2

I am working on FTP client for internal usage for deployments. I have started out with WinSCP scripts, everything seems to be working fine, except one operation (deleting large(many files) directory containing files and sub-directories). I know that my targeted FTP server does not support 'recursive directory removal', however it is possible to achieve desired operation by doing recursion on client side (list all files/dirs and delete everything one by one).

WinSCP script line that fails:

rmdir /path/to/large_directory

Error:

Lost connection.
Disconnected from server
Error deleting file '/path/to/large_directory/InnerDir/InnerDir2/dir'.
Error deleting file '/path/to/large_directory/InnerDir/InnerDir2'.
Error deleting file '/path/to/large_directory/InnerDir'.
Error deleting file '/path/to/large_directory'.
Session 'username@ftp.hostname.com' closed.
No session.

After not being able to find solution on WinSCP script, decided to write on my own deployment application using C# and open source library 'System.Net.FtpClient'. However soon enough faced the same issue 'recursive large directory removal' fails. Except this time had more information about error:

Disposing FtpClient object...
Disposing FtpSocketStream...
System.IO.IOException: 
Unable to read data from the transport connection: 
An attempt was made to access a socket in a way forbidden by its access permissions. 
---> System.Net.Sockets.SocketException: 
    An attempt was made to access a socket in a way forbidden by its access permissions 
      at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
      at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)
--- End of inner exception stack trace ---

Challenge: error occurrence is unpredictable, in a sense that given directory which contains only few inner directories or files may succeed or fail, but given larger case it is almost guaranteed to fail. This applies to WinSCP and C# application. So, in theory this is possible solution - keep repeating the script until directory is completely removed, but doing that brings another challenges (manual re-connection is one of them).

While trying many different things, found out that completely disabling Windows 10 firewall did the trick. Thus allowed C# app and WinSCP script run flawlessly.

I need help with setting up firewall correctly, but no matter what I do the problem still persists, except if firewall is completely disabled. I have even created inbound / outbound rules, which should apply for all profiles, all local/remote ip addresses, ports, application/services... still no desired results.

Inbound rule: enter image description here

Outbound rule: enter image description here

  • FTP is fundamentally insecure. You seem to be asking how we fix your problems with your custom FTP client which are intended as a workaround for your problem with WinSCP. Maybe you should focus on fixing the WinSCP problem instead. Using an ssh server at the remote end would be a good start. – symcbean Oct 27 '16 at 16:43
0

FTP is a protocol which uses one TCP connection for control and then for each data transfer (i.e. files, directory listing) it uses new data connections on dynamically allocated ports. This makes it a nightmare for firewalls. You have the following options:

  • Disable firewall (works, but bad)
  • Allow all outgoing connections and switch your FTP client to passive mode (how this is done is off-topic here): This way the client tries to connect to the server for data transfer instead the server connecting to the client.
  • Allow incoming connections from port 20 (ftp-data) to any inside ports and switch your FTP client to active mode: A proper FTP server will originate all FTP data connections from port 20.
  • Use some kind of FTP helper with your firewall. Such helpers use deep inspection of the control connection to find out which ports need to be allocated for the data connections and then dynamically add the necessary rules to the firewall. Note that not all firewalls have such helpers and that these helpers don't work if the control connection is encrypted (FTPS).
  • Use another protocol instead of FTP, i.e. SSH/SCP/SFTP don't have these problems.
  • Thanks for your input, you do have valid points. I have tried some of it, but no effect (I have no control over server, so no option to change protocol, and besides it is actually FTP over SSL). However I have found solution to disable firewall for Stateful FTP on windows, not sure how bad/good it is, but at least it does not require to disable firewall completely anymore. – Nerijus Dzinzeleta Oct 29 '16 at 12:33
0

Actually by trying many things and searching, have found solution, which was exactly that I was looking for:

The problem is caused by the stateful FTP filter of the firewall. As a workaround you can disable it by executing netsh advfirewall set global StatefulFTP disable with administrator rights.

There is post with similar problem: Java 7 prevents FTP transfers on Windows Vista and 7 if firewall is on. Any ideas?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.