The inability to connect with FTP is a symptom, you'll need to identify the actual cause first.
- Is the HP-UX FTP server fileset installed? (It may have been removed if your site has a strict security hardening policy.)
swinstall -l fileset | grep FTPServer
The fix for this: reinstall the HPUX-FTPServer filesets from your HP-UX installation media.
- Does the /usr/lbin/ftpd binary exist? (It may have been removed without swremoving the fileset if your site has a clumsily-applied strict security hardening policy)
ll /usr/lbin/ftpd
The fix for this: the same as the previous one.
- Is inetd configured to start ftpd when someone attempts to connect? (With HP-UX 11.23 and later, non-essential services may be automatically disabled at OS installation time if you choose to use one of the Install-Time Security profiles. In 11.31, a security profile might even be applied by default unless you explicitly choose a traditional non-secured installation if I recall correctly.)
grep ^ftp /etc/inetd.conf
The fix for this: make sure ftpd is configured in inetd.conf as described earlier in this thread. Send a "kill -HUP" to inetd when you're done.
- Has someone commented out or removed "ftp" from /etc/services? Editing /etc/services used to be the only way to stop the syslog daemon from accepting incoming messages from network in the HP-UX versions 10.20 and 11.00, but for some strange reason some people seem to be thinking this is the right way to disable any network service in HP-UX. (This is not true: while disabling an inetd service this way may work, it will cause inetd to emit error messages in syslog each time it starts or re-reads its configuration. Other services like sshd are not based on inetd and may or may not need /etc/services at all, so changing /etc/services may have no effect on them.)
ps -ef |grep [i]netd
The fix for this: find out why inetd has been stopped (it may be a security policy at your site). Start inetd.
- Has the connection been blocked by rules in /var/adm/inetd.sec? Read the file, and edit the rules if necessary.
- If the answers to all the previous questions has been 'yes', there might be an IPFilter configured in HP-UX, or a network firewall in between your FTP client and the HP-UX system. These can refuse the connection on behalf of the HP-UX system, so that the HP-UX never sees the incoming FTP connection.
See if you have IPFilter rules configured in /etc/opt/ipf directory, edit them and reapply if necessary (see IPFilter documentation).
If /etc/opt/ipf does not exist or is empty, or editing IPFilter did not solve the problem, configure inetd to log incoming connections (see "man inetd"), restart inetd, make a FTP connection attempt, and check the syslog.
If there is no message from inetd about an incoming FTP connection, you now know the connection attempt is not actually reaching your server at all: something else is rejecting the connection. Contact your network administrator for further troubleshooting.
If you see a log message from inetd, there might be some other problem that prevents inetd from starting ftpd for your incoming FTP connection. Read the next lines of syslog: there should be an error message from inetd describing the problem.
MK
