Subject: How to time out dead ftpd processes

From: Steve DiBartolomeo <[email-masked]>
Date: Thu, 10 Dec 1998 09:38:51 -0800

Having a problem with incoming ftp connections that
don't do anything and tie up my system.

I am running an anonymous ftp server on SunOS 4.1
(Sparc 2 with 64M ram). Because we have only a
128K ISDN connection I have limited the max number
of concurrent users to 4. Most of my clients download
data via a WEB browser - typical file size is 1-6 MB
and generally no connection lasts more than an hour.

Here is the approriate line in my ftpaccess file:

class   all   real,anonymous  *
limit   all   4   Any              /etc/msgs/msg.dead   

In the last weeks we're getting lots of emails telling
us that the ftp login is denied. It turns out that
someone seems to be logging in multiple times over
a few minutes until the max is reached. The connections
are never closed but no data is transferred.

Here is a typical process summary ......

$ ps -auxw | grep ftpd

ftp      27247  0.0  0.0  816    0 ?  IW   16:56   0:00 -xxx.75.223.1: anonymous/IE30User@: R (ftpd)
ftp      27250  0.0  0.0  816    0 ?  IW   16:57   0:00 -xxx.75.223.1: anonymous/IE30User@: R (ftpd)
ftp      27251  0.0  0.0  816    0 ?  IW   16:58   0:00 -xxx.75.223.1: anonymous/IE30User@: R (ftpd)
ftp      27249  0.0  0.0  816    0 ?  IW   16:57   0:00 -xxx.75.223.1: anonymous/IE30User@: R (ftpd)
ftp      27243  0.0  0.0  816    0 ?  IW   16:55   0:00 -xxx.75.223.1: anonymous/IE30User@: R (ftpd)

As you can see the same guy hit the ftp server 5 times within 3 minutes - the xferlog shows
that no files were transferred. (I've xxx'd out part of his IP address) I kill all the processes
and things are OK again for a while. Then the next day the problem gets repeated.

Short of removing the max limit and cleaning up the dead processes regularly is there a way to
deal with this?

If I add 

   deny xxx.75.223.1

to the ftpaccess file will this at least prevent this guy from locking up my system? The last
few incidences have always been the same IP address....

Is there a way to time out any connection that has not transferred data say in 5 minutes?

Steve DiBartolomeo                    T (831) 426-6163
Applications Manager                  F (831) 426-2824
Artwork Conversion Software, Inc.     [email-masked]
Santa Cruz, CA 95060                  http://www.artwork.com

---

From: "Scott D. MacKay" <[email-masked]>
Date: Thu, 10 Dec 1998 13:30:18 -0500

S
> Short of removing the max limit and cleaning up the dead processes regularly is there a way to

Actually, a nice feature would be to limit # connections from 1 IP.....

-------------------------
| Scott MacKay : Postmaster
|   [email-masked] | [email-masked] | ICQ 12191982 | (716) 383-1290
| Real Time Enterprises, Pittsford NY
| -Electronic Document Imaging-System Integration-Software Development-
| 'The opinions shared here only reflect the poster's  
|  views and may not reflect the views of the company.'

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 10 Dec 1998 14:23:59 -0500 (EST)

> Actually, a nice feature would be to limit # connections from 1

That's been on Stan's TODO for a couple years now.  Actually, it's about 3
items down on my TODO for the VR-series, so I'll probably be getting to in
in a month or so (no promises, though .. watch for the announcement).

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 10 Dec 1998 13:26:25 -0500 (EST)

On Thu, 10 Dec 1998, Steve DiBartolomeo wrote:

> Having a problem with incoming ftp connections that don't do anything
> and tie up my system.
> 
> I am running an anonymous ftp server on SunOS 4.1 (Sparc 2 with 64M
> ram). Because we have only a 128K ISDN connection I have limited the
> max number of concurrent users to 4. Most of my clients download data
> via a WEB browser - typical file size is 1-6 MB and generally no
> connection lasts more than an hour.
> 
> In the last weeks we're getting lots of emails telling us that the ftp
> login is denied. It turns out that someone seems to be logging in
> multiple times over a few minutes until the max is reached. The
> connections are never closed but no data is transferred.
> 
> As you can see the same guy hit the ftp server 5 times within 3
> minutes - the xferlog shows that no files were transferred. (I've
> xxx'd out part of his IP address) I kill all the processes and things
> are OK again for a while. Then the next day the problem gets repeated.
> 
> Short of removing the max limit and cleaning up the dead processes
> regularly is there a way to deal with this?
> 

Set the idle time limit down.  Sayeth 'man ftpd':

       The  ftp server will timeout an inactive session after 15 minutes.
       If the -t option is specified, the inactivity timeout period will
       be set to timeout seconds.  A client may also request a different
       timeout period;  the maximum period allowed may be set to timeout
       seconds with the -T option.  The default limit is 2 hours.

--

---

From: Brett Goldstock <[email-masked]>
Date: Thu, 10 Dec 1998 14:45:18 -0500

According to the FAQ, symbolic links can be used in a chrooted environment
with loopback mounts. I'm running under Solaris where this allegedly works,
but I'm not familiar with this. Can someone provide detail on how this
works?

-Brett

|Brett M. Goldstock                               [email-masked]|
|Senior Technical Analyst/Sys Admin          http://www.tvdata.com|
|TVData                                               800/833-9581|
|                "We tell the world what's on TV."                |

---

From: Jon Lewis <[email-masked]>
Date: Thu, 10 Dec 1998 14:47:18 -0500 (EST)

On Thu, 10 Dec 1998, Scott D. MacKay wrote:

> regularly is there a way to > deal with this? 

What version was being used above?  This was supposedly fixed a while
back.

----don't waste your cpu, crack rc5...www.distributed.net team enzo---
 Jon Lewis <[email-masked]>  |  Spammers will be winnuked or 
 Network Administrator       |  nestea'd...whatever it takes
 Florida Digital Turnpike    |  to get the job done.
______http://inorganic5.fdt.net/~jlewis/pgp for PGP public key________

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 10 Dec 1998 15:37:13 -0500 (EST)

On Thu, 10 Dec 1998, Brett Goldstock wrote:

> According to the FAQ, symbolic links can be used in a chrooted
> environment with loopback mounts. I'm running under Solaris where this
> allegedly works, but I'm not familiar with this. Can someone provide
> detail on how this works?

Best rule-of-thumb:  symbolic links do NOT work.

Actual fact: they work fine if, and only if, the destination of the link
is relative and visible.  Consider, we chroot to /ftp/root ...

  /home/badtarget
  /ftp/root/badlink -> /home/badtarget

This link fails, the target is outside the chroot and not visible.

  /ftp/root/dira/badtarget
  /ftp/root/dirb/badlink -> /ftp/root/dira/badtarget

This link fails, the target is inside the chrrot, but not relative.  The
/ftp/root part is outside the chroot and not visible.  some Unix systems
may allow this.  Don't count on it; don't use it (if for no other reason
than it lets your chroot'd ftp user know there's more to the file system
and they can see a bit of how it's laid out).

  /ftp/root/dira/goodtarget
  /ftp/root/dirb/goodlink -> ../dira/goodtarget

This link succeeds.  It's relative and stays inside the visible area of
the chroot.

Notice all these links will work fine to a normal (non-chroot'd) shell
user.

--

---

From: Bob Luckin <[email-masked]>
Date: Thu, 10 Dec 98 15:14:34 CST

> Actually, a nice feature would be to limit # connections from 1 IP.....

Can't you do this already by defining a class containing the IP address you
want to limit, and limiting that class to 1 connection ?  Or am I
misunderstanding something here (I deleted the original message, so there
may be some other aspect I've missed out on) ?

Check the ftpaccess.5 man page and examples, but I think something like :-
   class nasty anonymous xxx.75.223.1
   limit nasty 1 Any /etc/msgs/msg.whatever
would allow you to limit logins from that IP address to 1.

Admittedly, this doesn't solve the problem of a hanging session - if it
really is hung instead of being kept open via the client polling NOOPs
every now and then.  But it should limit the number of sessions this
this IP address can hang this way.

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "A man, a plan, a canal, Suez !"
                                 [http://www.dhc.net/~luckin/palindromes.html]

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 10 Dec 1998 16:24:57 -0500 (EST)

On Thu, 10 Dec 1998, Bob Luckin wrote:

> Can't you do this already by defining a class containing the IP
> address you want to limit, and limiting that class to 1 connection ?  
> Or am I misunderstanding something here (I deleted the original
> message, so there may be some other aspect I've missed out on) ?

In a specific case, as he was reporting, you're right this will work.  The
question is the ability to state, as a general rule, only N connections
per IP number.

--