topic Re: FTP log message in Operating System - HP-UX

FTP log message

Rootberry — Mon, 13 Feb 2006 14:17:56 GMT

We repeatedly are getting messages in the log file pertainint to FTP athentication. I will copy and paste it below

"Feb 12 16:14:12 akl ftpd[4115]: pam_authenticate: Authentication failed 134217759 Feb 12 16:14:15 akl ftpd[4116]: pam_authenticate: Authentication failed 134217759 Feb 12 16:14:23 akl ftpd[4117]: pam_authenticate: Authentication failed 134217759 Feb 12 16:14:28 akl ftpd[4118]: pam_authenticate: Authentication failed 134217759 Feb 12 16:14:33 akl ftpd[4119]: pam_authenticate: Authentication failed 134217759 Feb 12 16:14:41 akl ftpd[4120]: pam_authenticate: Authentication failed 134217759 Feb 12 16:14:43 akl ftpd[4121]: pam_authenticate: Authentication failed 134217759"

Any ideas what this is or how to resolve it?

Re: FTP log message

Geoff Wild — Mon, 13 Feb 2006 14:27:06 GMT

What is in /etc/pam.conf for ftp?

# grep ftp /etc/pam.conf
ftp auth required libpam_hpsec.so.1
ftp auth required libpam_unix.so.1
ftp account required libpam_hpsec.so.1
ftp account required libpam_unix.so.1
ftp session required libpam_hpsec.so.1 bypass_limit_login bypass_umask bypass_nologin
ftp session required libpam_unix.so.1

Also - did this just happening or was it always happening....

What OS version are you running?

Rgds...Geoff

Re: FTP log message

paolo barila — Mon, 13 Feb 2006 14:31:08 GMT

Hi,
a ftp user is trying to ftp with a wrong password

Yuo should see also

Feb 13 20:27:16 ftpd[10763]: User root: Login incorrect
Feb 13 20:27:16 nettuno ftpd[10763]: failed login from ...

Check in /etc/inetd.conf
if you have -l option on ftp:

ftp stream tcp6 nowait root /usr/lbin/ftpd ftpd -l <----

Re: FTP log message

Rootberry — Mon, 13 Feb 2006 14:33:35 GMT

You were right, I should have posted that info...thanks for helping me help myself ;)

Here's whats in the /etc/pam.conf
root[/etc] >grep ftp /etc/pam.conf | pg
ftp account required /usr/lib/security/libpam_unix.1
ftp auth required /usr/lib/security/libpam_unix.1

Version is HP-UX 11.00

Its been an on going issue. Some days are worse than others.

Re: FTP log message

Rootberry — Mon, 13 Feb 2006 14:39:10 GMT

root[/etc] >grep ftp inetd.conf | pg
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -t 120
# Before uncommenting the "tftp" entry below, please make sure
# that you have a "tftp" user in /etc/passwd. If you don't
# have one, please consult the tftpd(1M) manual entry for
tftp dgram udp wait root /usr/lbin/tftpd tftpd\

Re: FTP log message

Jeff Schussele — Mon, 13 Feb 2006 14:48:49 GMT

Hi,

It may not be an incorrect PW, it could also be that the account is disabled for any one or more reasons:

1) Account inactivity
2) Exceeded max incorrect PW attempts
3) Past PW lifetime
4) Past account lifetime
5) Pw required & a null PW
6) Admin lock
7) Pw is a *

Run the following command on the account

/usr/lbin/getprpw -m lockout user_name

man getprpw for details on what the return means.

HTH,
Jeff

Re: FTP log message

Rootberry — Mon, 13 Feb 2006 16:20:03 GMT

Thanks to all for the responses. In this scenario it turned out, our email notification was grabbing the whole story.

So after thumbing through the syslog we will be updating the script to capture logon failures as well.

All the responses were very informative.

-John

Re: FTP log message

Rootberry — Mon, 13 Feb 2006 16:21:44 GMT

See above reply