not create file" error.

Cause

This issue may occur for the following reasons:

• The disk space of the Linux instance is full.

• The FTP home directory does not have the write permission.

Solution

Perform the following steps to check the disk space of the Linux instance and the permissions of the FTP home directory.

1. Remotely connect to the Linux instance.

   For more information, see Log on to a Linux instance using a password or key.

2. Check if the file failed to upload due to insufficient disk space on the Linux instance.

   df -h

   Note

   A disk partition is considered full when its space usage reaches 100%.

   In the following example, the space usage of the /dev/xvda1 partition is 59%.

   

3. Check whether the FTP home directory has the write permission.

   Note

   Before you run the following command, replace /home/user with the actual FTP home directory.

   ls -l /home/user

   If the permissions shown in the red box in the following figure do not include w, you do not have the write permission.

   

4. Add the write permission.

   chmod +w /home/user

5. Run the following command. If the command output contains w, the write permission is granted.

   ls -l /home/user