Subject: Any ideas to fix "FTP LOGIN REFUSED (ftp not in /etc/passwd) FROM <node>"?

From: "Wynn Fenwick" <[email-masked]>
Date: Thu, 14 Jan 1999 02:30:24 -0500

All,

I'm running HP 10.20, and wu-ftpd 2.4.2 academ BETA-18.

I have configured what I think is the correct config for wu-ftp. I have
an existing server on HP-UX
9.05 that works fine and I have patterned the new configs after this
working box.

First, a little background, because things aren't exactly vanilla.

I have compiled two versions of wu-ftpd, One which looks for an
ftpaccess file
/opt/ftp/lib/ftpaccess-nortel and the other
/opt/ftp/lib/ftpaccess-internet. I use tcp_wrappers to twist
the incoming ftp connection to one binary or the other depending on what
domain tcpd decides the
connection comes from.

This allows us to operate a diode-style server. Nortel people can leave
stuff for the Internet and the
Internet can leave stuff only Nortel people can get at.

Symptoms
--------
1. When I attempt to login anonymously, I get what's in the subject
line.
2. Logging in as a real user gives an instant failure:

53-node2-$ ftp node.nortel.ca
Connected to node.nortel.ca.
220 node FTP server (Version wu-2.4.2-academ[BETA-18](2) Tue Jan 12
12:07:04 EST 1999) ready.
Name (node.nortel.ca:wynn): wynn
331 Password required for wynn.
Password: *******
530 Login incorrect.
Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

The password is correct for sure. Syslog on node.nortel.ca says:

Jan 14 02:09:15 node ftpd-nortel[19073]: connect from node2.nortel.ca
Jan 14 02:09:47 node ftpd[19073]: failed login from node2.nortel.ca
[a.b.c.d], wynn

Some other info that will elminate suggestions I've checked already...

-#> grep ftp /etc/passwd
ftp:*:500:10:Anonymous FTP account:/disc0/users/ftp:/bin/false

-#> more /disc0/users/ftp/etc/passwd
root:*:0:3::/:/bin/false
ftp:*:500:10:Anonymous FTP account:/disc0/users/ftp:/bin/false
ftp2:*:501:10:Anonymous FTP account for file xfer
protection:/disc0/users/ftp:/bin/false

-#>ls -l /opt/ftpd/lib
total 46
lrwxr-x---   1 root       users           30 Jan 14 01:52 ftpaccess ->
/opt/ftpd/lib/ftpaccess-internet
-rw-r-----   1 root       root         19030 Dec 10 09:52
ftpaccess-internet
-rw-r-----   1 root       root          2676 Dec  9 17:39
ftpaccess-nortel

-#> grep ftp /etc/inetd.conf
# wu-ftp settings
ftp          stream tcp nowait root /etc/tcp_wrappers/tcpd
/opt/ftpd/bin/ftpd-nortel  -laio -t 300

-#> grep ftp /etc/hosts.allow
nortel-ftpd: ALL EXCEPT .nortel.ca .nortel.co.uk .nortel.com
.nortel-nsm.com .nortelnetworks.com :
rfc931: umask 000: severity=auth.info: twist
/opt/ftpd/bin/ftpd-internet  -laio -t 300

...Can someone give me ideas to try because I am out of them...

--
Wynn Fenwick | Security Analyst | Nortel Networks | ESN 395-1198 | MS 009 FITZ
"Watchin X-Files with no lights on, We're dans la maison... I hope the
Smoking Man's in this one" - BNL, One Week