Red Hat Enterprise Linux Diagnostics and Troubleshooting

Instructions

Despite the security risks, your company provides authenticated FTP access to home directories on the serverb system. After a recent change, users report that they cannot log in to the FTP server. You are tasked to restore authenticated FTP access. Use the ftpuser account with the redhat password to troubleshoot the issue.

1. Log in to the servera system and switch to the root user.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...
   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]#

2. Attempt to log in to the FTP server.

   1. Run the lftp command to log in as the ftpuser user.

      [root@servera ~]# lftp ftpuser@serverb.lab.example.com
      Password: redhat
      lftp ftpuser@serverb.lab.example.com:~>

   2. FTP servers authenticate users only when they execute a command. Run an ls command to cause the authentication attempt and error. Do not exit the lftp prompt.

      lftp ftpuser@serverb.lab.example.com:~> ls
      ls: Login failed: 530 Login incorrect.

3. Gather more troubleshooting information.

   1. From the workstation system, open a second terminal. Log in to the serverb system and switch to the root user.

      [student@workstation ~]$ ssh student@serverb
      ...output omitted...
      [student@serverb ~]$ sudo -i
      [sudo] password for student: student
      [root@serverb ~]#

   2. View the /var/log/secure file to locate FTP-related authentication errors.

      The log file indicates a problem with the vsftpd PAM configuration file.

      [root@serverb ~]# tail -n 10 /var/log/secure
      ...output omitted...
      Nov  8 12:03:52 server vsftpd[2010]: PAM unable to resolve symbol: pam_sm_acct_mgmt
      ...output omitted...

   3. Verify if any files that belong to the vsftpd package changed since installation.

      The output indicates that the vsftpd PAM configuration changed.

      [root@serverb ~]# rpm -V vsftpd
      S.5....T.  c /etc/pam.d/vsftpd

4. Restore the vsftpd PAM configuration file. Keep a backup of the broken file.

   1. Rename the broken file.

      [root@serverb ~]# mv /etc/pam.d/vsftpd{,.broken}

   2. Reinstall the vsftpd package.

      [root@serverb ~]# yum reinstall vsftpd

      Note

      The broken file is moved, not copied, because the yum command by default does not overwrite configuration files when reinstalling. The broken file would remain if the cp command was used.

5. Test whether authenticated FTP access is restored, and then analyze why the modified PAM configuration file did not work.

   1. On the servera system, test whether authenticated FTP access is restored.

      lftp ftpuser@serverb.lab.example.com:~> ls
      -rw-r--r--    1 0        0          12 Feb 17 12:05 README.txt

      Note

      If the authentication error persists, then exit the lftp prompt and reconnect to the FTP server.

   2. On the serverb system, compare the /etc/pam.d/vsftpd and /etc/pam.d/vsftpd.broken files.

      [root@serverb ~]# diff -u /etc/pam.d/vsftpd{,.broken}
      ...output omitted...
      +account    required    pam_ftp.so
      ...output omitted...

      The broken file has an extra requirement to use the pam_ftp.so module.

   3. Read the pam_ftp module's documentation to determine why it caused an authentication error.

      [root@serverb ~]# man pam_ftp

      According to the man page, the pam_ftp.so module provides anonymous FTP access. However, the module is available for use only in auth rules and not in account rules.

6. Exit the second terminal. Return to workstation as the student user.

   [root@serverb ~]# exit
   [student@serverb ~]$ exit
   [student@workstation ~]$ exit

   lftp ftpuser@serverb.lab.example.com:~> exit
   [root@servera ~]# exit
   [student@servera ~]$ exit
   [student@workstation ~]$