PAM or PROFTPD help?!?!

[jasonM_Tmob]

Hi all, I have a strange symptom which I can not seem to resolve.

I have an FTP server running Proftod 1.2.10 on Debian. I have an intermittent problem where when I try to connect to the server, it closes my connection town. Packet analysis showed that immediately after sending the password a fin is sent from the server to close the session down. I have looked through all the logs in var/log and there is no indication in the auth.log file or the syslog of a problem. I have also turned on the extended log which only shows that something is amiss here at 09:34:59 where there is a user trying to log in but then no password arrives.

149.254.200.215 UNKNOWN nobody [16/Jun/2006:09:33:20 +0100] "USER ftpuser5" 331 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:33:20 +0100] "PASS (hidden)" 230 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:33:21 +0100] "TYPE I" 200 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:33:21 +0100] "PASV" 227 -
149.254.200.215 UNKNOWN nobody [16/Jun/2006:09:34:59 +0100] "USER ftpuser5" 331 -
149.254.200.215 UNKNOWN nobody [16/Jun/2006:09:35:00 +0100] "USER ftpuser5" 331 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:35:00 +0100] "PASS (hidden)" 230 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:35:01 +0100] "TYPE I" 200 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:35:01 +0100] "PASV" 227 -
149.254.200.215 UNKNOWN nobody [16/Jun/2006:09:36:59 +0100] "USER ftpuser5" 331 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:00 +0100] "PASS (hidden)" 230 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:00 +0100] "TYPE I" 200 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:00 +0100] "PORT 149,254,200,215,69,158" 200 -
149.254.200.215 UNKNOWN nobody [16/Jun/2006:09:37:16 +0100] "USER ftpuser5" 331 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:16 +0100] "PASS (hidden)" 230 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:17 +0100] "TYPE I" 200 -
149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:17 +0100] "PASV" 227 –

I am using PAM authentication so have thought that perhaps there is a fault here but it is intermittent so I don’t know what’s going on. There is definitely no problem with the password or user being incorrect as these are saved and not manually entered each time.

Can anyone help with this mysterious problem or tell me how to provide more detailed information of what is happening when users log on?

Thanks,

Jason

[jasonM_Tmob]

OK new development. I increased the debug level on the PAM authentication which produced the following output.

Jun 16 15:52:24 localhost proftpd[20432]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session opened.
Jun 16 15:52:25 localhost proftpd[20432]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - mod_delay/0.4: delaying for 15 usecs
Jun 16 15:52:26 localhost proftpd[20432]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - mod_delay/0.4: delaying for 41 usecs
Jun 16 15:52:29 localhost proftpd[20433]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session opened.
Jun 16 15:52:29 localhost proftpd[20433]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - mod_delay/0.4: delaying for 4 usecs
Jun 16 15:52:29 localhost proftpd[20433]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - ProFTPD terminating (signal 11)
Jun 16 15:52:29 localhost proftpd[20433]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session closed.
Jun 16 15:52:30 localhost proftpd[20434]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session opened.
Jun 16 15:52:30 localhost proftpd[20434]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - mod_delay/0.4: delaying for 28 usecs
Jun 16 15:52:46 localhost proftpd[20434]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session closed.
Jun 16 15:52:52 localhost proftpd[20435]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session opened.

As you can see the process was killed by signal 11 (segmentation fault). Does anyone know how this can be rectified or what it means?