[BlueOnyx:01317] Re: ProFTPD and ProFTPD server

[Rodrigo Ordonez Licona]

-----Original Message-----
From: blueonyx-bounces at blueonyx.it [mailto:blueonyx-bounces at blueonyx.it] On
Behalf Of Greg Kuhnert
Sent: Martes, 26 de Mayo de 2009 10:30
To: Tjerk Hacquebord
Cc: 'BlueOnyx General Mailing List'
Subject: [BlueOnyx:01306] Re: ProFTPD and ProFTPD server

If it is not proftpd, it must be another app misbehaving....

lsof -n | grep TCP.*ftp

Try the above command - and see what it finds. You should only see xinetd
running on that port.

+---------------------------------------------------------------------+
|   / \   Greg Kuhnert, gkuhnert at compassnetworks.com.au               |
| <  o  > Compass Networks - Pointing you in the right direction      |
|   \ /   Come see us for BlueQuartz / BlueOnyx modules & Support.    |
+---------------------------------------------------------------------+


Tjerk Hacquebord wrote:
> Got only the xinetx service:
>
> proftpd:        on
>
> I don't have another proftpd service in the list, just this one.
>
> Must be something else then that generates these warnings...
>
>
> Tjerk Hacquebord
> ---
> tjerk at hqmatics.nl
> http://www.hqmatics.nl
>
>
> HQMatics: Software- en websiteontwikkeling
>
> -----Oorspronkelijk bericht-----
> Van: blueonyx-bounces at blueonyx.it 
> [mailto:blueonyx-bounces at blueonyx.it]
> Namens Gerald Waugh
> Verzonden: dinsdag 26 mei 2009 15:35
> Aan: BlueOnyx General Mailing List
> Onderwerp: [BlueOnyx:01303] Re: ProFTPD and ProFTPD server
>
> Tjerk Hacquebord wrote; Monday, May 25, 2009 8:48 AM
>
>   
>> Looks like it yes.. But how did this start? This is a new server, not 
>> running any sites yet, one month up, running with auto updates.
>>     
>
> execute
>     chkconfig --list | grep proftpd
> You should see;
>
> proftpd         0:off   1:off   2:off   3:off   4:off   5:off   6:off
>         proftpd:        on
>
> Note: the 2nd instance is xinetd process.
> If the 1st instance shows 'on' in any place.
> execute
>    chkconfig proftpd off
>
> Gerald
>
>
>   
>> [root at server3 ~]# service proftpd stop
>> Shutting down proftpd:                                     [FAILED]
>>
>>
>> service is not running:
>> service --status-all
>> ....
>> poprelayd is stopped
>> postmaster is stopped
>> -->proftpd is stopped
>> Process accounting is disabled.
>> rdisc is stopped
>> ...
>>
>>
>> Tjerk Hacquebord
>> ---
>> tjerk at hqmatics.nl
>> http://www.hqmatics.nl
>>
>>
>> HQMatics: Software- en websiteontwikkeling
>>
>> -----Oorspronkelijk bericht-----
>> Van: blueonyx-bounces at blueonyx.it 
>> [mailto:blueonyx-bounces at blueonyx.it]
>> Namens Greg Kuhnert
>> Verzonden: maandag 25 mei 2009 15:17
>> Aan: blueonyx at blueonyx.it
>> Onderwerp: [BlueOnyx:01297] Re: ProFTPD and ProFTPD server
>>
>> Sounds like its running as a standalone process and in inetd....
>> Standard setup is to run from xinetd so do service proftpd stop
>>
>> Regards,
>> Greg.
>>
>> Tjerk Hacquebord wrote:
>>     
>>> I get this warning in /var/log/messages when an ftp connection 
>>> attempt is made:
>>>
>>>
>>>
>>> May 24 04:03:33 server3 xinetd[4951]: START: ftp pid=576 
>>> from=83.98.206.*
>>>
>>> May 24 04:03:33 server3 proftpd[576]: warning: "ProFTPD" 
>>> address/port
>>> (83.98.206.*:21) already in use by "ProFTPD server"
>>>
>>> May 24 04:03:33 server3 proftpd[576]: server3.hqmatics.com
>>> (83.98.206.*[83.98.206.*]) - FTP session opened.
>>>
>>> May 24 04:03:33 server3 proftpd[576]: server3.hqmatics.com
>>> (83.98.206.*[83.98.206.*]) - FTP session closed.
>>>
>>> May 24 04:03:33 server3 xinetd[4951]: EXIT: ftp status=0 pid=576
>>> duration=0(sec)
>>>
>>>
>>>
>>> Is ftp running twice? Why?
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>> Tjerk Hacquebord
>>>
>>> ---
>>>
>>> tjerk at hqmatics.nl <mailto:tjerk at hqmatics.nl>
>>>
>>> http://www.hqmatics.nl <http://www.hqmatics.nl/>
>>>
>>>


You can try restarting sendmail, mailscanner (if you have it), and maybe
portsentry.

I have seen rare cases where mailscanner takes over apaches ssl port. 

 Reboot should get you going too.

HTH

Rodrigo O
Xnet