Issue Regular FTP access failing since 18.0.79 Update #1

[Steve Jeffery]

Server operating system version

Debian 12

Plesk version and microupdate number

18.0.79 #1

We have an in house batch file that utilises regular FTP on port 21 to upload update files for our customers to an area on one of our servers. This uses an FTP user set up under the Subscription with access to just the updates area. This was working on Monday, but since yesterday when 18.0.79 was updated to 18.0.79 Update #1 it is timing out on connect. That's the only thing I'm aware of that has changed.

 

[Sebahat.hadzhi]

Hi, @Steve Jeffery . Could you please confirm what's being logged at /var/log/secure? Also, do I correctly understand the issue you are having is with one particular account only, not all FTP users?

 

[Bitpalast]

timing out on connect

I suggest to check whether the ProFTPD Fail2ban jail is blocking your internet access IP.

 

[Steve Jeffery]

I suggest to check whether the ProFTPD Fail2ban jail is blocking your internet access IP.

I did check this as an outside possibility, but our own fixed IPs are already whitelisted in Fail2Ban.

 

[Steve Jeffery]

Hi, @Steve Jeffery . Could you please confirm what's being logged at /var/log/secure? Also, do I correctly understand the issue you are having is with one particular account only, not all FTP users?

Being Debian we don't have /var/log/secure but we do have /var/log/auth.log

These are entries for a session on Monday 6th when the process worked
Jul 6 09:03:38 vps02 proftpd[2429803]: pam_unix(proftpd:session): session opened for user xxxxxxxxxx-parts(uid=10002) by (uid=0)
Jul 6 09:03:38 vps02 systemd-logind[536]: New session c8 of user xxxxxxxxxx.
Jul 6 09:03:38 vps02 (systemd)[2429805]: pam_unix(systemd-user:session): session opened for user xxxxxxxxxx(uid=10002) by (uid=0)
Jul 6 09:03:45 vps02 proftpd[2429840]: pam_unix(proftpd:session): session opened for user xxxxxxxxxx-parts(uid=10002) by (uid=0)
Jul 6 09:03:45 vps02 systemd-logind[536]: New session c9 of user xxxxxxxxxx.
Jul 6 09:03:45 vps02 proftpd[2429840]: pam_unix(proftpd:session): session closed for user xxxxxxxxxx-parts
Jul 6 09:03:45 vps02 proftpd[2429840]: pam_systemd(proftpd:session): Failed to connect to system bus: No such file or directory
Jul 6 09:03:45 vps02 systemd-logind[536]: Session c9 logged out. Waiting for processes to exit.
Jul 6 09:03:45 vps02 systemd-logind[536]: Removed session c9.
Jul 6 09:03:45 vps02 proftpd[2429844]: pam_unix(proftpd:session): session opened for user xxxxxxxxxx-parts(uid=10002) by (uid=0)
Jul 6 09:03:45 vps02 systemd-logind[536]: New session c10 of user xxxxxxxxxx.
Jul 6 09:03:45 vps02 proftpd[2429844]: pam_unix(proftpd:session): session closed for user xxxxxxxxxx-parts
Jul 6 09:03:45 vps02 proftpd[2429844]: pam_systemd(proftpd:session): Failed to connect to system bus: No such file or directory
Jul 6 09:03:45 vps02 systemd-logind[536]: Session c10 logged out. Waiting for processes to exit.
Jul 6 09:03:45 vps02 systemd-logind[536]: Removed session c10.
Jul 6 09:03:45 vps02 proftpd[2429846]: pam_unix(proftpd:session): session opened for user xxxxxxxxxx-parts(uid=10002) by (uid=0)
Jul 6 09:03:45 vps02 systemd-logind[536]: New session c11 of user xxxxxxxxxx.

and these on Wednesday 8th when the process failed. As I say the panel auto updated on the 7th.

Jul 8 09:50:10 vps02 proftpd[3185840]: pam_unix(proftpd:session): session opened for user xxxxxxxxxx-parts(uid=10002) by (uid=0)
Jul 8 09:50:10 vps02 systemd-logind[536]: New session c110 of user xxxxxxxxxx.
Jul 8 09:50:10 vps02 (systemd)[3185842]: pam_unix(systemd-user:session): session opened for user xxxxxxxxxx(uid=10002) by (uid=0)
Jul 8 09:50:39 vps02 proftpd[3185946]: pam_unix(proftpd:session): session opened for user xxxxxxxxxx-parts(uid=10002) by (uid=0)
Jul 8 09:50:39 vps02 systemd-logind[536]: New session c111 of user xxxxxxxxxx.
Jul 8 09:50:39 vps02 proftpd[3185946]: pam_unix(proftpd:session): session closed for user xxxxxxxxxx-parts
Jul 8 09:50:39 vps02 proftpd[3185946]: pam_systemd(proftpd:session): Failed to connect to system bus: No such file or directory
Jul 8 09:50:39 vps02 systemd-logind[536]: Session c111 logged out. Waiting for processes to exit.
Jul 8 09:50:39 vps02 systemd-logind[536]: Removed session c111.
Jul 8 09:50:39 vps02 proftpd[3185947]: pam_unix(proftpd:session): session opened for user xxxxxxxxxx-parts(uid=10002) by (uid=0)
Jul 8 09:50:39 vps02 systemd-logind[536]: New session c112 of user xxxxxxxxxx.
Jul 8 09:50:45 vps02 sys_auth[3185974]: pam_unix(common-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=root
Jul 8 09:50:47 vps02 sys_auth[3185982]: pam_unix(common-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= user=root

I don't know whether those last two authentication failure lines are relevant as they refer to user=root but they're in the approximate timeframe.

We only have the one Subscription specific additional ftp user on this server at present so I can't say whether it's specific to that user or not.

 

[Sebahat.hadzhi]

Could you please create a new test FTP user? Also, have you tried to temporarily pause Fail2Ban to rule it out completely? Lastly, are you using passive mode for the FTP connection? If yes, it's worth checking if there's an external firewall and if any recent changes were performed.

 

[Steve Jeffery]

Could you please create a new test FTP user? Also, have you tried to temporarily pause Fail2Ban to rule it out completely? Lastly, are you using passive mode for the FTP connection? If yes, it's worth checking if there's an external firewall and if any recent changes were performed.

As I managed to work around the problem by implementing SFTP I doubt it's anything to do with Fail2Ban but I'll try your suggestions and get back to you.