Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have had proftpd installed for a while now but since today I can not sign into the ftp server. I keep getting the error 530 login incorrect.

I restarted proftpd in debug mode and got the below response when I tried to sign in:

- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): FTP session opened.
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'USER bernhard' to mod_tls
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'USER bernhard' to mod_core
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'USER bernhard' to mod_core
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'USER bernhard' to mod_delay
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'USER bernhard' to mod_auth
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching CMD command 'USER bernhard' to mod_auth
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching POST_CMD command 'USER bernhard' to mod_delay
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching LOG_CMD command 'USER bernhard' to mod_log
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'PASS (hidden)' to mod_tls
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'PASS (hidden)' to mod_core
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'PASS (hidden)' to mod_core
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'PASS (hidden)' to mod_delay
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'PASS (hidden)' to mod_auth
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching CMD command 'PASS (hidden)' to mod_auth
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): retrieved UID 500 for user 'bernhard'
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): retrieved group ID: 500
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): retrieved group name: bernhard
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): ROOT PRIVS at mod_auth_pam.c:311
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): RELINQUISH PRIVS at mod_auth_pam.c:481
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): USER bernhard (Login failed): Incorrect password.
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching POST_CMD_ERR command 'PASS (hidden)' to mod_delay
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_log
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_auth
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): FTP session closed.
share|improve this question
    
If it worked before but does not work now then the first step you need to do is to determine what changed. If your answer is nothing changed then you need to go back to the first step. –  yoonix Apr 28 '14 at 22:43
1  
I installed a bunch of basic development tools. I did a reboot of the server and could still log in. a few hours later a colleage of mine, thinking I hadn't done the reboot did it again. And from that moment on we can't log into proftpd anymore. I removed all the development tools I installed to try and get proftpd working again, but without results. –  Bernhard Apr 28 '14 at 22:48
    
I have found out that the problem is caused by an update from version 1.3.3g to 1.3.4a. I downgraded back to 1.3.3g and everything works again. –  Bernhard May 3 '14 at 1:57
    
What operating system is this? Did anything appear in /var/log/secure (or equivalent) when login failed? –  Paul Haldane May 4 '14 at 9:16
    
What operating system and version is this? –  ewwhite May 6 '14 at 18:09

3 Answers 3

up vote 1 down vote accepted
+50

It sounds a lot like the libpam you've got installed wasn't upgraded when proftpd was, may try doing that prior to the upgrade for proftpd and see if that corrects the issue.

Also check the proftpd.conf particularly

#This is required to use both PAM-based authentication and local passwords

#AuthOrder mod_auth_pam.c* mod_auth_unix.c

^^^ and make sure that the conf didnt get updated to "generic"

share|improve this answer
    
Thanks art3mis! The second part of your answer solved it! I upgraded proftpd and now I can use it again! For that, you get the 50 bounty. I know it isn't a lot, but just a small token of my appreciation –  Bernhard May 10 '14 at 19:55
    
Geez... Really? –  ewwhite May 11 '14 at 15:39

If this is a RHEL or CentOS EL6.x system, it's important to modify your PAM configuration, as the one that ships with the package is no good:

Edit: /etc/pam.d/proftpd to reflect:

#%PAM-1.0M-1.0
auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
auth required pam_shells.so
auth include system-auth
account include system-auth
#session include system-auth
session required pam_loginuid.so
share|improve this answer

One point to note that burned me is ... pam_shells.so

pam_shells.so - this requires that all the allowable shells be in /etc/shells.

With NIS, because we have many different distro's of Linux and Solaris, our NIS shells are all /usr/local/bin/

On the machines themselves, in /usr/local/bin/ we create soft links to the shells. i.e. /usr/local/bin/bash --> /bin/bash

Where I got burned is... even though /bin/bash is in /etc/shells, /usr/local/bin/bash also needs to be in there.

It's a 10 second fix, but it took me a long time to figure out.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.