FTP related messages in syslog.log

[ASIFKHAN]

Hi Seniors/Friends,

We are getting messages related to FTP in syslog.log continously.

Jun 7 15:07:56 WSWMSAPP ftpd[28541]: FTP server (Revision 4.0 Version wuftpd-2.6.1 Wed Jun 18 07:11:14 GMT 2008) ready.
Jun 7 15:07:58 WSWMSAPP ftpd[28541]: pam_authenticate:No account present for user
Jun 7 15:07:58 WSWMSAPP ftpd[28541]: User null: Login incorrect
Jun 7 15:07:58 WSWMSAPP ftpd[28541]: REFUSED "NULL" from localhost [127.0.0.1], null
Jun 7 15:08:11 WSWMSAPP ftpd[28542]: Data port : 20


I am unable to understand why it is happening and also we are seeing some transmitting issues at application side. since ftp & telnet service is the need of our application so we cannot disable it.

Although my FTP is working and i have set file [root@WSWMSAPP:/etc/ftpd]#cat /etc/ftpd/ftpusers
root
null

[root@WSWMSAPP:/etc/ftpd]#uname -a
HP-UX WSWMSAPP B.11.31 U ia64 0781042592 unlimited-user license
[root@WSWMSAPP:/etc/ftpd]#swlist | grep -i wuftpd


Thanks
ASIF KHAN

[Matti_Kurkela]

According to the logs, the connection attempt comes from the local host.

Perhaps something is trying to make a FTP login with an unspecified username, i.e. user "". The program code that produces the subsequent log messages is apparently smart enough to replace "" with "null".

Does your application include a monitoring function that periodically checks if the FTP server is accessible? Or do you have some sort of enterprise monitoring system installed? (Such a monitoring agent might be checking the availability of the FTP server by default.)

MK

[ASIFKHAN]

HI MK,

Thanks for reply.
I tried to search for "" or NULL user in user database but did not find any such user.

Second thing we have same type of server with same application but we are not getting such messages there.

We niether have installed monitoring tool nor appplication has anu inbuilt feature to ceck for ftp.

Thank::
Asif Khan

[Matti_Kurkela]

> I tried to search for "" or NULL user in user database but did not find any such user.

Nothing suggests that such a user actually exists - only that someone or something is attempting a FTP login on localhost and leaving the username part empty when sending the FTP LOGIN command.

You said you also have some "transmitting issues" with your application, and that the application uses FTP.

Does your application use FXP-style FTP transfers, i.e. does it connect to both local & remote FTP servers and make them transfer files to each other? In that case, the application must have a configuration entry for the local FTP username. If that entry is left empty, and the application will retry any failed transfers, that might be the cause - for both the log messages and for your "transmitting issues".

MK