ftpd 'refused' messages in syslog

[Brad Marks]

Running 10.20 on a k-420.
I've begun getting this repeating message in syslog at 20 min. after each hour. Any help in making this go away would be greatly appreciated.
Thanks!
Aug 17 02:20:29 fki ftpd[1113]: refused PORT 208,253,206,240,4,129
Aug 17 02:21:29 fki ftpd[1194]: refused PORT 208,253,206,240,4,130
Aug 17 02:22:29 fki ftpd[1241]: refused PORT 208,253,206,240,4,133
Aug 17 02:23:29 fki ftpd[1315]: refused PORT 208,253,206,240,4,134
Aug 17 03:20:29 fki ftpd[4084]: refused PORT 208,253,206,240,4,220
Aug 17 03:21:28 fki ftpd[4097]: refused PORT 208,253,206,240,4,221
Aug 17 03:22:28 fki ftpd[4172]: refused PORT 208,253,206,240,4,222
Aug 17 03:23:29 fki ftpd[4222]: refused PORT 208,253,206,240,4,223
Aug 17 04:20:28 fki ftpd[7076]: refused PORT 208,253,206,240,5,30
Aug 17 04:21:28 fki ftpd[7100]: refused PORT 208,253,206,240,5,31
Aug 17 04:22:28 fki ftpd[7110]: refused PORT 208,253,206,240,5,32
Aug 17 04:23:29 fki ftpd[7222]: refused PORT 208,253,206,240,5,35
Aug 17 05:20:29 fki ftpd[9868]: refused PORT 208,253,206,240,5,151
Aug 17 05:21:28 fki ftpd[9941]: refused PORT 208,253,206,240,5,152
Aug 17 05:22:28 fki ftpd[9951]: refused PORT 208,253,206,240,5,155
Aug 17 05:23:28 fki ftpd[10062]: refused PORT 208,253,206,240,5,156

[Brian Bergstrand]

Someone is connecting to your server and sending a PORT command to setup the data connection. PORT consists of the 4 bytes of an IP address (208.253.206.240) and the two bytes of a port number.

This shell command will give you the port number by substituting X and Y with the last two numbers respectively.

echo $(( ($X<<8) + $Y ))

So the first port number would be:

echo $(( (4<<8) + 129 ))
1153

Your server is refusing the PORT commands for some reason. Most likely the PORT address is different from the host that made the connection. This will cause the server to reject the PORT command since someone could be trying to do something nasty (or they are behind a stupid NAT firewall). Your server may also be configured to not allow certain addresses.

If you are using WU-FTPD (which I think is the default in 11i - or maybe a patch) then check out the following config commands. They should allow you to accept different PORT addresses; if that is what you really want.

passive address
passive ports
pasv-allow
port-allow

HTH.

[Brad Marks]

I found the solution to this! Only took two years!

In /etc/inetd.conf where the ftp service si started as ftpd, I added the -p argument. So the line looks like this:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -p

Thought someone might like to know one day...

Thanks,
Brad

[Alan Meyer_4]

Brad, thanks for the update... I'd give you points... but, ummm, this is your message... :)

[Alex Lavrov.]

Hmm, how and why it solves the problem?
Don't have HPUX box right now to "man ftpd" :)

[Brad Marks]

Alex,
As per the man page for ftpd:
-p The default action of ftpd does not allow usage of
reserved ports as the originating port on the
client's system i.e., the PORT command cannot
specify a reserved port. This option allows the
client to specify a reserved port. Note, allowing
usage of reserved ports can result in the misuse
of ftpd. The security ramifications should be
understood before the option is turned on.


Thanks, Alex, for helping this post to be more helpful.

Brad

[Alex Lavrov.]

OK, thanx!

(zero points plz:) )

[Brad Marks]

-p The default action of ftpd does not allow usage of
reserved ports as the originating port on the
client's system i.e., the PORT command cannot
specify a reserved port. This option allows the
client to specify a reserved port. Note, allowing
usage of reserved ports can result in the misuse
of ftpd. The security ramifications should be
understood before the option is turned on.