Anonymous FTP responds "530 Login incorrect."

[Esko Ilola]

[esko@fragpc download]$ ftp as2000
Connected to as2000.furpile.com.
220 as2000.furpile.com FTP Server (Version 5.4) Ready.
502 AUTH is unimplemented.
502 AUTH is unimplemented.
KERBEROS_V4 rejected as an authentication type
Name (as2000:esko): ftp
331 Guest login OK, send ident as password.
Password:
530 Login incorrect.
Login failed.
Remote system type is VMS.
ftp> quit
425 Session is disconnected.

I have done everything "by the book" and I have also tried out a flock (big flock) of different approaches to fix this one.

This is how my TCPIP$FTP_SYSTARTUP.COM looks like:
$ DEFINE/SYSTEM/EXEC TCPIP$FTP_ANONYMOUS_LOG DISK$ANONFTP0:[LOGFILES]ANON.LOG
$ DEFINE/SYSTEM/EXEC TCPIP$FTP_SERVER DISK$ANONFTP0:[LOGFILES]FTP.LOG
$ DEFINE/SYSTEM/EXEC TCPIP$FTP_ANONYMOUS_ALIAS FTP
$ DEFINE/SYSTEM/EXEC TCPIP$FTP_ANONYMOUS_DIRECTORY DISK$ANONFTP0:[FTPROOT],DISK$ANONFTP1:[FTPROOT],DISK$ANONFTP2:[FTPROOT]

Any idea what is wrong ?

[Esko Ilola]

Oh... Forgot to mention:
I'm running OpenVMS 7.3-2 in a puny AS2000.

Downgraded to 7.3-2 from 8.2 because I had a lot of difficulties with the newer OS.

Old is good...

[Steven Schweda]

Anything in the log files (including
non-anonymous)?

"Guest login" suggests that the "ftp" user
alias is ok, but have you tried "anonymous"
as user instead of "ftp"?

What are you using as the password? (I don't
know of anything which fails, though.)

It all (Version V5.4 - ECO 5, OpenVMS V7.3-2)
works for me, but I get no "AUTH" or
"KERBEROS" messages.

[Esko Ilola]

Hi.

Those extra AUTH messages result from Linux ftp client trying to connect using different authorization methods before falling back to the old stuff. There is nothing bad in them as long as the FTP server does not loose it's marbles which it seemingly does not here.

And yes, I have tried the ANONYMOUS as well. The FTP is just an anonymous alias defined in the TCPIP$FTP_SYSTARTUP.COM.

Could it be some file the server does not have rights to modify/use and the respond being a tad misleading ?

[Steven Schweda]

There could be something in one of the log
files, too, but I can't read them from here.

[Wim Van den Wyngaert]

Tested it on 7.3.

1) I had to restart TCPIP before the alias was accepted.
2) After I removed ANONYMOUS from the sysuaf I got about the rejection you had (after a Guest login OK).

So, did you add ANONYMOUS to the sysuaf with tcpip$config ?

Wim

[Esko Ilola]

Yes. I used the TCPIP$CONFIG "Add anonymous ..." thing to add the anonymous account to SYSUAF.

$ set def sys$system
$ run authorize
UAF> show anonymous

Username: ANONYMOUS Owner: ANONYMOUS
Account: ANONY UIC: [3376,1] ([ANONY,ANONYMOUS])
CLI: DCL Tables: DCLTABLES
Default: DISK$ANONFTP0:[ANONYMOUS]
LGICMD: _NL:
Flags: DisCtlY DefCLI LockPwd Restricted DisWelcome DisNewMail DisMail
DisReport DisReconnect
Primary days: Mon Tue Wed Thu Fri
Secondary days: Sat Sun
Primary 000000000011111111112222 Secondary 000000000011111111112222
Day Hours 012345678901234567890123 Day Hours 012345678901234567890123
Network: ##### Full access ###### ##### Full access ######
Batch: ----- No access ------ ----- No access ------
Local: ----- No access ------ ----- No access ------
Dialup: ----- No access ------ ----- No access ------
Remote: ----- No access ------ ----- No access ------
Expiration: (none) Pwdminimum: 6 Login Fails: 1
Pwdlifetime: 90 00:00 Pwdchange: (pre-expired)
Last Login: (none) (interactive), 6-DEC-2005 00:42 (non-interactive)Maxjobs: 0 Fillm: 50 Bytlm: 52200
Maxacctjobs: 0 Shrfillm: 0 Pbytlm: 0
Maxdetach: 0 BIOlm: 18 JTquota: 4096
Prclm: 8 DIOlm: 18 WSdef: 350
Prio: 8 ASTlm: 100 WSquo: 512
Queprio: 4 TQElm: 15 WSextent: 512
CPU: (none) Enqlm: 100 Pgflquo: 10240
Authorized Privileges:
NETMBX TMPMBX
Default Privileges:
NETMBX TMPMBX
UAF> exit
%UAF-I-NOMODS, no modifications made to system authorization file
%UAF-I-NAFNOMODS, no modifications made to network proxy database
%UAF-I-RDBNOMODS, no modifications made to rights database

[Wim Van den Wyngaert]

Anal/aud to find out the details of the login failure.

Is ftp working from the VMS host to the VMShost itself ?

Wim

[Wim Van den Wyngaert]

The sysuaf setup is the same as on my node (with exception of the 1 logion failure).

Intrussions active ? Is the user name anonymous working correctly ?

Wim

[Peter Zeiszler · Accepted solution]

Can you check the security of the ANONYMOUS LOG directory?

[Esko Ilola]

After resting a tad (2 weeks) I returned to this issua and found out the reason almost immediately: The FTP server was not allowed to write to the ANONFTP.LOG. Why? Because I had changed the log file myself and didn't change the ownership or ACL to allow this. Hmph...