topic Re: FTP login fails before prompting for a password in Operating System - HP-UX

FTP login fails before prompting for a password

K. Lesperance — Thu, 02 Oct 2008 17:26:47 GMT

Hi,

When trying to ftp from an AIX system to an HP-UX 11.31 system, the login fails before it even prompts for a password:

rssap18:/home/hpzkeles>ftp -v rssapdb
Connected to rssapdb.ryder.com.
220 rssapdb.ryder.com FTP server (Revision 3.0 Version wuftpd-2.6.1 Wed Dec 19 08:45:38 GMT 2007) ready.
Name (rssapdb:hpzkeles): sapftp
331 Password required for sapftp.
530 Login incorrect.
Login failed.
ftp>

From the syslog, I'm guessing it's an issue with pam:

Oct 2 13:59:08 rssapdb ftpd[27650]: Data port : 20
Oct 2 13:59:08 rssapdb ftpd[27650]: FTP server (Revision 3.0 Version wuftpd-2.6.1 Wed Dec 19 08:45:38 GMT 2007) ready.
Oct 2 13:59:16 rssapdb ftpd[27650]: pam_authenticate:Authentication failed
Oct 2 13:59:16 rssapdb ftpd[27650]: User sapftp: Login incorrect
Oct 2 13:59:16 rssapdb ftpd[27650]: failed login from 168.218.96.203 [168.218.96.203]
Oct 2 14:04:49 rssapdb ftpd[27650]: FTP session closed

Our ftp entries for pam.conf look like this:

rssapdb -> /root
root # grep ftp /etc/pam.conf
ftp auth required libpam_hpsec.so.1
ftp auth required libpam_unix.so.1
ftp account required libpam_hpsec.so.1
ftp account required libpam_unix.so.1
ftp session required libpam_hpsec.so.1 bypass_limit_login bypass_umask bypass_nologin
ftp session required libpam_unix.so.1

If I connect from another HP-UX system, it's working:

rssapapp -> /etc
root # ftp rssapdb
Connected to rssapdb.ryder.com.
220 rssapdb.ryder.com FTP server (Revision 3.0 Version wuftpd-2.6.1 Wed Dec 19 08:45:38 GMT 2007) ready.
Name (rssapdb:hpzkeles): sapftp
331 Password required for sapftp.
Password:
230 User sapftp logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

Oct 2 14:10:08 rssapdb ftpd[29248]: Data port : 20
Oct 2 14:10:08 rssapdb ftpd[29248]: FTP server (Revision 3.0 Version wuftpd-2.6.1 Wed Dec 19 08:45:38 GMT 2007) ready.
Oct 2 14:10:13 rssapdb ftpd[29248]: FTP LOGIN FROM rssapapp.ryder.com [168.218.96.165], sapftp

I've also tried from HP-UX 11.11, and a RedHat Linux server, and am able to log in successfully. We even have another AIX server we can ftp from successfully (but I don't see how anything on the client side could be causing this). Any help with this one would be appreciated.

Re: FTP login fails before prompting for a password

Tim Nelson — Thu, 02 Oct 2008 19:38:05 GMT

I do not have the answer but maybe discussing will find it.

-all other servers work except AIX server1. First assumption would be yes a client issue but... first,

any IP restrictions in either /var/adm/inetd.sec ?
ftp using tcp wrappers, look in hosts.deny for IP of AIX server

Does AIX server1 have any issue FTPing to any other server.

Re: FTP login fails before prompting for a password

K. Lesperance — Thu, 02 Oct 2008 19:41:57 GMT

Upon further investigation, I think it's the AIX client. Another AIX server can ftp to our host in question successfully, and the problem server can't FTP to other HP-UX hosts.

We're not using tcp wrappers, and there's no /var/adm/inetd.sec file.

Re: FTP login fails before prompting for a password

OldSchool — Thu, 02 Oct 2008 19:43:37 GMT

also, on server rssapdb:

in inetd.conf: is the ftpd using the "-f" switch? if so, check for "deny" entries in /etc/ftpaccess

Re: FTP login fails before prompting for a password

OldSchool — Thu, 02 Oct 2008 19:48:33 GMT

oopss ftpaccess activitate by

ftpd -a

sorry ...no points for this one

Re: FTP login fails before prompting for a password

K. Lesperance — Thu, 02 Oct 2008 19:50:18 GMT

inetd.conf looks like this:

ftp stream tcp6 nowait root /usr/lbin/ftpd ftpd -l

there's also no /etc/ftpaccess (or /etc/ftpd/ftpaccess).

Re: FTP login fails before prompting for a password

Tim Nelson — Thu, 02 Oct 2008 19:52:31 GMT

So,
FTP client options ( no global ftp client settings I can think of ) only command line options.

Maybe a patch issue with this AIX server ?

Does AIX to AIX work ?

Re: FTP login fails before prompting for a password

TTr — Thu, 02 Oct 2008 20:10:53 GMT

> 220 rssapdb.ryder.com FTP server (Revision 3.0 Version wuftpd-2.6.1 Wed Dec 19 08:45:38 GMT 2007) ready.
> Name (rssapdb:hpzkeles): sapftp
> 331 Password required for sapftp.
> 530 Login incorrect.
> Login failed.
The hint here is that you are NOT prompted for a password. I bet that have a .netrc file on the AIX server which has an entry in it for the 11.31 server that contains a password entry but no login entry.

Re: FTP login fails before prompting for a password

Suraj K Sankari — Fri, 03 Oct 2008 07:11:57 GMT

Hi,

1st check this files /etc/ftpaccess and /etc/ftpd/ftpaccess
If /etc/ftpacces file is not there then no issue this means every one can do ftp if file is there then make sure your ftpuser name should not be there in this file.

2nd In /etc/ftp/ftpaccess file should having this 5 lines

class users real,guest *
guestgroup ftp
suppressversion yes
log commands real,guest,anonymous
log transfers real,guest,anonymous * IN,OUT

3rd Edit the /etc/inetd.conf file and put -a -l
Ex.
ftp stream tcp6 nowait root /usr/lbin/ftpd ftpd -a -l

after changing the same restart your network with
inetd -c

then try ftp

Suraj

Re: FTP login fails before prompting for a password

K. Lesperance — Fri, 03 Oct 2008 12:01:54 GMT

Tim,

I tried AIX to AIX, and that's not working, either.

TTr,

I looked for a .netrc in my home directory, and I don't have one. This also doesn't work for other users. I was wondering if there was a global netrc file, but I don't see one in /etc.

Re: FTP login fails before prompting for a password

Steven Schweda — Fri, 03 Oct 2008 12:51:37 GMT

> I looked for a .netrc [...]

Too bad. That sounded to me like the best
theory by far. Does "man ftp" on the AIX
system reveal some secret wisdom? Safe to
assume that "ftp" there is not some weird
alias? (Use the full path to make sure?) It
sure seems to be sending a (bad) password,
and it apparently does it all on its own, so
it sure looks (to me) as if it's getting some
input from some (mysterious) source.

"ftp -n [...}"

Re: FTP login fails before prompting for a password

TTr — Fri, 03 Oct 2008 13:55:17 GMT

As Steven suggested, check if ftp is replaced by an alias or by a shell script. Does AIX have truss available? Run the ftp command through truss to see what it is doing.

Re: FTP login fails before prompting for a password

K. Lesperance — Fri, 03 Oct 2008 16:59:49 GMT

It turns out it was a permissions issue with one of the /dev/tty files.

Thanks everyone!