Subject: misunderstood log entry

From: [email-masked] (Yale Rosenblatt)
Date: Thu, 31 Jul 1997 08:35:35 -0700

I am running Version wu-2.4.2-academ[BETA-13] and it seems to be running 
pretty well.

I have only one problem. We have a web site that that has a download button
that links into my server anonymously. Some users say that they are given 
permission denied to download the software.

Now ftp or fetch to the server works fine, so I am not sure why 
some people are having this problem. My log file does show one error
often. It could be a generic message or my problem. 
 
Can someone tell me what the below "deny" message means? And as a 
side issue, what is PASV and the associated numbers?

Yale Rosenblatt
Networking Manager
PE Applied Biosystems - Genetic Analysis Division

Jul 30 15:51:00 proteus ftpd[903]: ANONYMOUS FTP LOGIN FROM [user info] 
Jul 30 15:51:00 proteus ftpd[903]: command: SYST
Jul 30 15:51:00 proteus ftpd[903]: SYST
Jul 30 15:51:00 proteus ftpd[903]: <--- 215
Jul 30 15:51:00 proteus ftpd[903]: UNIX Type: L8
Jul 30 15:51:00 proteus ftpd[903]: command: PASV
Jul 30 15:51:00 proteus ftpd[903]: PASV
Jul 30 15:51:00 proteus ftpd[903]: <--- 425
Jul 30 15:51:00 proteus ftpd[903]: Can't open passive connection: Permission denied.
Jul 30 15:51:00 proteus ftpd[903]: <--- 221
Jul 30 15:51:00 proteus ftpd[903]: You could at least say goodbye.
Jul 30 15:51:00 proteus ftpd[903]: FTP session closed
Jul 30 15:51:07 proteus ftpd[904]: <--- 220
Jul 30 15:51:07 proteus ftpd[904]: proteus FTP server (Version wu-2.4.2-academ[BETA-13](3) Wed May 7 00:13:17 PDT 1997) ready.
Jul 30 15:51:08 proteus ftpd[904]: command: USER anonymous
Jul 30 15:51:08 proteus ftpd[904]: <--- 331
Jul 30 15:51:08 proteus ftpd[904]: Guest login ok, send your complete e-mail address as password.
Jul 30 15:51:08 proteus ftpd[904]: USER anonymous
Jul 30 15:51:08 proteus ftpd[904]: command: PASS password
Jul 30 15:51:08 proteus ftpd[904]: PASS bobby@
Jul 30 15:51:08 proteus ftpd[904]: <--- 230
Jul 30 15:51:08 proteus ftpd[904]: Guest login ok, access restrictions apply.
Jul 30 15:51:08 proteus ftpd[904]: ANONYMOUS FTP LOGIN FROM [user info] 
Jul 30 15:51:08 proteus ftpd[904]: command: SYST
Jul 30 15:51:08 proteus ftpd[904]: SYST
Jul 30 15:51:08 proteus ftpd[904]: <--- 215
Jul 30 15:51:08 proteus ftpd[904]: UNIX Type: L8
Jul 30 15:51:08 proteus ftpd[904]: command: PASV
Jul 30 15:51:08 proteus ftpd[904]: PASV
Jul 30 15:51:08 proteus ftpd[904]: <--- 425
Jul 30 15:51:08 proteus ftpd[904]: Can't open passive connection: Permission denied.
Jul 30 15:51:08 proteus ftpd[904]: <--- 221
Jul 30 15:51:08 proteus ftpd[904]: You could at least say goodbye.
Jul 30 15:51:08 proteus ftpd[904]: FTP session closed

---

From: Bob Luckin <[email-masked]>
Date: Thu, 31 Jul 97 21:54:35 CDT

Hello Yale,

I haven't seen any replies to your query on the mailing list yet, so I'll
try :-

You don't say what Operating System you are running on, but it might be
Solaris 2.  Solaris 2 requires the permissions on ~ftp/dev/tcp to be set
to world writable in order for ftpd to be able to make passive connections.

Some FTP clients (usually Web browsers) try to establish a passive connection
with the server - that's what the PASV command in your log is.  So if you
are running Solaris 2, try setting the permissions on ~ftp/dev/tcp to 666.

If you're running another OS, then I can't help...

This problem (and others) is documented in the FAQ which you can find on
the Web in Kent Landfield's excellent WU-FTPD Resource Centre at
   http://www.landfield.com/wu-ftpd/
(The FAQ itself is at http://www.hvu.nl/~koos/wu-ftpd-faq.html; look at
question 9.10)

The PASV command is basically a request to the server to move communication
to a non-default port on the server machine.  You can find more detail in
the RFC at
   http://www.landfield.com/rfcs/rfc959.html

The numbers in your log are the 3-digit codes the server uses at the
start of every response to the client to categorise the response type...
So for example, 425 implies (roughly) :
   4 - negative completion, but you may retry as it _might_ be transient
   2 - a control or data connection was involved
   5 - more specific detail on the area indicated by the second digit of
       the triad; in this case meaning it can't open the data connection.
These are also documented in the RFC.

I hope this helps !

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "Rats live on no evil planet"

> Jul 30 15:51:07 proteus ftpd[904]: <--- 220
[Snip...]