Subject: Re: BeroFTPD-1.3.4 on HP-UX 11

From: "James B. Byrne" <[email-masked]>
Date: Thu, 18 Mar 1999 11:47:13 -0500

I have BeroFTPD 1.3.4 built (with gcc 2.8.1) and running on an 
HP-UX 11.00 machine but I am getting the following error 
message when a virtual user tries to do a 'dir' of his working 
directory:

ftp> dir
200 PORT command successful.
425 Can't create data socket (209.47.131.74,20): Permission denied.

Now what causes this?  The ftpaccess files are identical to 
those being used on a HP-UX 10 system with BeroFTPD 
1.3.2.  The passwd files and user directory structures on both 
systems are identical.  The built in ls command was compiled 
with 1.3.4.  In fact the configure list is reproduced below.

./configure \
--enable-internal-ls \
--enable-chmod-lim \
--enable-ratios \
--prefix=/usr/local \
--with-confdir=/usr/local/etc/ftpd \
--with-logdir=/var/adm/syslog \
--with-piddir=/var/run \
--enable-throughput \
--enable-transfer-cnt \
--enable-transfer-lim \
--enable-passwd

Any suggestions as to what I may have done wrong would be 
greatly appreciated.

Regards,
Jim
---
James B. Byrne                Harte & Lyne Limited
vox: +1 905 561 1241          9 Brockley Drive
fax: +1 905 561 0757          Hamilton, Ontario
mailto:[email-masked]  Canada L8E 3C3

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 18 Mar 1999 12:19:58 -0500 (EST)

> 425 Can't create data socket (209.47.131.74,20): Permission denied.

I don't run BeroFTPD, but it looks to me like the daemon isn't root
(superuser) when it's attempting to connect to the client from the
ftp-data port (20).  Are you running the daemon as root or some other
user?  Also, I'd check the OS books, some systems have protection schemes
arround the privileged ports and you need to do some magic handwaving to
tell the system the deamon is allowed to open a connection on the port.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "James B. Byrne" <[email-masked]>
Date: Thu, 18 Mar 1999 13:25:25 -0500

On 18 Mar 99, at 12:19, Gregory A Lundberg wrote:

>  don't run BeroFTPD, but it looks to me like the daemon isn't root
> user?

I am running ftpd from inetd.  Inetd was started with boot up.  
As far as I can tell all privilege settings are the same on both 
systems.  Only the operating system differs. 

Is there something obvious to others that I am missing here?  
How does one influence the suid of the BeroFTPD deamon 
when it is invoked by inetd?

Regards,
Jim
---

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 18 Mar 1999 13:49:13 -0500 (EST)

As I said, I don't run BeroFTPD, so I don't know if there's maybe a setup
file for the sevrer which tells it to run as a non-root user.

Your inetd startup looks correct.

I know some systems need special handwaving to allow the daemon to use the
privileged ports.  For instance on Truste Solaris, I believe, you need to
tag the executable are privileged .. simply running as root won't do.
Maybe HP/UX 11 needs something like that as well?

Are you running multiple virtual servers?  If so, do you have the problem
on all of them?  Or all but the base, default, server?  Or only one or
two?

--

---

From: "James B. Byrne" <[email-masked]>
Date: Thu, 18 Mar 1999 16:01:12 -0500

> on all of them?  Or all but the base, default, server?  Or only one or

Yes, and no.  As usual I am encountering problems moving 
from one platform to another and upgrading the software at the 
same time.  I suppose that I should have learned better by 
now.

The long story is that I had Kent Langfield's Newvirt-050 
running on my main virtual host (HP/9000 H30) when that 
machine suffered a catastrophic cpu failure in January.  I then 
had to hurriedly move these sites onto another server, an older 
HP/9000 running HP-UX 10.01.  In the process I found that I 
was forced to move to BeroFTPD in order to maintain the 
same functionality.  I am running Bero 1.3.2 on that machine 
under HP-UX 10.01.

Now it is time to move all these sites back and I do not wish 
to go though hoops with the configuration files just to go back 
to a more primitive version of ftpd.  None the less the process 
has not been straight forward.

First I could not get Bero 1.3.4 to build on HP-UX 11.  This 
problem I believe that I have traced down and fixed. Now it 
appears that I have run into something else that is less 
obvious.  As I really need the virtual ftpaccess feature I am 
sort of stuck.

I do appreciate your assistance in this and I truly recognize 
the very gentlemanly manner in which you so graciously offer 
assistance to someone that is using a product that has little 
or nothing to do with your own efforts in this area. If you could 
see your way to incorporating the NEWVIRT code into VR 
then I would switch in a heartbeat.

I do not know if this is a case where HP-UX 11 is expecting 
something that I am not giving it, or if I have misconfigured 
something that has changed in Bero from 1.3.2 to 1.3.4.  I can 
only ask if someone else has run into this and if they have, 
how did they fix it?

This is what is being logged in the syslog:

/var/adm/syslog/syslog.log:Mar 18 13:23:41 hahp9k02 ftpd[3774]: VirtualFTP Conne
ct to: 209.47.131.83
/var/adm/syslog/syslog.log:Mar 18 13:23:48 hahp9k02 ftpd[3774]: USER ftpjmrmt
/var/adm/syslog/syslog.log:Mar 18 13:23:52 hahp9k02 ftpd[3774]: PASS password
/var/adm/syslog/syslog.log:Mar 18 13:23:53 hahp9k02 ftpd[3774]: FTP LOGIN FROM h
ahp9k01.harte-lyne.ca [209.47.131.101], ftpjmrmt
/var/adm/syslog/syslog.log:Mar 18 13:23:53 hahp9k02 ftpd[3774]: SYST
/var/adm/syslog/syslog.log:Mar 18 13:23:53 hahp9k02 ftpd[3774]: TYPE Image
/var/adm/syslog/syslog.log:Mar 18 13:23:55 hahp9k02 ftpd[3774]: PORT
/var/adm/syslog/syslog.log:Mar 18 13:23:55 hahp9k02 ftpd[3774]: TYPE ASCII
/var/adm/syslog/syslog.log:Mar 18 13:23:55 hahp9k02 ftpd[3774]: LIST
/var/adm/syslog/syslog.log:Mar 18 13:23:55 hahp9k02 ftpd[3774]: exiting on signa
l 11

Comments and suggestions are welcome.  I am cross posting 
this to the hpux admin list in the hopes that someone there 
may have an answer.

Regards,
Jim
---

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 18 Mar 1999 16:32:56 -0500 (EST)

On Thu, 18 Mar 1999, James B. Byrne wrote:

> /var/adm/syslog/syslog.log:Mar 18 13:23:55 hahp9k02 ftpd[3774]: exiting on signal 11

Hello!  Signal 11.  The daemon's dying.  The usual cause for that is a bad
pointer somewhere in the code (proximate to LIST, probably).  When VR was
being ported and debugged for HP/UX 10.20, we found a few sizeof/endian
problems (ie., sizeof(int) != sizeof(mode_t) on 10.20).  ISTM I've heard
that HP/UX 11 is a 64-bit OS.  If that's true, it's possibly another such
problem.

When I hit these, I insert some syslog messages in the code in an attempt
to localize the failure.  A couple compile/test cycles and I can usually
binary-search it down to the line where it's failing.  Spotting the
problem (for mode_t) was hard since it _looked_ right.  Usually, though,
it's some function returning an error condition which wasn't properly
checked causing the daemon to misbehave shortly thereafter.

What's odd, to me, is that you're getting the signal 11 in the system log
and your earlier posting indicated a permission-denied binding to port 20
for the PORT-mode data connection for the LIST command.  Maybe the daemon
isn't handling the permission-denied error and later dying with the signal
11 when it tries to use the unopened (and value == -1) file handle for the
socket.

--