FTP to Alpha ES40 running Open VMS 7.3-1

[jaker]

When using internet explorer 6.0 SP2 to make a ftp connection to my ES40 ALpha, I can only log on 2x within a certain period and then it wont allow any more connections( IE it wont allow me to log on and in the auth utility it shows login failures).. Is this a OpenVMS limitation and how do I change it??

[Steven Schweda]

> VMS 7.3-1

This does not identify the IP software, nor,
consequently, the FTP server. If we assume
HP's TCPIP (as in "TCPIP SHOW VERSION")...

I don't use MSIE, so all I know is what I see
on my (VMS) FTP server. From what I've seen,
MSIE has no idea how to interpret the VMS
directory listings, so it's pointless to try
to use it with a TCPIP FTP server.

I haven't observed MSIE causing repeated
log-in failures at my FTP server, but it's so
lame that it could do almost anything without
amazing me.

> [...] log on [...]

Anonymous FTP, or specifying a real user name
and password?

> Is this a OpenVMS limitation and how do I
> change it??

First, you might look at the FTP server logs
on the VMS system, to see what's actually
happening. Then, when you decide that MSIE
is doomed in this situation, you might try a
more capable FTP client, like a better Web
browser, or a dedicated FTP client like, say,
SmartFTP,

[labadie_1]

Can you post the result of
$ ucx sh service ftp/full

[Ian Miller.]

HGFTP is supposed to play well with IE and HP TCPIP.

However you do need to look at the logs.

IE is probably making multiple connections to your system

[Steven Schweda · Accepted solution]

Looking over my anonymous FTP server log, it
appears that MSIE ("ident:IEUser@") logs in
and out much more frequently than other
clients, often once for each FTP command.
Thus, if there's an authorization problem, it
could quickly be interpreted as a break-in
attempt.

It also routinely fails to distinguish a VMS
directory spec from a file name, leading to
such doomed commands as:

CWD dir:SYS$POSIX_ROOT^:^[misc^]xp1000sg.exe

(which, I'd guess, also got a gratuitous
slash tacked on, in case it wasn't defective
enough to begin with.)

On the bright side, some poor fellow on the
HP-UX forum can't get it to work right, even
with a _UNIX_ FTP server:

http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1220322

[jaker]

we arent allowing anonymous logins and I use the VMS login.. and yes it is the HP TCPIP as in $ ucx tcpip>

Here is the output fromthe ucx sho service ftp/full
Service: FTP
State: Enabled
Port: 21 Protocol: TCP Address: 0.0.0.0
Inactivity: 5 User_name: TCPIP$FTP Process: TCPIP$FTP
Limit: 10 Active: 0 Peak: 9

File: TCPIP$SYSTEM:TCPIP$FTP_RUN.COM
Flags: None

Socket Opts: Rcheck Scheck
Receive: 0 Send: 0

Log Opts: Acpt Actv Dactv Conn Error Exit Logi Logo Mdfy Rjct TimO Addr
File: SYS$SYSDEVICE:[TCPIP$FTP]TCPIP$FTP_RUN.LOG

Security
Reject msg: not defined
Accept host: 0.0.0.0


Is the limit shown here meaning concurrent connections as in only 10 connections are allowed at 1 time..???

I think I answered most of the questions...:-)

[Steven Schweda]

> I think I answered most of the
> questions...:-)

> (as in "TCPIP SHOW VERSION")...


> Is the limit shown here meaning concurrent
> connections as in only 10 connections are
> allowed at 1 time..???

tcpip help set service /limit


So, I'd expect your FTP server log to be:

SYS$SYSDEVICE:[TCPIP$FTP]TCPIP$FTP_RUN.LOG

Its contents may offer some clues to what's
happening.


On the bright side, Firefox on a Mac doesn't
do a very good job with a TVPIP FTP server,
either. It's better than MSIE, but file and
directory names which are long enough to be
presented on two lines confuse it (until it
sees the first short name -- goofy). And
Safari is about as hopeless as MSIE.

Isn't it interesting that TCPIP doesn't
include an FTP server which anyone else
likes, and its vendor seems unable or
unwilling to try to get popular Web browsers
changed to accomodate the FTP server it does
have?

[jaker]

Here is part of the log...
I am the elmjr1 userid.... I can log on fine with siad userID

%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 10.53.20.65 at 8-APR-`
%SYSTEM-F-NOSUCHID, unknown rights identifier
%TCPIP-E-FTP_LOGFAL, remote interactive login failure anonymous
-TCPIP-I-FTP_NODE, client host name: 10.53.20.65
-LOGIN-F-NOSUCHUSER, no such user
%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 10.53.20.65 at 8-APR-`
%SYSTEM-F-NOSUCHID, unknown rights identifier
%TCPIP-E-FTP_LOGFAL, remote interactive login failure anonymous
-TCPIP-I-FTP_NODE, client host name: 10.53.20.65
-LOGIN-F-NOSUCHUSER, no such user
%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 10.53.20.65 at 8-APR-`
%SYSTEM-F-NOSUCHID, unknown rights identifier
%TCPIP-E-FTP_LOGFAL, remote interactive login failure anonymous
-TCPIP-I-FTP_NODE, client host name: 10.53.20.65
-LOGIN-F-NOSUCHUSER, no such user
%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 10.53.20.65 at 8-APR-`
%TCPIP-E-FTP_LOGFAL, remote interactive login failure ELMJR1
-TCPIP-I-FTP_NODE, client host name: 10.53.20.65
-LOGIN-F-EVADE, break-in evasion in effect

I guess I cant pin-point the "unknown rights identifier" part of this log..
I am the admin on the ES40 , but I have used 3rd party ftp software in the past and not TCPIP's FTP.. There is no $$ in the budget for this system since its going away next year...

And thanks for all your input BTW

"Isn't it interesting that TCPIP doesn't
include an FTP server which anyone else
likes, and its vendor seems unable or
unwilling to try to get popular Web browsers
changed to accomodate the FTP server it does
have?"
I wouldnt think FTP would be going away so maybe folks dont like making changes to stuff that works (limited as it is)... If it aint broke dont fix it kinda thing...??

[Steven Schweda]

It appears that you're getting a bunch of
failing "anonymous" log-in requests, followed
by an attempt as user ELMJR1, which fails
because all the "anonymous" failures have
poisoned the well:

-TCPIP-I-FTP_NODE, client host name: 10.53.20.65
-LOGIN-F-EVADE, break-in evasion in effect

After enough failures from one IP address,
even valid info will be rejected for a while.

> I guess I cant pin-point the "unknown
> rights identifier" part of this log..

Knowing nothing, I'd assume that it's
specific to the "anonymous" user, which, I
gather, you don't have.

Without knowing exactly what you're doing
with your browser, it's hard to say what's
causing all the (failing) "anonymous" log-in
requests.

You might be happier if you enabled anonymous FTP (SYS$MANAGER:TCPIP$CONFIG.COM, "Optional
components"), even if you don't actually
intend to use it for anything. If nothing
else, it should evade the LOGIN-F-EVADE
problem (symptom?).

[jaker]

ok WE have installed SmartFTP and for me ( I am the system admin with all privs)it works great, for our standard user they are restricted and have netmbx,oper, and tmpmbx and it doesnt work at all; in the ftp log file it shows a connection but the SmartFTP never connects. I think it is related to the vms login, but not sure what priv allows that to work...

Thanks

[Steven Schweda]

> [...] I think it is related to the vms
> login, but not sure what priv allows that
> to work...

No special privileges (including OPER) are
needed to use FTP. I can imagine that there
are other possible problems, but, with no
evidence, it's tough to guess which of the
multitude it might be.

You might try to verify that a "normal" user:

Can actually log in from a PC, using, say,
Telnet.

Can use a simple/stupid command-line FTP
client, either from a PC, or, better, from
the VMS system itself.

If SmartFTP is trying to use passive mode,
you might try to persuade it not to. If it
can show you a detailed transcript of what it
does (and what happens when it does it), that
might tell you something. I haven't used
SmartFTP lately, and I don't have a
convenient Windows system here, but I have
seen it work with a TCPIP FTP server in the
past.


> (as in "TCPIP SHOW VERSION")...

I don't enjoy pulling teeth. Would this be
_so_ tough to do?

[jaker]

This is the response from the tcpip sho version..
tcpip sho version

Compaq TCP/IP Services for OpenVMS Alpha Version V5.3
on a AlphaServer ES40 running OpenVMS V7.3-1

I appreciate all your help, and hopfully its not as hard as pulling teeth..

[Steven Schweda]

> [...] Version V5.3 [...]

It probably wouldn't matter, but this version
seems to be up to ECO 2:

ftp://ftp.itrc.hp.com/openvms_patches/layered_products/alpha/ALP_TCPIP_ECO-V0503-182.txt
ftp://ftp.itrc.hp.com/openvms_patches/layered_products/alpha/ALP_TCPIP_ECO-V0503-182.PCSI-DCX_AXPEXE

30MB of pure fun, I'm sure.

Naturally, the ".txt" file omits all the
useful info, so you need to extract the
release notes from the (big) kit to find out
it does anything specific for you.