Proftpd problem

[Jean-PhilippeT]

It seems that I cannot post chkconfig --list on the board so it's in an attached text file

 

[Jean-PhilippeT]

Did U install Kerberos 5, tune it?

no


thx again

 

[fogelf]

Here all fine. Need to go on.
grep ftp /var/log/secure

 

[Jean-PhilippeT]

Attached in text file again

grep ftp /var/log/secure

 

[fogelf]

try to change password for user 'noise' temporary
passwd noice <<< type any dummy here, for example 'qweqwe' and try to login again

 

[Jean-PhilippeT]

same error message

530 login incorrect

 

[fogelf]

backup /etc/pam.d and try to use attached one

 

[Jean-PhilippeT]

still not working with that pam.d.

the smtp service has no problem with it.

 

[fogelf]

Output of su -l $FTP_USER -s '/bin/sh' -c 'cat /etc/{passwd,group}' provide actual data?
In additional provide permission for /etc/{passwd,group}, also try to login with selinux turned off.

 

[Jean-PhilippeT]

ls -l /etc/{passwd,group}
-rw-r--r-- 1 root root 1102 Nov 23 12:13 /etc/group
-rw-r--r-- 1 root root 3651 Jan 20 13:51 /etc/passwd


other results are in the attached text file, all my ftp users are there.

 

[fogelf]

on server exec strace -f -s 1024 -o /tmp/STRACE /etc/init.d/xinetd restart
try to login under FTP user and attach /tmp/STRACE (do not forget to hide password in STRACE)

 

[Jean-PhilippeT]

This one went wrong

I did the strace, logged with a ftp account used on the box, sended a stop signal(ctrl-c) to strace that the process ignored.

At the meantime smtp auth started to failed.

retsarted xinetd, smtp auth came back ok and strace stopped.

Now in /tmp/STRACE, when I grep for the user name used on the ftp login I have nothing so it's like I never tried login via ftp.

All the rest is tracked down by strace except that ftp login, I see all smtp auth trial failing one after another etc.

tried twice and I always get the same results.

 

[fogelf]

>it's like I never tried login via ftp.
possible need to wait until xinet.d service perform restart

>sended a stop signal(ctrl-c) to strace that the process ignored.
in another console call /etc/init.d/xinetd restart, should be enought

 

[Jean-PhilippeT]

I waited for the message xinet.d stop/start to finish before proceeding.

I will have another look at all this today.

another console call /etc/init.d/xinetd restart, should be enought

yeah that worked okay, just founded it weird a bit.

Is it normal that using strace on xinet.d prevent my smtp auth to work properly ?

 

[Sito]

I'm on version 9.5.4 on Fedora 8 and have the same problem after a yum update.

I tried all solutions and problem still (530 Login Incorrect for all users). Any solutions?

 

[Jean-PhilippeT]

still trying to figure why ftp login doesn't show up in xinet.d strace

...

 

[Sito]

I solve the problem! I found the solution here http://forum.parallels.com/showthread.php?t=87980.

The yum update change the '/etc/pam.d/proftpd'.

#%PAM-1.0
auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
auth required pam_stack.so service=system-auth
auth required pam_shells.so
account required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth

I changed /etc/pam.d/proftpd to match a fedora server without the update ( 1.3.1 )

#%PAM-1.0
auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
auth include system-auth
auth required pam_shells.so
account include system-auth
session include system-auth
session required pam_loginuid.so

 

[buller3]

Thank you very much Sito, this fix works fine for me.

The yum update change the '/etc/pam.d/proftpd'.

#%PAM-1.0
auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
auth required pam_stack.so service=system-auth
auth required pam_shells.so
account required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth

I changed /etc/pam.d/proftpd to match a fedora server without the update ( 1.3.1 )

#%PAM-1.0
auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
auth include system-auth
auth required pam_shells.so
account include system-auth
session include system-auth
session required pam_loginuid.so