ftp not working... Audit Error... Exit with signal 11

[Eric Crosby_1]

I have a 5430 running 11.11. Just started yesterday afternoon, wherever you ftp from, after successful login you get an error:

530 Login disallowed (audit error)
Login failed.

Disk space is not an issue. Auditing is turned off. tcp wrappers and ftp show a good connection (ie. successful login), then it gives me an error: exiting on signal 11.

Anyone have any ideas?
Thanks Ahead of time.

Eric

[harry d brown jr]

ftpaccess ??

What is a successful login if the login fails?

live free or die
harry

[Eric Crosby_1]

When I say successful login, I mean successful authentication (as per syslog). IE:

Aug 22 08:07:10 5430A ftpd[17862]: PAM_TEXT_INFO: Last successful login for MyUserName: Thu Aug 22 08:06:36 MST7MDT 2002 on tty .
Aug 22 08:07:10 5430A ftpd[17862]: PAM_TEXT_INFO: Last unsuccessful login for MyUserName: Fri Aug 2 09:57:21 MST7MDT 2002 .
Aug 22 08:07:10 5430A ftpd[17862]: FTP session closed
Aug 22 08:07:10 5430A ftpd[17862]: exiting on signal 11


My tcp wrappers I have logging both successful and unsuccessfulwhich shows as successful connection.


Hope this clarifies things a bit.

Thanks,
Eric

[john korterman · Accepted solution]

Hi,

if yours is a trusted system, you might take a look at the last entry in the attached thread:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x3ab553921f1ad5118fef0090279cd0f9,00.html


regards,
John K.

[harry d brown jr]

What does your ftpaccess file look like?

live free or die
harry

[Eric Crosby_1]

Okay, this just took a turn for the worse.

I now see that a few users CAN ftp. I do see a coorelation though. The users home directories who cannot ftp are showing up as the being owned by their UID instead of showing the user name. I have done an authchk -p. Which has not helped.

[Darren Prior]

Hi Eric,

A couple of thoughts:

* Are you running any 3rd party security products?

* Can you see an entry in /etc/passwd for a problem user's UID? Authck is a good check to ensure /etc/passwd and tcb are correct, but won't catch a user missing from both places.

regards,

Darren.

[Eric Crosby_1]

Fixed. Authck -k showed some problems. Then pwck showed that user oracle had too many fields. After that was fixed, all the other issues went away.

Thanks For everyone!!!