FTP server enabled but disabled on 7.3-2

[Susan Abercrombie]

I have an AlphaServer 2000 4/200running 7.3-2 and TCP/IP 5.4. I'm having a problem with the FTP server.

Using the server components option of
@sys$startup:tcpip$config
it shows FTP service as Enabled and Started. FTP client is also Enabled and Started. But
$tcpip show service ftp
lists the state as disabled. If I execute
$tcpip enable service ftp
I get no error message, but the service is still disabled.

I cannot make an ftp connection from another system to this host. Attempts to make a connection from another host fail with various messages depending on the client host. From an OpenVMS Itanium system on the same subnet the error is
%TCPIP-E-FTP_NETERR, I/O error on network device
-SYSTEM-F-REJECT, connect to network object rejected.
(Not surprising for a disabled service.)

The system was upgraded from OpenVMS 7.2-1 and TCP/IP 5.0a (if I recall the latter correctly). There was no problem connecting before the upgrade. There is no problem connecting from this host to the Itanium (similarly configured) or various other hosts. If I reboot to an image copy of the old 7.2-1 system, the settings seem to be the same, except that the FTP service is enabled within $TCPIP, and there is no problem with the FTP service.

Can someone suggest to me how the service can be both enabled/started and disabled, and how I can go about enabling it?

Thanks!
Sue

[Steven Schweda]

I have no real wisdom here, but have you
tried "TCPIP SHOW SERVICE /FULL FTP"?

Check user TCPIP$FTP in AUTHORIZE?

Anything in "SYS$MANAGER:TCPIP$FTP_SERVER.LOG"?

"@ SYS$MANAGER:TCPIP$FTP_SHUTDOWN.COM" and
"@ SYS$MANAGER:TCPIP$FTP_STARTUP.COM", and
look for anomalies?

SYSTEM-F-REJECT = "connection refused", as
you've probably surmised. (Outgoing and
incoming are pretty unrelated, so you should
concentrate on the broken half.)

TCPIP V5.4 is up to ECO 5 now.

[Volker Halle]

Sue,

a TCPIP service will switch from the enabled to disabled state, if the service (or the server process) cannot be correctly started. There should be an OPCOM message issued, which would provide additional information. The service logfile should also contain error inforamtion.

Volker.

[Ian Miller.]

Look for opcom messages and log files.
A problem I have had after a series of upgrades is incorrect ownership of directories.
Check owner and protection of TCPIP$FTP directory.

[Daniel Fernandez Illan]

Sue,

I had a similar problem with mount service when upgraded from TCP/IP 5.0a to TCP/IP 5.4.
Solution was to define Domain name on TCP/IP because version 5.0 did not need this variable but 5.4 yes.

Saludos.
Daniel.

[faris_3]

Hi,

This article cures 99 % of
%TCPIP-E-FTP_NETERR, I/O error on network device
-SYSTEM-F-REJECT, connect to network object rejected

errors.

Hoping you are noy in the 1% left.

http://h18000.www1.hp.com/support/asktima/communications/CHAMP_SRC960729007492.html

/homi

[faris_3]

>Can someone suggest to me how the service can be both enabled/started and disabled, and how I can go about enabling it?

If you have tried the latest ECO of 5.4,

in last ressort you can rename your SYS$COMMON:[SYSEXE]TCPIP$SERVICE.DAT to
something else end redo a full IP configuration.

/hf

[Willem Grooters]

Have you looked in the FTP logfiles (SYS$SYSDEVICE:[TCPIP$FTP]TCPIP$FTP_RUN.LOG - that can hold clues on what might be the problem. As stated by others, check protection and ownership of this directory and the files in it (But since it has worked, I doubt there would be something wrong)

Willem

[Susan Abercrombie]

Thanks, folks, for entirely sensible pointers. Still struggling :-).

The recommended article on the support site seems to be out of date (but is useful, regardless, and thank you!). It refers to installed images TCPIP$FTPC and TCPIP$FTPD. I don't have these. I have TCPIP$FTP_SERVER.EXE.

When SYS$MANAGER:TCPIP$FTP_STARTUP.COM is executed, it does install the image with privs. No error from the startup procedure. Nothing odd in the directory ownership or privs that I can see. Anyway, nothing different from the IA64 box.

I don't have a server process running. When the system reboots or when I try to start it manually, the resulting SYS$SYSDEVICE:[TCPIP$FTP]TCPIP$FTP_RUN.LOG contains:
%DCL-E-NOCMDPROC, error opening captive command procedure - access denied
TCPIP$FTP job terminated at 6-FEB-2006 16:07:15.68

Accounting information:
Buffered I/O count: 29 Peak working set size: 1952
Direct I/O count: 21 Peak virtual size: 171840
Page faults: 145 Mounted volumes: 0
Charged CPU time: 0 00:00:00.14 Elapsed time: 0 00:00:00.32

I assume the captive procedure TCPIP$FTP_RUN.COM in sys$system. It is owned by SYSTEM, and has W:RE protection. Same as on the IA64 box. There is nothing in the account's SYS$LOGIN other than a LOGIN.COM (with just a comment line), and its log files. All are owned by that user account.

Interactive execution from a privileged account resulted in a successful service. The initial output was
FTP server started on
.4 6-FEB-2006 19:29:11.88
That looked odd, so I set the domain, as someone suggested. Made the initial output prettier but did not allow the service to be started properly.

I booted up a 7.3-1 system which had been created by updating the 7.2-1. No problem starting the service there. I booted up a disk on which 7.3-2 had been installed from scratch rather than updated. No problem there.

So, the TCPIP$FTP user reports access denied on a captive procedure which is (presumably) SYS$SYSTEM:TCPIP$FTP_RUN.COM, which has W:RE protection.

I'm still baffled.

Is there any way that it could be trying to execute some other command procedure?

[Karl Rohwedder]

Susan,

regarding 'access denied': have you also checked the LGICMD procedure of the TCPIP$FTP account (should be LOGIN.COM)?

regards Kalle