OpenVMS no inbound ftp

[Roger Marcinik]

FTP client & server are enabled & started,
but:
TCPIP> sho serv ftp

Service Port Proto Process Address State

FTP 21 TCP TCPIP$FTP 0.0.0.0 Disabled
TCPIP>

Even so, we can use outbound FTP to transfer files to other machines on the network, but
all attempts to connect to this host for FTP are rejected.
What are we overlooking?

[Robert Gezelter]

Roger,

First of all, inbound and outbound are completely separate, except for the fact that both use the underlying IP stack.

Are there any error messages when the FTP server is started? Are the correct processes up and running? Are the accounts used by the underlying FTP server in proper order?

It is rather difficult to diagnose "over the phone" with information that is so limited.

- Bob Gezelter, http://www.rlgsc.com

[Roger Marcinik]

We have lost a lot of sys admin experience recently.

1) No error messages except when external machine tries to connect: connection rejected.

2) Which specific "correct processes" should we look for to be "up and running"?

3) Which accounts are "used by the underlying FTP server"?

[Robert Gezelter]

Roger,

For a start, which IP stack (and which version) are you running?

- Bob Gezelter, http://www.rlgsc.com

[Homer Shoemaker]

I don't know what system you're using, but it looks like the FTP service is Disabled.

If that's so, maybe this will help.

From the $ prompt:

@SYS$MANAGER:TCPIP$CONFIG

Select Server Components

Select the option to enable FTP

[Roger Marcinik]

Welcome to OpenVMS (TM) Alpha Operating System, Version V7.3-2

See attch.

[John Gillings]

Roger,

Some dumb questions...

1) are you sure the requesting node has the correct address mapping? Try telnet and make sure you're reaching the right node.

2) See if you can FTP to yourself

3) Check your limits with $ TCPIP SHOW SERVICE FTP/FULL

4) Check for log files (see "File:" in the SHOW SERVICE output from 3)

5) Enable full login and logfailure auditing and see if you get any clues from there:

$ REPLY/ENABLE=SECURITY
$ SET AUDIT/ALARM/ENABLE=(LOGIN=ALL, LOGFAIL=ALL)

[Hoff]

Apply the current ECO kits for the particular version of TCP/IP Services in use here, then restart the TCP/IP stack, as a start.

If the IP server does not resolve itself and there are any firewalls, disable them for testing. FTP is insecure; it requires the firewall to open up all traffic on the ephemeral ports on one or both ends of the connection (or deep packet inspection, which is an option on some high-end firewalls), and it ships the username and password in cleartext over the connection.

To save anyone else the hassles of accessing the propriety-format Microsoft Office Word file that was attached, it's a Word document containing an image capture representation of the TCP/IP Services FTP configuration -- with the FTP server is being enabled. (Those of us using OpenVMS or other non-Microsoft platforms and tools may or may not have the ability to read Word documents. Posting text, JPG or such is usually a better choice for attachments.)

[Robert Gezelter]

Roger,

Ok. If you are running OpenVMS 7.3-2, there is a good chance that you are running TCPIP Services Version 5.4 (this can be verified by doing a TCPIP SHOW VERSION).

First question, is there a process with a name along the lines of TCPIP$FTP_1 running? If so, can you access it from the local machine? (Use the FTP client to access IP address 127.0.0.1)

Please check your console log. I have just confirmed that there is a confirmatory message of FTP startup in the console log.

- Bob Gezelter, http://www.rlgsc.com

[Steven Schweda]

> See attch.

Attach plain text, not a Microsoft Word
document, and I'd consider it.

> FTP client & server are enabled & started,
> [...]

Apparently not:

> FTP 21 TCP TCPIP$FTP 0.0.0.0 Disabled

Have you tried enabling it? You might
consider SYS$MANAGER:TCPIP$CONFIG.COM as a
convenient way to do that.

Other than TCPIP SHOW VERSION, any other
actual commands you've tried, with their
actual output, could be interesting.

> 1) No error messages except when external
> machine tries to connect: connection
> rejected.

Well, yeah. The FTP service is disabled, so
the FTP server is not running.

[Don Nutt]

Have you simply tried:

TCPIP> enable service FTP

TCPIP> show service FTP


Don

[Ian Miller.]

Have you tried enabling the ftp server in TCPIP$CONFIG ?

What is in
SYS$SYSDEVICE:[TCPIP$FTP]TCPIP$FTP_RUN.LOG ?

[Roger Marcinik]

A> TCPIP SHOW VERSION

HP TCP/IP Services for OpenVMS Alpha Version V5.4 - ECO 5
on a AlphaServer 4100 5/400 4MB running OpenVMS V7.3-2

[Roger Marcinik]

Some questions...

1) are you sure the requesting node has the correct address mapping? Try telnet and make sure you're reaching the right node.


Just did a "Ping" to the address of the node: All was normal. Stats: sent = 4, received = 4, lost = 0.

[Roger Marcinik]

First question, is there a process with a name along the lines of TCPIP$FTP_1 running? If so, can you access it from the local machine? (Use the FTP client to access IP address 127.0.0.1)

That process is NOT running. Here is what is running starting with TCPIP*


A> SHOW SYS/PROC=TCPIP*
OpenVMS V7.3-2 on node A 2-JUL-2008 08:34:00.83 Uptime 158 21:22:12
Pid Process Name State Pri I/O CPU Page flts Pages
00000216 TCPIP$INETACP HIB 10 9672 0 00:00:03.68 618 161
00000218 TCPIP$NTP_1 LEF 9 13836808 0 00:01:06.30 21264 150 N
0000021A TCPIP$SNMP_1 LEF 9 1391743 0 00:00:09.07 10149 91 N
0000021B TCPIP$HR_MIB LEF 9 470494 0 01:37:58.35 7181 92
0000021C TCPIP$OS_MIBS LEF 9 20605546 0 00:30:37.60 13286 132
00019D35 TCPIP$TNS2 HIB 6 51206 0 00:00:21.42 436 116
0000034D TCPIP$TNS1 HIB 6 10709 0 00:00:02.67 6940 21
A>

[Roger Marcinik]

Here's the ASCII version of the previous .doc attachment:

HP TCP/IP Services for OpenVMS Server Components Configuration Menu

Configuration options:

1 - BIND Disabled Stopped 12 - NTP Enabled Started
2 - BOOTP Disabled Stopped 13 - PC-NFS Disabled Stopped
3 - DHCP Disabled Stopped 14 - POP Disabled Stopped
4 - FINGER Disabled Stopped 15 - PORTMAPPER Disabled Stopped
5 - FTP Enabled Started 16 - RLOGIN Enabled Started
6 - IMAP Disabled Stopped 17 - RMT Disabled Stopped
7 - LBROKER Disabled Stopped 18 - SNMP Enabled Started
8 - LPR/LPD Disabled Stopped 19 - SSH Disabled Stopped
9 - METRIC Disabled Stopped 20 - TELNET Enabled Started
10 - NFS Disabled Stopped 21 - TFTP Disabled Started
11 - LOCKD/STATD Disabled Stopped 22 - XDM Disabled Stopped


A - Configure options 1 - 22
[E] - Exit menu

Enter configuration option:

[Roger Marcinik]

A> TCPIP SHO SERVICE FTP/FULL

Service: FTP
State: Disabled
Port: 21 Protocol: TCP Address: 0.0.0.0
User_name: not defined Process: TCPIP$FTP
A>

In addition, TCPIP$TFTP_RUN.COM hangs if try to execute.

[Steven Schweda · Accepted solution]

> [...] TCPIP$TFTP_RUN.COM hangs [...]

FTP and TFTP are different things.

Have you tried to enable/start the FTP
service yet (as repeatedly suggested)?

[Wim Van den Wyngaert]

I would say it aborted.

reply/ena
ucx ena servi ftp

and check the messages and log files.

Wim

[Robert Gezelter]

Roger,

As a start, please run the TCP/IP configuration procedure (SYS$MANAGER:TCPIP$CONFIG.COM) from a suitably privileged account. Then remove the FTP server and re-configure the FTP service (In TCPIP Services 5.4, the relevant options are labeled as "disable and stop" and "enable and start" respectively.

The TCPIP$FTP_1 process should then be started.

- Bob Gezelter, http://www.rlgsc.com

[Roger Marcinik]

Problem appears to have been solved.
All I did was execute
@sys$common:[sysexe]TCPIP$FTP_RUN.COM

and I was able to FTP into the node.

Thanks for all the help.

[Steven Schweda]

> All I did was [...]

Sounds very like what enabling and starting
the FTP service would have done. At least
until the next re-boot, when there's no
telling whether it'll be restarted. There
are some potential advantages in internal
consistency when you go through the proper
procedures to deal with problems like this.

Didi you ever disclose whether FTP had ever
been working on this system before?

[Wim Van den Wyngaert]

Your ucx sho servi shows

User_name: not defined

It should be TCPIP$FTP. Was "file" containing tcpip$system:tcpip$ftp_run.com ?

And did you check the log file mentioned in the service setup ?

Wim

[Peter Zeiszler]

"Service: FTP
State: Disabled
Port: 21 Protocol: TCP Address: 0.0.0.0
User_name: not defined Process: TCPIP$FTP"

From that it shows state of disabled.
Username "not defined"

Try this:
mc authorize show *ftp*/br
You should have an TCPIP$FTP account. If you don't then run through the setup for FTP server via @sys$manager:tcpip$config. The setup should create the account.

Server components and find ftp.
I think that after the server is enabled the command procedure asks if you want to configure the client.

[Roger Marcinik]

Thanks to all for your suggestions.
You probably guessed that I am not a sys admin or op. I'm just a user who tried to help a friend. And we did help him.
I could run some commands because I do not have AUDIT.