topic Re: More ftp problems in Operating System - HP-UX

Re: More ftp problems

Steven E. Protter — Tue, 22 Jul 2003 02:16:58 GMT

I think your approach should be different.

It seems that the operators of the mainframe are not careful what permissions they put on the file.

Fortuneately you have a servant, root cron that can change anything you need, including permissions.

If the file comes in at a fixed time, have root cron change the permissions a few minutes later to what they should be.

I didn't see your original post, but I've had these issues before and sometimes messing with the ftp server and inetd.conf is simply too time consuming for me.

SEP

Re: More ftp problems

Ronelle van Niekerk — Tue, 22 Jul 2003 02:30:17 GMT

I did think of this but unfortunately the files (just found out there is more than one) are not transferred at the same time every day.

They say there is no real pattern to it.

They also say that they can't set the permissions on the file before sending it.

I had this working on the test system but from my PC, not the mainframe.

Re: More ftp problems

Con O'Kelly — Tue, 22 Jul 2003 02:39:49 GMT

Hi Ronell

If you're sure these problems only occur when you enable use of ftpaccess with -a then the only thing I can think is that the timeout value being given to the ftpd daemon is being overridden by the ftpaccess file.

I have seen a timeout values being set in the ftpaccess file before, though I don't see it listed on HP-UX's man page for ftpaccess.

Might be something to investigate.

Cheers
Con

Re: More ftp problems

Massimo Bianchi — Tue, 22 Jul 2003 06:38:58 GMT

Hi,
can you post the file ftpaccess for a check ?

I'm also thinking that, since in test environt worked, there may be some difference between test and prod... patch level ?

How did you manage the test, the from and to hosts where the same, as in prod (mainframe --> hpux ) ?

If the connection is dropped, in the syslog you should have some warning. Is there anything interesting there ?

Is there any relevat time difference between mainframe and hpux ?

Massimo

Re: More ftp problems

Ronelle van Niekerk — Tue, 22 Jul 2003 20:12:35 GMT

Con,
I'll look into that. But the seission doesn't jsut timeout, nothing is transferred in the 10 minutes.

Massimo,
The test and production environments are slightly different but the base operating system is the same.
As I mentioned, I was testing from my PC to the tst box, not from the mainframe. I can't do that becasue it would mean getting the mainframe team involved in trying to ftp to the test machine and it's all too much really.
The syslog only shows that there was a connection from the mainframe but no FTP LOGIN.

The user's home directory and the directory they're uploading to are in no way related - would this be a problem

Re: More ftp problems

Dave La Mar — Tue, 22 Jul 2003 21:24:05 GMT

Ronell -
Let's start with the file coming from the "mainframe". In two of the more popular TCPIP clients used in the "IBM mainframe" world, permissions are not set in any config file or passed in the ftp job. Routinely, the permissions on a file sent are found to be that of rw by the user and group of the user that is in the ftp login session. I believe you are on the right track with the access file. Is the ftp user, the "mainframe" guy's are using, a common user on your HP-UX box?

Best of luck.

Regards,

dl

Re: More ftp problems

Ronelle van Niekerk — Tue, 22 Jul 2003 21:37:44 GMT

Dave,

No, the user was set up specifically for the ftp'ing of these files from the mainframe.

And you're right, the guys say that they have no control over the permissions of the file.

-Ronelle

Re: More ftp problems

Dave La Mar — Tue, 22 Jul 2003 22:18:30 GMT

Ronell -
Since I administer bot the HP-UX and "mainframe" side, I could run some tests here to duplicate your problem. What are the current permissions the files are coming in with and what do you want tem to be?

Regards,

dl

Re: More ftp problems

Dave La Mar — Tue, 22 Jul 2003 22:31:10 GMT

Ronell -
One last question before I leave for the day. The user that is logging in from the mainframe has what permissions to the directory being put to?

Hang in there. We'll (the forums) will get your answer.

dl

Re: More ftp problems

Ronelle van Niekerk — Tue, 22 Jul 2003 22:48:47 GMT

Dave,

They're currently coming in with -rw-rw---- and we want them to be -rw-r-----

The user's group has rwx premissions to the directory.

-Ronelle

Re: More ftp problems

Tim Adamson_1 — Tue, 22 Jul 2003 23:55:55 GMT

Hi Ronell,

Have you considered implementing ACLs on the directory on the UNIX server? Maybe you can work around the problem using ACLs.

Just an idea.

Cheers!

Re: More ftp problems

Ronelle van Niekerk — Wed, 23 Jul 2003 00:41:04 GMT

Tim,

Aren't acl's for use on specific files?
Unfortunately the files they ftp will have a different name every day - or more than once a day.

Re: More ftp problems

Ron Kinner — Wed, 23 Jul 2003 01:25:14 GMT

How about putting this ftp user into a group all by themselves? Then nobody but root can read it until a cron file looks at the directory (every 5 minutes or whatever), finds a new file and moves it to a different directory while changing owner/group/permisions.

Ron

Re: More ftp problems

Ronelle van Niekerk — Wed, 23 Jul 2003 01:42:07 GMT

Ron,

A good idea but not very neat - especially considering the fact that there may be more than one file a day, the files don't all go to the same directory and the filenames are not always the same.

ftpaccess just seems like the easiest, most streamlined solution. I just wish I could get itto work on the production system.

Re: More ftp problems

Tim Adamson_1 — Wed, 23 Jul 2003 02:52:25 GMT

Hi Ronelle,

Does the Unix server have multiple network cards? If so, does the same problem occur on different lan interfaces? I wonder if it is more related to the lan card (patching).

Seems like you may need to go through a process of elimination - ugghh!

Cheers!

Re: More ftp problems

Ronelle van Niekerk — Wed, 23 Jul 2003 03:27:17 GMT

Tim,

ugghh! is right.

This server has only one network card.

Re: More ftp problems

Ron Kinner — Wed, 23 Jul 2003 14:30:30 GMT

Your ftpaccess line:
"upload /user/home/dir /dir/to/upload yes username group 037"

037 is a bad value per my 11.0 man file. The examples they give use 0666 and 0600 (permissions and not mask). Perhaps that is why it doesn't want to work?

Ron

Re: More ftp problems

Seth Parker — Wed, 23 Jul 2003 14:31:36 GMT

Ronell,

This is the kind of thing that drives one crazy! It all looks like it should work.

Hmmm...

Was the -a option in inetd.conf previously? If not, then the ftpaccess file wasn't being used before. Maybe there's a problem someplace else in the file that's preventing transfers somehow. Can you post it?

Also, I noticed in the man page for ftpaccess that it's not a mask in the upload command, but a mode. So a rw-r-- mode should be 0640, not 037.

Good luck!
Seth

Re: More ftp problems

Wouter Jagers — Wed, 23 Jul 2003 19:58:51 GMT

I always try and make sure on filesystem level, by giving the directory 02xxx permissions (for example 02750).

When files are created in that directory, they should be owned by the group which owns the directory.