Find the answer to your Linux question:
Results 1 to 2 of 2
Hi all, I have a strange symptom which I can not seem to resolve. I have an FTP server running Proftod 1.2.10 on Debian. I have an intermittent problem where ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Jun 2006
    Location
    London
    Posts
    5

    ftp server intermittently closes connection


    Hi all, I have a strange symptom which I can not seem to resolve.

    I have an FTP server running Proftod 1.2.10 on Debian. I have an intermittent problem where when I try to connect to the server, it closes my connection town. Packet analysis showed that immediately after sending the password a fin is sent from the server to close the session down. I have looked through all the logs in var/log and there is no indication in the auth.log file or the syslog of a problem. I have also turned on the extended log which only shows that something is amiss here at 09:34:59 where there is a user trying to log in but then no password arrives.
    149.254.200.215 UNKNOWN nobody [16/Jun/2006:09:33:20 +0100] "USER ftpuser5" 331 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:33:20 +0100] "PASS (hidden)" 230 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:33:21 +0100] "TYPE I" 200 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:33:21 +0100] "PASV" 227 -
    149.254.200.215 UNKNOWN nobody [16/Jun/2006:09:34:59 +0100] "USER ftpuser5" 331 -
    149.254.200.215 UNKNOWN nobody [16/Jun/2006:09:35:00 +0100] "USER ftpuser5" 331 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:35:00 +0100] "PASS (hidden)" 230 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:35:01 +0100] "TYPE I" 200 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:35:01 +0100] "PASV" 227 -
    149.254.200.215 UNKNOWN nobody [16/Jun/2006:09:36:59 +0100] "USER ftpuser5" 331 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:00 +0100] "PASS (hidden)" 230 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:00 +0100] "TYPE I" 200 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:00 +0100] "PORT 149,254,200,215,69,158" 200 -
    149.254.200.215 UNKNOWN nobody [16/Jun/2006:09:37:16 +0100] "USER ftpuser5" 331 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:16 +0100] "PASS (hidden)" 230 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:17 +0100] "TYPE I" 200 -
    149.254.200.215 UNKNOWN ftpuser5 [16/Jun/2006:09:37:17 +0100] "PASV" 227 Ė
    I am using PAM authentication so have thought that perhaps there is a fault here but it is intermittent so I donít know whatís going on. There is definitely no problem with the password or user being incorrect as these are saved and not manually entered each time.

    Can anyone help with this mysterious problem or tell me how to provide more detailed information of what is happening when users log on?

    Thanks,

    Jason

  2. #2
    Just Joined!
    Join Date
    Jun 2006
    Location
    London
    Posts
    5
    OK new development. I increased the debug level on the PAM authentication which produced the following output.

    Jun 16 15:52:24 localhost proftpd[20432]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session opened.
    Jun 16 15:52:25 localhost proftpd[20432]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - mod_delay/0.4: delaying for 15 usecs
    Jun 16 15:52:26 localhost proftpd[20432]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - mod_delay/0.4: delaying for 41 usecs
    Jun 16 15:52:29 localhost proftpd[20433]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session opened.
    Jun 16 15:52:29 localhost proftpd[20433]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - mod_delay/0.4: delaying for 4 usecs
    Jun 16 15:52:29 localhost proftpd[20433]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - ProFTPD terminating (signal 11)
    Jun 16 15:52:29 localhost proftpd[20433]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session closed.
    Jun 16 15:52:30 localhost proftpd[20434]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session opened.
    Jun 16 15:52:30 localhost proftpd[20434]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - mod_delay/0.4: delaying for 28 usecs
    Jun 16 15:52:46 localhost proftpd[20434]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session closed.
    Jun 16 15:52:52 localhost proftpd[20435]: localhost.t-mobile.co.uk (149.254.200.215[149.254.200.215]) - FTP session opened.
    As you can see the process was killed by signal 11 (segmentation fault). Does anyone know how this can be rectified or what it means?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •