topic Re: confusing ftp message in Operating System - HP-UX

confusing ftp message

George Liu_4 — Mon, 22 Mar 2004 10:17:30 GMT

The ftp server with PHNE_27765 returns confusing messages after login was failed. See below,

It is HP-UX B.11.11

220 host.domain FTP server (Version 1.1.214.4(PHNE_27765) Wed Sep 4 05:59:34 GMT 2002) ready.
Name (host:root):
331 Password required for root.
Password:
530 Login incorrect.
Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

Any configuration can be tuned for this? Thanks in advance.

Re: confusing ftp message

Robert-Jan Goossens — Mon, 22 Mar 2004 10:24:28 GMT

Hi,

Are you sure you are on the system, could you check with an ls if you see some files.

Robert-Jan

Re: confusing ftp message

James A. Donovan — Mon, 22 Mar 2004 10:24:33 GMT

Do you have an /etc/ftpd/ftpusers file? Is the root user listed in that file? If the answer is yes to both questions, then remove the root user from this file and try again.

$ man ftpusers

for more information on the ftp security file.

If that doesn't fix the problem, check the syslog.log file of the system you're trying to ftp onto. It may have more information on why access is being denied.

Re: confusing ftp message

Jeff Schussele — Mon, 22 Mar 2004 10:25:28 GMT

Hi George,

It's just reporting remote system type & default transport mode.

Rgds,
Jeff

Re: confusing ftp message

George Liu_4 — Mon, 22 Mar 2004 10:35:34 GMT

Jeff,

Could those messages be disabled? Thanks.

:-) George

Re: confusing ftp message

RAC_1 — Mon, 22 Mar 2004 10:44:08 GMT

Check /etc/ftpd/ftpusers or /etc/ftpusers file.
Also check /etc/shells file. this should have all shells listed that user's use and are allowed to do ftp.
Check if FTP is allowed. Ceck /var/adm/inetd.sec file.

Anil

Re: confusing ftp message

rick jones — Tue, 23 Mar 2004 13:05:09 GMT

Well, disabling the messages would still leave one not logged-in :) However, if you examin the manpage for "ftp" (doesn't everyone try man "foo" when they first have an issue with foo?-), you will likely find an option that disables the SYST and TYPE calls and what other options are required.

Re: confusing ftp message

George Liu_4 — Tue, 23 Mar 2004 13:23:22 GMT

Well, my original question is not "how to make ftp available to root or such". My question is how to disable these messages "Remote system type is UNIX. \Using binary mode to transfer files."

You don't want to everybody knows your system type. Right?

Re: confusing ftp message

rick jones — Tue, 23 Mar 2004 13:30:28 GMT

If you are simply trying to make the system type messages go away because you are worried about crackers, do keep in mind that while you may be able to make that method of ID go away (you will also need to change the "welcome" message), I personally do not believe that it will make your system any more "secure" as hiding the system type is merely a variant of "security through obscurity"

Re: confusing ftp message

George Liu_4 — Tue, 23 Mar 2004 13:47:35 GMT

We do have warning banner.

Re: confusing ftp message

Marvin Strong — Tue, 23 Mar 2004 14:47:44 GMT

I don't know how to disable the messages, but does it matter anyway, once someone logs into ftp the command:

syst

can get the OS anyway.

As far as a banner goes, anyone thats going to crack you isn't going to care about the banner IMO.

Re: confusing ftp message

George Liu_4 — Tue, 23 Mar 2004 15:31:26 GMT

I agree with Marvin from the technical point of view. However, Banner is required from our security policy. It is better not to responde "syst" and "type" also.

Re: confusing ftp message

Jeff Schussele — Tue, 23 Mar 2004 16:14:00 GMT

Hi Marvin,

It's not a matter of the perpetrator "caring" about the banner. It's a matter of whether one can prosecute for this behavior. Courts have ruled in the past that w/o a banner stating that misuse is subject to criminal penalty, it could be perceived as an "invitation" to do what they please.
So you'd better have that banner if you intend to do something prosecute hackers after they've been caught.

My 2 cents,
Jeff

Re: confusing ftp message

Marvin Strong — Tue, 23 Mar 2004 17:36:36 GMT

I didn't mean to imply that the banner was not required. Certainly it should be there for legal reasons.

I was just stating the most persons that are willing to crack will take their chances anyway.

I was just trying to point out that hiding OS type, is not nearly enough to secure ftp, from malicious users.

Which im sure everyone here realizes already.

Re: confusing ftp message

Jeff Schussele — Tue, 23 Mar 2004 19:47:48 GMT

I certainly agree Marvin.
That's why PW hardening & teaching users about how to deal with "social-engineering" are the #1 lines of defense.

Cheers,
Jeff