Networking
cancel
Showing results for 
Search instead for 
Did you mean: 

FTP related messages in syslog.log

ASIFKHAN
Frequent Advisor

FTP related messages in syslog.log

Hi Seniors/Friends,

We are getting messages related to FTP in syslog.log continously.

Jun 7 15:07:56 WSWMSAPP ftpd[28541]: FTP server (Revision 4.0 Version wuftpd-2.6.1 Wed Jun 18 07:11:14 GMT 2008) ready.
Jun 7 15:07:58 WSWMSAPP ftpd[28541]: pam_authenticate:No account present for user
Jun 7 15:07:58 WSWMSAPP ftpd[28541]: User null: Login incorrect
Jun 7 15:07:58 WSWMSAPP ftpd[28541]: REFUSED "NULL" from localhost [127.0.0.1], null
Jun 7 15:08:11 WSWMSAPP ftpd[28542]: Data port : 20


I am unable to understand why it is happening and also we are seeing some transmitting issues at application side. since ftp & telnet service is the need of our application so we cannot disable it.

Although my FTP is working and i have set file [root@WSWMSAPP:/etc/ftpd]#cat /etc/ftpd/ftpusers
root
null

[root@WSWMSAPP:/etc/ftpd]#uname -a
HP-UX WSWMSAPP B.11.31 U ia64 0781042592 unlimited-user license
[root@WSWMSAPP:/etc/ftpd]#swlist | grep -i wuftpd


Thanks
ASIF KHAN

3 REPLIES
Matti_Kurkela
Honored Contributor

Re: FTP related messages in syslog.log

According to the logs, the connection attempt comes from the local host.

Perhaps something is trying to make a FTP login with an unspecified username, i.e. user "". The program code that produces the subsequent log messages is apparently smart enough to replace "" with "null".

Does your application include a monitoring function that periodically checks if the FTP server is accessible? Or do you have some sort of enterprise monitoring system installed? (Such a monitoring agent might be checking the availability of the FTP server by default.)

MK
MK
ASIFKHAN
Frequent Advisor

Re: FTP related messages in syslog.log

HI MK,

Thanks for reply.
I tried to search for "" or NULL user in user database but did not find any such user.

Second thing we have same type of server with same application but we are not getting such messages there.

We niether have installed monitoring tool nor appplication has anu inbuilt feature to ceck for ftp.

Thank::
Asif Khan
Matti_Kurkela
Honored Contributor

Re: FTP related messages in syslog.log

> I tried to search for "" or NULL user in user database but did not find any such user.

Nothing suggests that such a user actually exists - only that someone or something is attempting a FTP login on localhost and leaving the username part empty when sending the FTP LOGIN command.

You said you also have some "transmitting issues" with your application, and that the application uses FTP.

Does your application use FXP-style FTP transfers, i.e. does it connect to both local & remote FTP servers and make them transfer files to each other? In that case, the application must have a configuration entry for the local FTP username. If that entry is left empty, and the application will retry any failed transfers, that might be the cause - for both the log messages and for your "transmitting issues".

MK
MK