wu-ftpd authentication problem

wu-ftpd authentication problem

Post by Jack » Sun, 31 Dec 1899 09:00:00



A weird thing happened over the weekend.  The wu-ftp daemon on my RH6.2 just
could not seem to authorise users anymore although it was working just fine the day
before.  I had no idea what happened so I just removed and re-installed the RPM.
Then it worked.  Anyone know what the heck is going on?

Thanks in advance.

 
 
 

wu-ftpd authentication problem

Post by Gene Hesket » Sun, 31 Dec 1899 09:00:00


Unrot13 this;

Gene Heskett sends Greetings to Jack ;

Quote:> A weird thing happened over the weekend.  The wu-ftp daemon on my
> RH6.2 just could not seem to authorise users anymore although it was
> working just fine the day before.  I had no idea what happened so I
> just removed and re-installed the RPM. Then it worked.  Anyone know
> what the heck is going on?

Possibly a known exploit, that daemon was replaced with a new one
patched to defeat an exploit about 2 weeks ago.

In which case the system may have been compromised, take it off line as
soon as you get all the late updates from RH, and reinstall, finishing
up with all the updates.

Good luck.

Cheers, Gene
--

        email gene underscore heskett at iolinc dot net
ISP's please take note: My spam control policy is explicit!
#Any Class C address# involved in spamming me is added to my killfile
never to be seen again.  Message will be summarily deleted without dl.
This messages reply content, but not any previously quoted material, is
? 2000 by Gene Heskett, all rights reserved.
--

 
 
 

wu-ftpd authentication problem

Post by Andrew N. McGuir » Sun, 31 Dec 1899 09:00:00


On Mon, 10 Jul 2000, Jack quoth:

[] A weird thing happened over the weekend.  The wu-ftp daemon on my RH6.2 just
[] could not seem to authorise users anymore although it was working just fine the day
[] before.  I had no idea what happened so I just removed and re-installed the RPM.
[] Then it worked.  Anyone know what the heck is going on?

Well, not exactly, but I have some advice.  If you have a program that
does something like that again, strace it.  You may find out that
there was a file deleted or some event took place that would preclude
your program from running correctly.  Pay close attention to
errors marked ENOENT ( no such file or directory ).  If you do
a 'man errno', the rest of the possible errors are summarized there.

Something like this: 'strace -f -p PID'
I believe is the syntax... 'man strace' to be sure.

Regards,

anm
--
/*------------------------------------------------------------------------.
| Andrew N. McGuire                                                       |

| perl -le'print map?"(.*)"?&&($_=$1)&&s](\w+)]\u$1]g&&$_=>`perldoc -qj`' |
`------------------------------------------------------------------------*/

 
 
 

1. in.ftpd zombie problem with wu-ftpd on RH6

We're using wu-ftpd-2.5.0-2 on RedHat 6.0.  The server is working
fine, but we have noticed the following problem:

After several days of operation, there will be many 'leftover'
in.ftpds.  We allow 100 users at a time and this is resulting in users
being denied access to the site even though there are only 3-4 active
connections.

If you do a ftpshut followed by a killall in.ftpd, then all is fine
for several more days.

Once the problem develops, a ps shows:

# ps ax | grep in.ftpd
27280 ?        SW     0:00 [in.ftpd]
29153 ?        SW     0:00 [in.ftpd]
29530 ?        SW     0:00 [in.ftpd]
30009 ?        SW     0:00 [in.ftpd]
31063 ?        SW     0:00 [in.ftpd]
31067 ?        SW     0:00 [in.ftpd]
31384 ?        SW     0:00 [in.ftpd]
31899 ?        SW     0:00 [in.ftpd]
31948 ?        SW     0:00 [in.ftpd]
32115 ?        SW     0:00 [in.ftpd]
  324 ?        SW     0:00 [in.ftpd]
  572 ?        SW     0:00 [in.ftpd]
  581 ?        SW     0:00 [in.ftpd]
 1094 ?        SW     0:00 [in.ftpd]
 1449 ?        SW     0:00 [in.ftpd]
 1709 ?        SW     0:00 [in.ftpd]
 2302 ?        SW     0:00 [in.ftpd]
 2519 ?        SW     0:00 [in.ftpd]
<many more follow>

wu-ftpd is being launched from inetd.conf as follows:
ftp     stream  tcp     nowait.255      root    /usr/sbin/tcpd in.ftpd
-l -a -t240 -T240

Any ideas on solving this would be appreciated.

Thanks,
Brian

Anything you can imagine (and many things you can't), someone,
somewhere on the net is doing.


      http://www.mindspring.com/~briandaniels

2. openstep

3. WU-FTPD Guest Login with PAM Authentication

4. SendMail and DNS and Ugggh

5. wu-ftpd user authentication failure

6. Trident 9000i HELP

7. wu-ftpd guest login w/ PAM authentication

8. Newbie question

9. wu-ftpd instead of ftpd

10. FreeBSD ftpd 6.0 vs wu-ftpd 2.4

11. Weirdness of solaris ftpd and wu-ftpd

12. wu-ftpd or pro-ftpd

13. ftpd default server vs wu-ftpd ?