Subject: anon ftp outside of domain under SOLARIS -- somewhat long

From: [email-masked] (Richard A Haas)
Date: Wed, 05 Apr 1995 09:28:56 -0400

Folks,

I've spent a few days looking at this with little success, so I'd like to
ask for your assistance.

The situation:

 - SUN workstation running SOLARIS 2.3 (with maintenence release patches)

 - Trying to use: Version wu-2.4(2) 

 - ftp onsite (inside local domain) for real and anonymous ftp sessions work
   just fine.

 - ftp attempts from outside the lerc.nasa.gov domain all fail with:

(nimitz is a machine outside the local domain)

[nimitz]{1}% ftp ftp.lerc.nasa.gov
Connected to ftp.lerc.nasa.gov.
421 Service not available, remote server has closed connection

 - ftpd is run out of inetd with:

# wu-archive ftp daemon 2.4
ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  /export/asao/ftp/bin/ftpd -d

 - Though ftpd is run with "-d" there are no errors being logged in either
   /usr/adm/messages or the xferlog when connections are dropped.

 - The hosts.allow entry for ftp for the tcpd wrapper reads:

in.ftpd:LOCAL,ALL

   and there are no tcpd warnings (automatic mailings) when ftps fail from
   outside the domain (as there should be if tcpd is dropping the connection).

 - (Don't know if this is related) ckconfig cannot find the files in the
   ftpd hierarchy, even though they ARE there (with mode 555 dir permissions
   all the way through).

[/export/asao/ftp/bin] 62#./ckconfig
Checking _PATH_FTPUSERS :: ~ftp/etc/ftpusers
I can't find it... look in doc/examples for an example.
 
Checking _PATH_FTPACCESS :: ~ftp/etc/ftpaccess
I can't find it... look in doc/examples for an example.
 
Checking _PATH_PIDNAMES :: ~ftp/daemon/ftpd/ftp.pids-%s
I can't find it...
You need to make this directory [~ftp/daemon/ftpd] in order for
the limit and user count functions to work.
 
Checking _PATH_CVT :: ~ftp/etc/ftpconversions
I can't find it... look in doc/examples for an example.
 
... ad nauseum.

But if you look manually, they're there:

[/export/asao/ftp/bin] 63#ls -l ~ftp/etc/ftpusers
-r--r--r--   1 ftp      other         83 Apr  3 11:45 /export/asao/ftp/etc/ftpusers
[/export/asao/ftp/bin] 64#ls -l  ~ftp/etc/ftpaccess
-r--r--r--   1 ftp      other        415 Apr  4 17:41 /export/asao/ftp/etc/ftpaccess

[/export/asao/ftp/bin] 66#ls -l ~ftp/daemon/ftpd
total 10
drwxr-xr-x   2 root     other        512 Jan  5 12:16 ftp.pids-%s/
-rw-r--r--   1 root     root        4096 Apr  4 17:43 ftp.pids-all

 - The default SOLARIS ftpd works fine both onsite and offsite, but we need 
   to use the wu-archive ftpd because of it's enhanced logging capabilities.

Questions:
---------

1.  Any idea why ftpd drops connections from outside the local domain?

2.  Any idea why ckconfig can't find the ~ftp files?

3.  Where might I find more information on the "421 Service not available ..." 
    error?

4.  Is there a timeout for service response that might be causing ftpd to
    drop the offsite connection requests?

5.  Anything else I should look at?  Is there some way to increase the logging
    to see why these connections are dropped?

6.  Any SOLARIS-specific issues I should be aware of?

Any assistance would be greatly appreciated, especially by those offsite
users who want to get to our files.  :-)

Thanks.

Richard
--
-----------------------------------------------------------------------------
Richard A. Haas			|     Distributed System Admin / Unix Team 
NASA Lewis Research Center     	|     Advanced Space Analysis Office 
Cleveland, Ohio           	|     email: [email-masked] 
-----------------------------------------------------------------------------

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Wed, 5 Apr 95 15:43:55 MET DST

>  - The hosts.allow entry for ftp for the tcpd wrapper reads:

Since the daemon name is /export/asao/ftp/bin/ftpd, the rules should be for
/export/asao/ftp/bin/ftpd

> -r--r--r--   1 ftp      other         83 Apr  3 11:45 /export/asao/ftp/etc/ftpusers

The ~ftp for the homedir of ftp is a feature of bash and other shells. It's
NOT a kernel feature so you need to give the full pathnames.

                                            Grtx. KH

-- 
| Koos van den Hout,     Unixer, Internetter                    and BBS SysOp |
| Home:[email-masked]      BBS Koos z'n Doos (+31-3402-36647 28k8 vfc) |
| Work:[email-masked] * finger [email-masked] for PGPkey * (+31-3402-56619 14k4) |
| URL: http://www.hvu.nl/users/koos  I'm looking for a lic.plate with RFC 822 |
|   GCS d- p(-) c++(+++) l+ u+++ e++ m+(-) s+/- !n h f+ g+ w(++) t+ r !y(*)   |