Glad you got it to work. I don't believe you said if your shell account was on the same box as the webserver. If your shell account is on a different box, active ftp may be denied to the webserver box. This could be easily done with an access list on a router, no firewall required. If your login is on the same box, then a more complex explaination is required, and a firewall is more likely involved. In that case, it might be that your login is allowed to do active ftp, but the login your CGI runs as (www, apache, nobody, etc.) is denied by the firewall. Given my limited knowledge of network security I can't understand how this could be accomplished. The actual tcp connections are anonymous. Unless perhaps the firewall is on the same box.

Passive ftp is typically allowed, because it is viewed as less of a security risk. In passive ftp the client open both connections. A common assumption in network security is that if the inside box is initiaing the connections it must be OK.

For an excellent description of active vs. passive ftp try this.