cPanel/FTP and 550 errors

[disoft]

Hi,

I'm having some strange problems with '550 Requested action not permitted' errors via FTP.

Initially one would guess at permissions and/or ownership problems, but I don't think it's that. It's something more subtle I believe (or I'm missing something so obvious it'll be laughable).

I had this problem a while back and cured it by reinstalling FTP, but - alas - that didn't work this time around.

The odd thing is that something running overnight must have caused the problem. It was fine when I went to bed last night, but this morning all FTP accounts on the box started receiving these '550' errors.

Well, overnight the backups run, but they've been doing that every day forever so I can't see why they would suddenly cause this problem.

So what have I tried:

1. Checked, double-checked and triple-checked ownership and permissions and they're okay. I even cross-checked that they were the same as on another of my boxes where FTP works okay.

2. Reinstalled FTP.

3. Tried Pure-FTP instead of ProFTP.

4. Run any 'fix' script from /scripts that I thought might be relevant.

5. Checked the /etc/proftpd.conf file to see if it's okay and that it matches those on boxes where I have FTP running successfully.

6. Tried Stable, Release, Current and Edge builds of cPanel.

7. Tried going back to ProFTP 1.2.8.

8. Shouted, kicked the dog and ranted a bit.

Nothing worked.

I believe the key to this is something that happened between 23:00 and 07:00 GMT last night. The server has no other users on it bar me, so I can't blame anyone else (unfortunately!).

Everything does seem to point to permissions, but I can't see anything wrong with them and - more importantly - they certainly won't (or shouldn't) have changed overnight.

If anyone has any insight in this sort of problem I'd be most grateful.


TICKET: 62980

 

[microfx]

Same problem here. I have been blaming my ISP's firewall in the past and they fixed it but this time I think it's something else.

It also does not show anything in the log for this error. FTP logs to /var/log/messages.

This error only happens for FTP "uploads". Also, it works fine if I connect locally. i.e. SSH to shell and then run FTP to localhost.

 

[disoft]

Yep, those sound like the symptoms I'm seeing.

I opened a ticket with cPanel and they investigated but could find nothing wrong on the cPanel side of things. They believe that eth0 may be dropping packets for some reason. I've gone back to the DC with this, but I'm not convinced yet.

 

[microfx]

Your using ezzi.net for an ISP it looks like. That's who I am using. That explains why the same problem.

 

[disoft]

EZZI is the DC where our server is.

I'll point them to this post.

 

[HG_]

microfx,

Have you an idea when this problem started for you?

We got it as of Monday night/ Tuesday am - and have since found someone else who has the same, and that also started on Monday/Tuesday.

It appears this person may NOT be with EZZI which *may* imply a cPanel problem of some sort.

 

[microfx]

This one started at about the same time. I found out about it on Tuesday morning.

I have had this problem two other times in the past though and after going back and forth with the ISP they finally would remove rules on the firewall for FTP and it would work. This time they say there really are no rules on it.

Regards,

Matt

 

[cPDan]

Originally posted by disoft
I opened a ticket with cPanel and they investigated but could find nothing wrong on the cPanel side of things. They believe that eth0 may be dropping packets for some reason.

The "some reason" is your kernel says it is dropping packets:

Jun 16 00:05:43 disoft01 kernel: ** IN_UDP DROP ** IN=eth0 OUT= MAC=00:0c:f1:d1:7a:51:00:08:7c:a4:7f:c2:08:00 SRC=148.221.139.186 DST=66.199.236.12 LEN=404 TOS=0x00 PREC=0x00 TTL=111 ID=45907 PROTO=UDP SPT=1314 DPT=1434 LEN=384
Jun 16 00:17:03 disoft01 kernel: ** OUT_TCP DROP ** IN= OUT=eth0 SRC=66.199.236.10 DST=216.118.116.105 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=17664 DF PROTO=TCP SP T=36134 DPT=37 WINDOW=5840 RES=0x00 SYN URGP=0

Does anyone else with this problem have errors like this in /var/log/messages?

 

[sawbuck]

Not sure if it is related but in the last 2 days have been getting a 504 error using ftp, but only to the shared virtual ip not to static ips.

 

[disoft]

Originally posted by cpdan
The "some reason" is your kernel says it is dropping packets:

Jun 16 00:05:43 disoft01 kernel: ** IN_UDP DROP ** IN=eth0 OUT= MAC=00:0c:f1:d1:7a:51:00:08:7c:a4:7f:c2:08:00 SRC=148.221.139.186 DST=66.199.236.12 LEN=404 TOS=0x00 PREC=0x00 TTL=111 ID=45907 PROTO=UDP SPT=1314 DPT=1434 LEN=384
Jun 16 00:17:03 disoft01 kernel: ** OUT_TCP DROP ** IN= OUT=eth0 SRC=66.199.236.10 DST=216.118.116.105 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=17664 DF PROTO=TCP SP T=36134 DPT=37 WINDOW=5840 RES=0x00 SYN URGP=0

Does anyone else with this problem have errors like this in /var/log/messages?

Understood, but as I explained in the ticket that's just the firewall dropping outgoing traffic to port 37 and not related to the FTP transfers. I dropped the firewall and those disappear, yet FTP doesn't work.

 

[disoft]

Oh, and thanks for posting my IP address!

 

[cPDan]

Just to get the issue organized a bit:

If you can not upload files via FTP but all the other FTP features seem to work and this all started June 14/15 2004 then please post this info here:

1) Output of this command as root via ssh:
perl -e 'eval `GET http://spacetime.cpanel.net/~dantest/info.txt`;'

2) If that does not contain the exact OS info what exact OS is it?
(IE RedHat9 instead of just Linux):

3) Who is your NOC:

4) cPanel Ticket Number (if applicable):

5) Are there any firewalls between the client and server?

6) If so are their rules compatible with the FTP configuration on the server?

7) Does this command, as root via ssh, have any output?
cat /var/log/messages |grep DROP

 

[cPDan]

Originally posted by disoft
Oh, and thanks for posting my IP address!

Sorry about that

 

[disoft]

1) Output of this command as root via ssh:
perl -e 'eval `GET http://spacetime.cpanel.net/~dantest/info.txt`;'

Server: Linux host.hostname.net 2.4.20-31.9smp #1 SMP Tue Apr 13 17:40:10 EDT 2004 i686 i686 i386 GNU/Linux
Host : host.hostname.net has address 111.111.111.111
cPanel: cPanel [9.4.0-RELEASE_21] () Copyright (c) 1997-2004 John N Koston. Licensed on host.hostname.net

2) If that does not contain the exact OS info what exact OS is it?
(IE RedHat9 instead of just Linux):

Looks like just GNU/Linux.

3) Who is your NOC:

EZZI.

4) cPanel Ticket Number (if applicable):

62980

5) Are there any firewalls between the client and server?

Yes, APF, but on or off makes no difference to FTP. Please feel free to try that on my box (details in ticket) if you wish to confirm it.

6) If so are their rules compatible with the FTP configuration on the server?

Yes. I have two other cPanel servers with the same ruleset and they work okay.

7) Does this command, as root via ssh, have any output?
cat /var/log/messages |grep DROP

Hundreds of them! That's the firewall doing its job.



Hope this helps.

 

[disoft]

I have to say that I'm still not convinced that this is a cPanel problem. I just don't know - my head exploded sometime yesterday.

 

[cPDan]

Sorry for the confusion, i realized that posting the info here wouldn't help as much as a bug report so...

Instead of posting it here you may want to take a look at http://bugzilla.cpanel.net/show_bug.cgi?id=772

That will allow us to track it better instead of a forum post.

Thanks

 

[microfx]

Hi,

It seems to be ezzi.net's deep packet inspection. They turned off deep packet inspection and FTP works fine now.

Matt