FTP 530 Login incorrect error

[jeff willis_1]

We've replaced an old Alphaserver running Openvms 7.1-1H2 ucx version 4.2 ECO 1 to a new itanium 2620 running Openvms 8.2.1 tcpip 5.5 ECO 1. The only problem we've got is ftp. We're trying to put files from a Windows 2003 server and we itermittently getting FTP 530 Login incorrect errors. We don't get this when we use the old machine or when we try and ftp from a Windows XP box to the new server.

[Steven Schweda]

Anything interesting in the log file(s)?

SYS$SYSDEVICE:[TCPIP$FTP]TCPIP$FTP_RUN.LOG

SYS$MANAGER:OPERATOR.LOG

Different service limit or other
characteristics?

UCX show service /full ftp

[jeff_447]

Thanks for quick response

Entry in SYS$SYSDEVICE:[TCPIP$FTP]TCPIP$FTP_RUN.LOG

%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 10.1.0.15 at 4-JUN-2006 10:27:58.58

%TCPIP-E-FTP_LOGFAL, remote interactive login failure ordout

-TCPIP-I-FTP_NODE, client host name: 10.1.0.15

-LOGIN-F-NOSUCHUSER, no such user

Nothing in operator.log

FTP Limit is greater in new machine at 1000. Old machine user limit is 10

Is there an ftpusers file I need to populate like linux

[Steven Schweda]

So, is there a user name of "ordout"?
(Someone seems to think so, someone else,
not.)

A bad password for a valid user looks like:

%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 10.0.0.9 at 31-MAY-2006 06:05:10.95
%TCPIP-E-FTP_LOGFAL, remote interactive login failure sms
-TCPIP-I-FTP_NODE, client host name: 10.0.0.9
-LOGIN-F-INVPWD, invalid password

I know of no analogue to /etc/ftpusers.

[jeff_447]

Do the following errors mean that due to a remote ftp script continually trying to access our server with an invalid username that when a user tries to perform a manual ftp from the same machine a break-in evasion comes into in effect

%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 10.1.0.15 at 4-JUN-2006 11:32:58.60
%TCPIP-E-FTP_LOGFAL, remote interactive login failure ordout
-TCPIP-I-FTP_NODE, client host name: 10.1.0.15
-LOGIN-F-NOSUCHUSER, no such user
%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 10.1.0.15 at 4-JUN-2006 11:33:58.59
%TCPIP-E-FTP_LOGFAL, remote interactive login failure ordout
-TCPIP-I-FTP_NODE, client host name: 10.1.0.15
-LOGIN-F-NOSUCHUSER, no such user
%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 10.1.0.15 at 4-JUN-2006 11:34:25.40
%TCPIP-E-FTP_LOGFAL, remote interactive login failure wmsmgr
-TCPIP-I-FTP_NODE, client host name: 10.1.0.15
-LOGIN-F-EVADE, break-in evasion in effect

[Volker Halle]

Jeff,

try a $ SHOW INTRUSION command on your VMS system to see the intrusion records. You can delete intrusion records with DELETE/INTRUSION

Volker.

[Steven Schweda]

It sure looks that way. You might also
learn something useful from ANAL /AUDIT in a
case like this.

[Volker Halle]

Jeff,

I just tried such an operation and after 6 or 7 login attempts with a bad username/password, I get the following intursion record and can't login anymore from that node with a valid username/password:

AXPVMS $ show int
Intrusion Type Count Expiration Source
--------- ---- ----- ---------- ------
NETWORK INTRUDER 7 6-JUN-2006 15:25:07.72 10.20.30.151::FTP_0xxxxxxxx

Volker.

[jeff_447]

Going add the required user and see what happens. Thanks Everybody