Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have had proftpd installed for a while now but since today I can not sign into the ftp server. I keep getting the error 530 login incorrect.

I restarted proftpd in debug mode and got the below response when I tried to sign in:

- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): FTP session opened.
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'USER bernhard' to mod_tls
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'USER bernhard' to mod_core
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'USER bernhard' to mod_core
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'USER bernhard' to mod_delay
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'USER bernhard' to mod_auth
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching CMD command 'USER bernhard' to mod_auth
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching POST_CMD command 'USER bernhard' to mod_delay
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching LOG_CMD command 'USER bernhard' to mod_log
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'PASS (hidden)' to mod_tls
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'PASS (hidden)' to mod_core
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'PASS (hidden)' to mod_core
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'PASS (hidden)' to mod_delay
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching PRE_CMD command 'PASS (hidden)' to mod_auth
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching CMD command 'PASS (hidden)' to mod_auth
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): retrieved UID 500 for user 'bernhard'
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): retrieved group ID: 500
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): retrieved group name: bernhard
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): ROOT PRIVS at mod_auth_pam.c:311
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): RELINQUISH PRIVS at mod_auth_pam.c:481
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): USER bernhard (Login failed): Incorrect password.
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching POST_CMD_ERR command 'PASS (hidden)' to mod_delay
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_log
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_auth
- srv2.********.nl proftpd[1660] 159.253.3.237 (83.247.33.135[83.247.33.135]): FTP session closed.
share|improve this question
    
If it worked before but does not work now then the first step you need to do is to determine what changed. If your answer is nothing changed then you need to go back to the first step. –  yoonix Apr 28 at 22:43
1  
I installed a bunch of basic development tools. I did a reboot of the server and could still log in. a few hours later a colleage of mine, thinking I hadn't done the reboot did it again. And from that moment on we can't log into proftpd anymore. I removed all the development tools I installed to try and get proftpd working again, but without results. –  Bernhard Apr 28 at 22:48
    
I have found out that the problem is caused by an update from version 1.3.3g to 1.3.4a. I downgraded back to 1.3.3g and everything works again. –  Bernhard May 3 at 1:57
    
What operating system is this? Did anything appear in /var/log/secure (or equivalent) when login failed? –  Paul Haldane May 4 at 9:16
    
What operating system and version is this? –  ewwhite May 6 at 18:09

2 Answers 2

up vote 0 down vote accepted
+50

It sounds a lot like the libpam you've got installed wasn't upgraded when proftpd was, may try doing that prior to the upgrade for proftpd and see if that corrects the issue.

Also check the proftpd.conf particularly

#This is required to use both PAM-based authentication and local passwords

#AuthOrder mod_auth_pam.c* mod_auth_unix.c

^^^ and make sure that the conf didnt get updated to "generic"

share|improve this answer
    
Thanks art3mis! The second part of your answer solved it! I upgraded proftpd and now I can use it again! For that, you get the 50 bounty. I know it isn't a lot, but just a small token of my appreciation –  Bernhard May 10 at 19:55
    
Geez... Really? –  ewwhite May 11 at 15:39

If this is a RHEL or CentOS EL6.x system, it's important to modify your PAM configuration, as the one that ships with the package is no good:

Edit: /etc/pam.d/proftpd to reflect:

#%PAM-1.0M-1.0
auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
auth required pam_shells.so
auth include system-auth
account include system-auth
#session include system-auth
session required pam_loginuid.so
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.