php - CURL FTP 连接仅在主机上被拒绝

Question

我使用 PHP 和 Curl 连接到 FTP 服务器，
奇怪的是，当我在本地设置中尝试我的代码时，它以隐式 TLS 和显式 TLS 方式工作，但是当我在任何服务器上运行相同的代码时，它不起作用并返回 Connection refused .
PHP代码是:

<?php

function simple_list_test() {
    $curlopts = [];
    $debug = true;
    $return = null;
    
    $curlopts[CURLOPT_USERPWD] = "{$user}:{$password}";
    $curlopts[CURLOPT_SSL_VERIFYPEER] = false;
    $curlopts[CURLOPT_SSL_VERIFYHOST] = false;
    $curlopts[CURLOPT_FTP_SSL] = CURLFTPSSL_TRY;
    $curlopts[CURLOPT_FTPSSLAUTH] = CURLFTPAUTH_TLS;
    $curlopts[CURLOPT_RETURNTRANSFER] = true;
    $curlopts[CURLOPT_URL] = "ftp://ftp.avidafinance.com:21/"; // I tried with ftps:// protocol too it works on local but not when you run it on a hosting
    $curlopts[CURLOPT_FTPLISTONLY] = 1;
    $curlopts[CURLOPT_UPLOAD] = 0;
    $curlopts[CURLOPT_RETURNTRANSFER] = 1;

    $ch = curl_init();

    foreach($curlopts as $key => $value) {
        curl_setopt($ch, $key, $value);
    }

    if ($debug) {
        curl_setopt($ch, CURLOPT_VERBOSE, true);
        $verbose = fopen('php://temp', 'w+');
        curl_setopt($ch, CURLOPT_STDERR, $verbose);
    }

    $return = curl_exec($ch);

    if ($debug) {
        rewind($verbose);
        $verboseLog = stream_get_contents($verbose);
        echo "Verbose information:\n<pre>", htmlspecialchars($verboseLog), "</pre>\n";
    }

    if ($error = curl_error($ch)) {
        throw new Exception($error);
    }

    return $return;
}

我花了一整天，尝试了很多方法，包括设置 CURLOPT_PORT , 设置 ftps://协议(protocol)，增加超时，包括服务器 .crt和 .pem带有 curl 的证书，但它们都不起作用，所以我想知道是否有人可以在这里帮我一把，
以下是使用 PHP 7.3 和 curl 7.68.0 的本地开发环境的详细输出简介:

*   Trying 13.53.118.182:21...
* TCP_NODELAY set
* Connected to ftp.avidafinance.com (13.53.118.182) port 21 (#0)
< 220 FileZilla Server 0.9.60 beta
> AUTH TLS
< 234 Using authentication type TLS
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
*  subject: OU=Domain Control Validated; CN=ftp.avidafinance.com
*  start date: Mar 23 12:46:23 2020 GMT
*  expire date: Mar 23 12:46:23 2022 GMT
*  issuer: C=US; ST=Arizona; L=Scottsdale; O=GoDaddy.com, Inc.; OU=http://certs.godaddy.com/repository/; CN=Go Daddy Secure Certificate Authority - G2
*  SSL certificate verify ok.
> USER ****
< 331 Password required for *****
> PASS *****
< 230 Logged on
> PBSZ 0
< 200 PBSZ=0
> PROT P
< 200 Protection level set to P
> PWD
< 257 "/" is current directory.
* Entry path is '/'
* Request has same path as previous transfer
> EPSV
* Connect data stream passively
* ftp_perform ends with SECONDARY: 0
< 229 Entering Extended Passive Mode (|||57081|)
*   Trying 13.53.118.182:57081...
* TCP_NODELAY set
* Connecting to 13.53.118.182 (13.53.118.182) port 57081
* Connected to ftp.avidafinance.com (13.53.118.182) port 21 (#0)
> TYPE A
< 200 Type set to A
> NLST
< 150 Opening data channel for directory listing of "/"
* Maxdownload = -1
* Doing the SSL/TLS handshake on the data stream
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* SSL re-using session ID
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
*  subject: OU=Domain Control Validated; CN=ftp.avidafinance.com
*  start date: Mar 23 12:46:23 2020 GMT
*  expire date: Mar 23 12:46:23 2022 GMT
*  issuer: C=US; ST=Arizona; L=Scottsdale; O=GoDaddy.com, Inc.; OU=http://certs.godaddy.com/repository/; CN=Go Daddy Secure Certificate Authority - G2
*  SSL certificate verify ok.
* Remembering we are in dir ""
< 226 Successfully transferred "/"
* Connection #0 to host ftp.avidafinance.com left intact

但是当我在主机上运行完全相同的代码时(尝试了超过 3 个不同的服务器)，它会是这样的:

*   Trying 13.53.118.182...
* TCP_NODELAY set
* Connected to ftp.avidafinance.com (13.53.118.182) port 21 (#0)
< 220 FileZilla Server 0.9.60 beta
> AUTH TLS
< 234 Using authentication type TLS
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
*  subject: OU=Domain Control Validated; CN=ftp.avidafinance.com
*  start date: Mar 23 12:46:23 2020 GMT
*  expire date: Mar 23 12:46:23 2022 GMT
*  issuer: C=US; ST=Arizona; L=Scottsdale; O=GoDaddy.com, Inc.; OU=http://certs.godaddy.com/repository/; CN=Go Daddy Secure Certificate Authority - G2
*  SSL certificate verify ok.
> USER *****
< 331 Password required for ******
> PASS *****
< 230 Logged on
> PBSZ 0
< 200 PBSZ=0
> PROT P
< 200 Protection level set to P
> PWD
< 257 "/" is current directory.
* Entry path is '/'
> EPSV
* Connect data stream passively
* ftp_perform ends with SECONDARY: 0
< 229 Entering Extended Passive Mode (|||57093|)
*   Trying 13.53.118.182...
* TCP_NODELAY set
* Connecting to 13.53.118.182 (13.53.118.182) port 57093
* connect to 13.53.118.182 port 21 failed: Connection refused
* Failed to connect to ftp.avidafinance.com port 21: Connection refused
* Failed EPSV attempt. Disabling EPSV
> PASV
< 227 Entering Passive Mode (13,53,118,182,222,194)
*   Trying 13.53.118.182...
* TCP_NODELAY set
* Connecting to 13.53.118.182 (13.53.118.182) port 57026
* connect to 13.53.118.182 port 21 failed: Connection refused
* Failed to connect to ftp.avidafinance.com port 21: Connection refused
* Closing connection 0

简而言之，我需要一个 Explicit FTP Over TLS连接，我试过 curl , ftp_ssl_connect fsockets , .... 他们都没有工作，我会很感激任何帮助，它不一定是 curl

Answer 1

让我们总结一下这里的内容:https://slacksite.com/other/ftp.html

In active mode FTP the client connects from a random unprivileged port (N > 1023) to the FTP server's command port, port 21.

和

In passive mode FTP the client initiates both connections to the server, solving the problem of firewalls filtering the incoming data port connection to the client from the server. When opening an FTP connection, the client opens two random unprivileged ports locally (N > 1023 and N+1).

由于非限制端口策略，这适用于您的机器，很高兴知道这在服务器上不起作用，您不能只是“开放端口”。
我有一个类似的问题，我用 Python ftputil 库解决了这个问题。