Solved

Pure-FTPd authentication fail

Posted on 2012-04-04
7
3,530 Views
Last Modified: 2012-04-06
Hi expertos,

I have Ubuntu 10.4LTS server running for more than 1 year without problems.

On this server I have Pure-FTP-MySQL installed (pure-ftpd-common pure-ftpd-mysql) with explicit TLS and self-signed certificate. Works perfectly!
Starting ftp server: Running: /usr/sbin/pure-ftpd-mysql-virtualchroot -l mysql:/etc/pure-ftpd/db/mysql.conf -l pam -A -p 10900:11999 -E -Y 2 -D -8 UTF-8 -u 1000 -O clf:/var/log/pure-ftpd/transfer.log -H -b -B

Open in new window


Now, from few days ago none of the users can login:
Status:	Resolving address of ftp.myserver.net
Status:	Connecting to 10.10.10.133:21...
Status:	Connection established, waiting for welcome message...
Response:	220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
Response:	220-You are user number 1 of 50 allowed.
Response:	220-Local time is now 19:46. Server port: 21.
Response:	220-This is a private system - No anonymous login
Response:	220-IPv6 connections are also welcome on this server.
Response:	220 You will be disconnected after 15 minutes of inactivity.
Command:	AUTH TLS
Response:	234 AUTH TLS OK.
Status:	Initializing TLS...
Status:	Verifying certificate...
Command:	USER test
Status:	TLS/SSL connection established.
Response:	331 User test OK. Password required
Command:	PASS ******
Response:	530 Login authentication failed
Error:	Critical error
Error:	Could not connect to server

Open in new window


I haven't changed anything!
All what has been happening in the neighborhood was a test of new firewall, which I removed after testing and put old firewall back. All old settings preserved, actually nothing was changed.

I tried:
- removed pure-ftpd-mysql and pure-ftpd-common (preserved settings), and installed back, but NO AVAIL
- removed SSL cert and created new one, but NO AVAIL
- changed /etc/pure-ftpd/conf/TLS from 2 to 1 to allow also non-TLS connections...but still NO AVAIL (same error as above)
- bypassed firewall and tested from local LAN IP, with or without TLS, but NO AVAIL

Always the same message in  /var/log/messages :
Apr  4 19:41:42 ftp pure-ftpd: (?@10.10.10.125) [INFO] New connection from 10.10.10.125
Apr  4 19:41:42 ftp pure-ftpd: (?@10.10.10.125) [INFO] SSL/TLS: Enabled TLSv1/SSLv3 with DHE-RSA-AES128-SHA, 128 secret bits cipher
Apr  4 19:41:44 ftp pure-ftpd: (?@10.10.10.125) [INFO] PAM_RHOST enabled. Getting the peer address
Apr  4 19:41:50 ftp pure-ftpd: (?@10.10.10.125) [WARNING] Authentication failed for user [test]
Apr  4 19:41:50 ftp pure-ftpd: (?@10.10.10.125) [INFO] Logout.

Open in new window


I do not understand.
This is not Windows self-breaking OS, but stable Linux box.
Ideas welcome.
0
Comment
Question by:Andrej Pirman
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 57

Expert Comment

by:giltjr
ID: 37812175
Well to me it looks like the password for the user-id test has been changed.

Response:      331 User test OK. Password required
Command:      PASS ******
Response:      530 Login authentication failed
0
 
LVL 18

Author Comment

by:Andrej Pirman
ID: 37816494
Hmmm... I've tested with ALL existing and previously working users (20 of them) and nobody can connect.
So I created new user, test...with fres settings, fresh password...but still no go.
Nothing else in logs.

Any other idea?
Maybe some more in-deep logging?
0
 
LVL 57

Expert Comment

by:giltjr
ID: 37816979
Could an IP address have changed?  Based on the message:

   PAM_RHOST enabled. Getting the peer address

Pure-FTPd is trying to get the client IP address to validate it against something.  If the IP address that is sees from the client changed, then it could be failing the connection because of that.
0
NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

 
LVL 57

Accepted Solution

by:
giltjr earned 500 total points
ID: 37817288
You may also want to enable debug logging on the Pure-FTPd server to see that shows any more information.

You can follow these instructions (although it says Debian, it works for Ubuntu also).

http://www.faqforge.com/linux/controlpanels/ispconfig3/how-to-enable-debugging-in-pure-ftpd-on-debian-linux/
0
 
LVL 18

Author Comment

by:Andrej Pirman
ID: 37817605
Oh...bad pingo... :)
PROBLEM SOLVED

First, thanx giltjr for pointing me out to VerboseLog. Immediately I found this:
 postfix/proxymap[9609]: warning: connect to mysql server 127.0.0.1: Access denied for user ...

Open in new window

Oups...it must be mysql buggy...let's see.
Found out that pure-ftpd-mysql is using "ispconfig" user to connect to database (ok, it's my CP), and when I lookup privileges table in mysql, found "ispconfig" user to allow connections only from "localhost". Which is mostly OK, but some apps use 127.0.0.1 instead of localhost.
So I altered privileges of "ispconfig" user to allow connection from ANY host.

Removed VerboseLog, restarted pure-ftpd, restarted mysql...and we're back in business!
0
 
LVL 18

Author Closing Comment

by:Andrej Pirman
ID: 37817612
I decided to give you all the points, since you pushed me in the right way.
0
 
LVL 57

Expert Comment

by:giltjr
ID: 37818032
Glad I could get you down the path to the solution.
0

Featured Post

Space-Age Communications Transitions to DevOps

ViaSat, a global provider of satellite and wireless communications, securely connects businesses, governments, and organizations to the Internet. Learn how ViaSat’s Network Solutions Engineer, drove the transition from a traditional network support to a DevOps-centric model.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction This article explores the design of a cache system that can improve the performance of a web site or web application.  The assumption is that the web site has many more “read” operations than “write” operations (this is commonly the ca…
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question