[svlug] error message question

[Tin Le]

-----BEGIN PGP SIGNED MESSAGE-----

Gordon,

Looking through the strace log, I noticed that I had missed several
important piece of info.

> I enabled all of the logging through the /etc/ftpaccess file (log
> transfers anonymous,real inbound,outbound log commands
> anonymous,real,guest inbound,outbound) 
> and get this on the server on ftp logins from one workstation:
> Aug 11 16:22:05 wilfred ftpd[764]: USER emluser
> Aug 11 16:22:08 wilfred ftpd[764]: PASS password
> Aug 11 16:22:08 wilfred ftpd[764]: REST 0
                                     ^^^^^^
At this point, you(Netscape) login successfully as emluser, and Netscape
sent a "REST" command to wuftpd.  This is a command to tell the ftp server
that the ftp client wants to resume a previous transfer.

That's interesting.  Seem to be a bug in ftp client.

> Aug 11 16:22:08 wilfred ftpd[764]: SYST
> Aug 11 16:22:39 wilfred ftpd[765]: USER gordon
> Aug 11 16:22:39 wilfred ftpd[765]: PASS password

This part confuses me.  It seem now you are login again as gordon.  Is
this two separate login sessions mixed in?

> Aug 11 16:22:39 wilfred ftpd[765]: SYST
> Aug 11 16:22:56 wilfred PAM_pwdb[767]: (login) session opened for user
> gordon by (uid=0)
> Aug 11 16:22:56 wilfred pam_console[767]: can't find device or X11 socket
> to examine for 1

Anyway the strace log shows that the ftp server is waiting for ftp client
to send it the next command, as evident in the 

read(0,  <unfinished ...>
^^^^^

It (wu-ftpd) is sitting in a read loop waiting for commands.  Is there
anything at all in the middle (between ftp server and client?) such as
a proxy?  Something is sending a "REST" command to the server so it waits
for further command from client, but client never sent it.

As for the other error

> Aug 11 16:22:56 wilfred pam_console[767]: can't find device or X11 socket
> to examine for 1

the strace log does not show anything that has to do with it.  The early
part of the log shows that wu-ftpd went through pam just fine.  It
authenticated and logged you in ok.

What is your ftpaccess file look like?  Can you post that?

Does this problem only happen with one user?  Or does it happened with all
users?

Tin Le
- ----
http://tin.le.org
Tin Le - tin at le.org
Firewall and Security Consulting


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAgUBOZiFEBiIIbPkDHhBAQFV4AQAueu+sPNxSJKjOElnO0MV8rtomqZXrcHK
l5wRsphtsEKq5H6Ei8VrPBzgLak328cLPW+R4yUyQz0twJdQT85ZQtWd/itoNffE
MBsk2RO0QNHu2S1lmzb/D40LxIXWR85QB3J5lY0tmHcggMHmXEQGooPT7wAGz4Oi
SmsuzpBUmL4=
=+XwM
-----END PGP SIGNATURE-----