Home / server / Questions / 710386
In Process
kockiren
Asked: 2015-08-03 23:01:27 +0800 CST

How to find difference in sending passwords to ProFTPD

  • 772

There is a CentOS Server with proftpd installed, that works for a long time. Now I create a user the right way as the last time and check it with ftp command on windows CMD and it works. 

/etc/proftpd/ftpasswd --passwd --name newuser --uid 9999 --home /var/ftp/newuser --shell /bin/false

Now the new user try to connect with the new created credentials to the server and get a password incorrect. So I retry with the builtin ftp Client from windows an can connect to the Server. The new user use the windows explorer to connect to the FTP Server. I try it too and get a password incorrect too.

Maybe it is a encoding problem while transfer the password to the server. How can I debug it? The Auth log of proftpd didn't show a hint what goes wrong. I try serval FTP Clients and all tested works fine but not the Explorer FTP Client.

The log from the windows explorer FTP Client

FTP Server [18783] ::ffff:xx.xx.xx.xx [31/Jul/2015:17:53:44 +0200] "USER newuser" 331
FTP Server [18783] ::ffff:xx.xx.xx.xx [31/Jul/2015:17:53:44 +0200] "PASS (hidden)" 530

The log from same machine with builtin cmd ftp command:

FTP Server [19016] ::ffff:xx.xx.xx.xx [31/Jul/2015:17:55:03 +0200] "USER newuser" 331
FTP Server [19016] ::ffff:xx.xx.xx.xx [31/Jul/2015:17:55:03 +0200] "PASS (hidden)" 230

I enter the password serval times with copy and paste and typed it manually. How can I check the transferred password?

Update: On Client side I have to run wireshark and show that the password is send correctly. In the FTP Packets there is everything fine. This is the Wireshark protocol from the windows explorer. The only difference to the builtin FTP Client is the request for user anonymous.

Response: 220 ProFTPD 1.3.3g Server
Request: USER anonymous
Response: 331 Password required for anonymous
Request: PASS User@
Response: 530 Login incorrect.
Response: 220 ProFTPD 1.3.3g Server
Request: USER newuser
Response: 331 Password required for newuser
Request: PASS secret
Response: 530 Login incorrect

The same machine with the builtin ftp client give this output:

Response: 220 ProFTPD 1.3.3g Server
Request: USER newuser
Response: 331 Password required for newuser
Request: PASS secret
Response: 230 User newuser logged in
windows

1 Answers

  1. You could use tcpdump to capture the packets from the wire to a file then analyse them. That should tell you exactly what is being sent.

    • 0