ftp error log- hits port 20 and drops

[Mihael Lopatko]

Hi,
I am getting this error constantly on our new blade system log file;
when a ftp packet hits port 20 and drops, it records the following information:

May 21 04:45:26 "servername" ftpd[2403]: FTP session closed May 21 04:46:26 "servername" ftpd[2406]: Data port : 20 May 21 04:46:26 "servername" ftpd[2406]: FTP server (Revision 4.0 Version wuftpd-2.6

I am not sure where is it comming from and why?
Any help would be appreciated.

[Wilfred Chau_1]

do you have port 20 blocked on the firewall?
active ftp requires both port 20 and 21

try change to use passive mode and see if that works.

[Mihael Lopatko]

Port 20 is open , as per my network engineer.

[Matti_Kurkela]

Your "information" looks like three syslog messages, jumbled together:

> May 21 04:45:26 "servername" ftpd[2403]: FTP session closed

> May 21 04:46:26 "servername" ftpd[2406]: Data port : 20

> May 21 04:46:26 "servername" ftpd[2406]: FTP server (Revision 4.0 Version wuftpd-2.6

The [bracketed] number after the word "ftpd" is a PID number: one instance of ftpd typically handles one session. Therefore, the first log message belongs to one session, the second and third to another.

The last two messages look like standard wu-ftpd start-up messages. The information they contain is about ftpd version and configuration: they tell nothing about the port the incoming connection may have been using.

Port 20 is the FTP data port: it is not supposed to be open at all until a PORT command is issued within a FTP command session by the FTP client. (This happens automatically when a LS, DIR, GET or PUT command is used.) And when a PORT command is used, the data connection is opened _outgoing_ from the server, i.e. the server opens a data connection to the client.

To get more information about what is going on, you may have to increase the amount of logging. Please see:

http://www.wfms.org/wu-ftpd/docs/logging.html

In HP-UX, the ftpd daemon is typically started from inetd. This means each incoming FTP connection is first accepted by inetd: it starts a new copy of ftpd and then hands over the incoming connection to it. If you run "inetd -l" or send a "kill -QUIT" signal to the currently running inetd process, you can make it log the source addresses of all incoming connections processed by inetd... including any incoming FTP connections.

But there might be some conclusions you can make even without any information other than what you already have. Are the FTP-related log messages repeating in pretty much constant intervals, e.g. one group of messages every three minutes? If so, are you using some sort of enterprise monitoring software at your site? Perhaps its standard "HP-UX" monitoring template includes a test to verify that the FTP server is running on the system?

MK

[Mihael Lopatko]

Hi,

It looks like I found the server that was sending these ftp checks. So I will need to see if I can stop that or change the settings. I am not sure if this would create other problems or not, except increasing the log file! Thanks a lot.

[Bill Hassell]

> except increasing the log file!

You can cleanup your syslog.log by moving all the ftpd logging to another logfile. Edit the file /etc/syslog.conf and pull ftpd entries out like this:

*.info;mail.none;local5.none /var/adm/syslog/syslog.log
local5.info /var/adm/syslog/ftpd.log

local5 is the facility used by ftpd for logging so this will put the messages in a separate file.

[Mihael Lopatko]

Thanks. I will consider this.