Subject: Any ideas to fix "FTP LOGIN REFUSED (ftp not in /etc/passwd) FROM <node>"

From: "Wynn Fenwick" <[email-masked]>
Date: Thu, 14 Jan 1999 02:27:18 -0500

All,

I'm running HP 10.20, and wu-ftpd 2.4.2 academ BETA-18.

I have configured what I think is the correct config for wu-ftp. I have
an existing server on HP-UX 9.05 that works fine and I have patterned
the new configs after this working box.

First, a little background, because things aren't exactly vanilla.

I have compiled two versions of wu-ftpd, One which looks for an
ftpaccess file /opt/ftp/lib/ftpaccess-nortel and the other
/opt/ftp/lib/ftpaccess-internet. I use tcp_wrappers to twist the
incoming ftp connection to one binary or the other depending on what
domain tcpd decides the connection comes from.

This allows us to operate a diode-style server. Nortel people can leave
stuff for the Internet and the Internet can leave stuff only Nortel
people can get at.

Symptoms
--------
1. When I attempt to login anonymously, I get what's in the subject
line.
2. Logging in as a real user gives an instant failure:

53-node2-$ ftp node.nortel.ca
Connected to node.nortel.ca.
220 node FTP server (Version wu-2.4.2-academ[BETA-18](2) Tue Jan 12
12:07:04 EST 1999) ready.
Name (node.nortel.ca:wynn): wynn
331 Password required for wynn.
Password: *******
530 Login incorrect.
Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

The password is correct for sure. Syslog on node.nortel.ca says:

Jan 14 02:09:15 node ftpd-nortel[19073]: connect from node2.nortel.ca
Jan 14 02:09:47 node ftpd[19073]: failed login from node2.nortel.ca
[a.b.c.d], wynn

Some other info that will elminate suggestions I've checked already...

-#> grep ftp /etc/passwd
ftp:*:500:10:Anonymous FTP account:/disc0/users/ftp:/bin/false

-#> more /disc0/users/ftp/etc/passwd
root:*:0:3::/:/bin/false
ftp:*:500:10:Anonymous FTP account:/disc0/users/ftp:/bin/false
ftp2:*:501:10:Anonymous FTP account for file xfer
protection:/disc0/users/ftp:/bin/false

-#>ls -l /opt/ftpd/lib
total 46
lrwxr-x---   1 root       users           30 Jan 14 01:52 ftpaccess ->
/opt/ftpd/lib/ftpaccess-internet
-rw-r-----   1 root       root         19030 Dec 10 09:52
ftpaccess-internet
-rw-r-----   1 root       root          2676 Dec  9 17:39
ftpaccess-nortel

-#> grep ftp /etc/inetd.conf
# wu-ftp settings
ftp          stream tcp nowait root /etc/tcp_wrappers/tcpd
/opt/ftpd/bin/ftpd-nortel  -laio -t 300

-#> grep ftp /etc/hosts.allow
nortel-ftpd: ALL EXCEPT .nortel.ca .nortel.co.uk .nortel.com
.nortel-nsm.com .nortelnetworks.com : rfc931: umask 000:
severity=auth.info: twist /opt/ftpd/bin/ftpd-internet  -laio -t 300

...Can someone give me ideas to try because I am out of them...

--
Wynn Fenwick | Security Analyst | Nortel Networks

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 14 Jan 1999 03:31:54 -0500 (EST)

On Thu, 14 Jan 1999, Wynn Fenwick wrote:

> I have configured what I think is the correct config for wu-ftp. I
> have an existing server on HP-UX 9.05 that works fine and I have
> patterned the new configs after this working box.

First guess, you've missed something to tell the ftp daemon how to
authenticate users.  Look at the <src|support>/config/config.hpx and
<src|support>/makefiles/Makefile.hpx files to see if there's anything you
need to change for your system (usually something about C2 security or
shadow passwords).  On some systems you have to do some mystic incantation
to tell the system to let the daemon do its thing but I don't think HP-UX
10 is one of them.

The specific message in your subject line means exactly what it says so
either the daemon doesn't know how to properly read your /etc/passwd file
or the user really doesn't exist.

Your problem with a real user's password points to a missing mod for
security on your system or a problem reading the /etc/passwd file.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Wynn Fenwick" <[email-masked]>
Date: Fri, 15 Jan 1999 13:42:01 -0500

> to tell the system to let the daemon do its thing but I don't think HP-UX

The shadow passwords option is off, but I have been unable to find any
reference in the source code or makefiles doing anything based on the

#define HP_UX_10_TRUSTED

configuration in config.hpx.

What header looks at this, and is this bulding  wu-ftpd to look for something
other than a standard /etc/passwd file?

> The specific message in your subject line means exactly what it says so
either the daemon doesn't
> know how to properly read your /etc/passwd file or the user really doesn't
exist.
>security on your system or a problem reading the /etc/passwd file.

I suspect both problems have the same root cause.

--
Wynn Fenwick, Security Analyst        |
Security Technology, Nortel Networks  |

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 15 Jan 1999 16:36:54 -0500 (EST)

> configuration in config.hpx.

HP_UX is a typo in your email, search for HPUX and you'll see:

src/ftpd.c:#ifdef HPUX_10_TRUSTED
src/ftpd.c:#if defined(SecureWare) || defined(HPUX_10_TRUSTED)
src/ftpd.c:# if defined(SecureWare) || defined(HPUX_10_TRUSTED)
src/ftpd.c:# endif /* SecureWare || HPUX_10_TRUSTED */
src/ftpd.c:# if defined(SecureWare) || defined(HPUX_10_TRUSTED)
src/ftpd.c:# endif /* SecureWare || HPUX_10_TRUSTED */
src/ftpd.c:#elif defined(SecureWare) || defined(HPUX_10_TRUSTED)
src/ftpd.c:#if defined(SecureWare) || defined(HPUX_10_TRUSTED)
src/ftpd.c:#ifdef HPUX_10_TRUSTED
src/ftpd.c:#ifdef HPUX_SELECT
src/config/config.hiu:#define HPUX_SELECT
src/config/config.hpx: * config.h for HPUX
src/config/config.hpx:#undef HPUX9
src/config/config.hpx:#define HPUX_10_TRUSTED
src/config/config.hpx:#ifdef HPUX9
src/config/config.hpx:#define HPUX_SELECT
src/makefiles/Makefile.hpx:# Makefile for HPUX
src/makefiles/Makefile.hpx:CFLAGS   = -Aa -Dunix -D_HPUX_SOURCE -O +Onolimit ${IFLAGS} ${LFLAGS}

> I suspect both problems have the same root cause.

So do I.  Unfortunately, the only HP/UX 10.20 boxes I have access to I
cannot compile and test the daemon on.

--