Outbound FTP and telnet mostly not working

[Kent Ostby]

Hi folks --

I've got a machine here that can ftp and telnet out fine to machines on same domain but gets errors trying to get to other machines that it should have access.

when I try to telnet out, the response is:

Trying...
telnet: Unable to connect to remote host: Connection refused

when I try to ftp out, the response is:

ftp: connect: Connection refused
ftp>

Other machines seem to work fine going to my target machine and I can telnet and ftp into this machine.

Also, I can rlogin from this machine to the target machine.

Points will be given.

[TwoProc]

Kent,

The problem seems to be in the security settings of the machine that you're trying to get to.

I think that it has masked your machine out of /etc/hosts.allow or /etc/hosts.deny. But, apparently the rlogin level hasn't denied you access. Or maybe, that server has denied all access (maybe opting for only ssh logins (common) - but forgot to mask out the rlogin stuff).

Of course, it is probably not your machine specifically, more than likely it is all domains except for the local one, and maybe a trusted one or two. Same idea for the machine list (if it is not a domain level security rule) - it could be an exclusion for all machines, except for a small discrete list of machines that can access this one.

Ok, one more try (freethink warning)! - maybe identd can't figure out your machine - so it rejects it? Maybe it has a hard and fast rule for an identd rejection?

[Kent Ostby]

John .. it's not just one target system .. it's any system off the campus that this one is on.

For instance, my machine is :

abc.mydomain.hp.com

I can get to :

def.mydomain.hp.com

but not:

xyz.yourdomain.hp.com
or
qrp.someother.hp.com

[RAC_1]

Is the firewall in between?? If yes ae the required ports opened in the firewall??

What does syslog.log on target systems say??

Anil

[Kent Ostby]

There isnt a firewall and the machine next to it which is set up similarly can telnet to those same boxes.

[TwoProc]

Check the default gateway for both machines and compare... (but that doesn't make sense) - you *can* rlogin... I'm thinking routing except that you can still use some services...
hmm...
Allright then, how about differences in IPFilter rules for outbound traffic?

[Kent Ostby]

John -- Same gateway ...

Where would I see the IPFilter rules (or what specific command would list them for me).

[Steven E. Protter]

Trying...
telnet: Unable to connect to remote host: Connection refused

when I try to ftp out, the response is:

ftp: connect: Connection refused
ftp>

These are both typical responses of the following conditions;
* firewall block
* daemon not listening
* /var/adm/inetd.sec is blocking access
* ipfilter firewall is denying access by ip or hostname
* There is a problem on the target box being unable to open a process or spawn and ftpd or telnetd daemon
* misconfigured inetd.conf

These responses lean toward the target being an hp-ux box. Add ideas if its linux or windows.

SEP

[Kent Ostby]

Okay ... found the problem ...

On one machine we were using socksified telnet and ftp and on the other, we weren't.

Turns out that /etc/PATH had an incorrect setting (it had /opt/socks/bin ahead of /usr/bin ).

All is well now.

[Kent Ostby]

As noted above, the problem turned out to be that we were using socksified ftp and telnet by virtue of our path settings being incorrect.

which telnet from both machines was the telling clue.