ftp error : 503 user access denied...

[Mike_108]

I'm currently using HP UX 11.0 installed on HP9000/800/L2000 server.

this is just happened 2 weeks ago, but before this it was ok.

i tried to ftp to the server but cannot login into the server, and i receive this error msg:


C:\>ftp 192.168.1.3
Connected to 192.168.1.3.
220 s01amy03 FTP server (Version 1.1.214.5 Tue Nov 16 09:39:15 GMT 1999) ready.
User (192.168.1.3:(none)): root
530 User root access denied...
Login failed.
ftp> bye
221 Goodbye.

C:\>

can somebody out there help me to figure out what is the problem....

regards,

[Jeff Schussele]

Hi Muhammad,

Make sure that root is NOT in the /etc/ftpd/ftpusers file.
This is a list of users NOT allowed to ftp.
Seems backwards doesn't it?

HTH,
Jeff

[Ken Hubnik_2]

You also need to see the /var/adm/inetd.sec file does not deny any ftp access.

[Steven E. Protter]

Want to fail an outisde security audit?

Then tale root out of the ftpusers file.

root user can accidently wipe out the whole system.

It may be a pain, but you should use less priviledged user ids for ftp transfers on and offf critical Enterprise HP-9000 servers.

Leave it alone, use another user, keep your system secure. Take it from a man who two years ago had this among other security faults presented to management in an audit that I initiated.

Steve

[Wouter Jagers]

Steve is absolutely right. However, if this was working 2 weeks ago, we want to find out what happened :-)

Did you perhaps change root's default shell (in /etc/passwd) to ksh recently ? If you did, ftp might not be accessible because of an 'invalid shell'. Check your logs for the messages.

regards

Wout

[KapilRaj]

check for /etc/shells (i do not remember correct me if i am wrong)

Any user's shell who wants to perform ftp should be entered here. I hope this is the problem

kaps

[Jose Mosquera]

Hi,

Are are denying ftp service for this address in /var/adm/inetd.sec file?

Also pls check following that root user is not appear in /etc/ftpd/ftpusers file, and a valid shell definition for root in /etc/passwd file.


Rgds.

[Mike_108]

Hi guys, sorry for late respond on all your answer. actually i've not online for last 2-3 days.
ok first of all, not only root can't ftp, but also all the user in that server can't login by ftp.

i've check in the /etc/ftpd/ftpusers file, no user login name inside the file.

and i check in the /var/adm/inetd.sec file, no user is denying for ftp.

only one thing that i check for the /etc/shells file, it contains string "/etc/local/bin/bash"
so, waht does it mean & what should i do to correct this ftp 503 error?

thanks & regards.

[Hai Nguyen_1]

It is the /etc/shells file which stops users from ftp'ing to the box. Someone has created this file on your server withing the last two weeks (Run "ll /etc/shells" to verify the timestamp of the file). If you rename the file (# mv /etc/shells /etc/shells.bak) then you and all other users will again be able to ftp to this server.

Hai

[Robert-Jan Goossens]

Hi,

Take a look at next discussion,

http://bizforums.itrc.hp.com/cm/QuestionAnswer/0,,0xb47b107d277ad611abdb0090277a778c,00.html

Robert-Jan.

[Jeff Schussele]

Hi,

I just thought of something else - is it possible that SSH has been installed & it's config has DENY ALL for ftp in it's config file?
Run
swlist | grep -i ssh
if it returns something, you'll need to check the config file.

Rgds,
Jeff

[KapilRaj · Accepted solution]

telnet hostname
login as root
cp /etc/shells /etc/shells.old
echo $SHELL >>/etc/shells
leave the shell as it is if u wanna revert incase of probs......

start an ftp session and start login as root

It should work

Good luck (U do not need it now)

Cheers .........

kaps

[Mike_108]

Hi all,

at last I manage to solve this problem by all of you all support. the problem happened because on november, somebody has modified the /etc/shells file, so, all the ? already answered.

this is because of /etc/shells file.
bye runnig "echo $SHELL >>/etc/shells" and the problem was solve.

thanks a lot to all of you that involve in solving this problem...

regards,
Mike

[Steven E. Protter]

Good.

Now, please, please please, because I like you, add root to /etc/ftupsers file and stop using root for ftp transfers. I'll sleep better at night. So will you.

:-)

Glad your problem is solved.

[Mike_108]

Hi steve,
thanks a lot on your advice...

i'll make sure the root will be leave alone, and hopefully the problem will never happened again, and now you can sleep well.
have a nice sleep... :-)

thanks & regards

Mike

[Joel Spencer]

Hi! What a great thread. This saved me today when I was desperately trying to ftp files using my user name and getting the access denied message.

Turns out that I had specified my startup shell as "/bin/ksh" which was NOT in /etc/shells. However, "/usr/bin/ksh" was in the /etc/shells file.

I changed my startup shell and all worked well. I had previously been combing thrugh files like inetd.sec and ftpusers and getting nowhere.

This thread saved me LOTS of time.

Best regards,

Joel Spencer
HP Australia.