Login failed message while starting FTP

[user1221]

root@hrdbdr01:/etc/ftpd# more /etc/shells
ksh
sh
bash
csh

[user1221]

root:wP3YfPdFupRN2:0:3::/:/sbin/sh

[Torsten.]

What shell is configured for root in /etc/passwd?




http://docs.hp.com/en/B3921-60631/ftpd.1M.html

...
ftpd authenticates users according to three rules:

- The user name must be in the password data base, /etc/passwd, and not have a null password. The client must provide the correct password for the user before any file operations can be performed.

- The user name must not appear in the file /etc/ftpd/ftpusers (see ftpusers(4)).

- The user must have a standard shell returned by getusershell().

[Hakki Aydin Ucar]

To enable the /etc/ftpd/ftpaccess file, you need specify the -a option for the ftp entry in the /etc/inetd.conf file. For example:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -a -l -d

is it OK ? check it out

[Torsten.]

I noticed the log "FTP LOGIN REFUSED" is for user rayees. How about his shell in passwd? Any similar message for root?

Did you already check if you have sftpd installed?

Since ftp is really unsecure, you should consider to use sftp anyway.

[user1221]

The entry in the /etc/inetd.conf file was
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

I changed it to;

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -a -l -d

and then restarted the inetd service with inetd -c.

There is no "ftpusers" file in /etc/ftpd/ftpusers.

checked again still not working.

[Matti_Kurkela · Accepted solution]

OK, the reason for rejection according to the syslog was "shell not in /etc/shells".

The shell field of /etc/passwd must match *exactly* with one of the lines in /etc/shells, otherwise ftpd will not allow access.

> root@hrdbdr01:/etc/ftpd# more /etc/shells
ksh
sh
bash
csh

Your /etc/shells does not have full path names in it. This may be the problem. Shells should be specified with a full path, both in /etc/passwd and in /etc/shells.

If /etc/shells is not readable or does not exist, the system uses this standard list:

/sbin/sh
/usr/bin/sh
/usr/bin/rsh
/usr/bin/ksh
/usr/bin/rksh
/usr/bin/csh
/usr/bin/keysh

This list is documented in getusershell(3C) man page (accessible with "man getusershell" command on your HP-UX system).

My suggestion: copy this standard list of shells to /etc/shells and add the full pathname of your bash shell to it. Then make sure your /etc/passwd uses full pathnames to specify the shells for each user.

MK

[Roland Piette]

Hi,

You report :
the /etc/ftpd/ftpaccess contents are
root@hrdbdr01:/etc/ftpd# more ftpaccess
root
rayees

I am afraid that this content doesn't match the needs for this file ! This content is totally wrong.

You need to make a copy of the sample file and reading the man page (man ftpaccess)
The sample file is located at the following path : /usr/newconfig/etc/ftpd/examples/ftpaccess

Regards
Roland

[user1221]

changed the /etc/shells to

/usr/bin/ksh
/sbin/sh
bash
/usr/bin/csh


restarted the inetd with inetd -c

Still the login failed message.

I transfered the files with scp as I cannot wait anymore to fix the FTP issue.
Thanks everyone for precious support.

[Roland Piette]

Hi,

I understand the urgency of the solution.
But if your are interresting to use ftp with ftpaccess file mecanism you are not far awy from the solution. I used it to give restricted access to users in this way that users cannot walk everywhere on my server (ftponly). They are connected in specific directory they see as root (/). ftpaccess is the key to handle the access rights.

Another thing to troubbleshoot the problem. Disable ftpaccess use in /etc/inetd.conf. Take away the -a option
restart inetd with inetd -c command
Try to connect !

If you can do it, you have a configuration problem with ftpaccess mecanism ....

Regards,
Roland