confusing ftp message

[George Liu_4]

The ftp server with PHNE_27765 returns confusing messages after login was failed. See below,

It is HP-UX B.11.11


220 host.domain FTP server (Version 1.1.214.4(PHNE_27765) Wed Sep 4 05:59:34 GMT 2002) ready.
Name (host:root):
331 Password required for root.
Password:
530 Login incorrect.
Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

Any configuration can be tuned for this? Thanks in advance.

[Robert-Jan Goossens]

Hi,

Are you sure you are on the system, could you check with an ls if you see some files.

Robert-Jan

[James A. Donovan]

Do you have an /etc/ftpd/ftpusers file? Is the root user listed in that file? If the answer is yes to both questions, then remove the root user from this file and try again.

$ man ftpusers

for more information on the ftp security file.

If that doesn't fix the problem, check the syslog.log file of the system you're trying to ftp onto. It may have more information on why access is being denied.

[Jeff Schussele]

Hi George,

It's just reporting remote system type & default transport mode.

Rgds,
Jeff

[George Liu_4]

Jeff,

Could those messages be disabled? Thanks.

:-) George

[RAC_1]

Check /etc/ftpd/ftpusers or /etc/ftpusers file.
Also check /etc/shells file. this should have all shells listed that user's use and are allowed to do ftp.
Check if FTP is allowed. Ceck /var/adm/inetd.sec file.

Anil

[rick jones]

Well, disabling the messages would still leave one not logged-in :) However, if you examin the manpage for "ftp" (doesn't everyone try man "foo" when they first have an issue with foo?-), you will likely find an option that disables the SYST and TYPE calls and what other options are required.

[George Liu_4]

Well, my original question is not "how to make ftp available to root or such". My question is how to disable these messages "Remote system type is UNIX. \Using binary mode to transfer files."

You don't want to everybody knows your system type. Right?

[rick jones]

If you are simply trying to make the system type messages go away because you are worried about crackers, do keep in mind that while you may be able to make that method of ID go away (you will also need to change the "welcome" message), I personally do not believe that it will make your system any more "secure" as hiding the system type is merely a variant of "security through obscurity"

[George Liu_4]

We do have warning banner.

[Marvin Strong]

I don't know how to disable the messages, but does it matter anyway, once someone logs into ftp the command:

syst

can get the OS anyway.

As far as a banner goes, anyone thats going to crack you isn't going to care about the banner IMO.

[George Liu_4]

I agree with Marvin from the technical point of view. However, Banner is required from our security policy. It is better not to responde "syst" and "type" also.

[Jeff Schussele]

Hi Marvin,

It's not a matter of the perpetrator "caring" about the banner. It's a matter of whether one can prosecute for this behavior. Courts have ruled in the past that w/o a banner stating that misuse is subject to criminal penalty, it could be perceived as an "invitation" to do what they please.
So you'd better have that banner if you intend to do something prosecute hackers after they've been caught.

My 2 cents,
Jeff

[Marvin Strong]

I didn't mean to imply that the banner was not required. Certainly it should be there for legal reasons.

I was just stating the most persons that are willing to crack will take their chances anyway.

I was just trying to point out that hiding OS type, is not nearly enough to secure ftp, from malicious users.

Which im sure everyone here realizes already.

[Jeff Schussele]

I certainly agree Marvin.
That's why PW hardening & teaching users about how to deal with "social-engineering" are the #1 lines of defense.

Cheers,
Jeff