title: FTP user getting locked - What to check?
body: <p>This time I have another question. This one is related to FTP. We have an ftp server say 127.0.0.2. The application server is on ip say 127.0.0.1. From the application server, we connect to the FTP server every 10 minutes and pull or push certain files in the INWARD and OUTWARD folders respectively. </p>
  
  <p>The ftp server is running linux with the following details:</p>
  
  <pre><code>-bash-3.2$ uname -n
  ftpserver.companyname.com
  -bash-3.2$ uname
  Linux
  -bash-3.2$ uname -r
  2.6.18-308.13.1.el5
  </code></pre>
  
  <p>The problem is that the FTP user gets locked automatically on a random basis. Random meaning really random... This instance it is working but within the next 15 seconds it will get locked triggering of an alert and thus requiring user intervention to get it unlocked. </p>
  
  <p>To check when the locking is happening, we wrote a monitoring shell script to check the ftp connection every 15 seconds. This script will only connect to the ftp machine and quit. If everything is ok, it will not do anything but if connection fails it will mail the stake holders with the ftp log.</p>
  
  <p>SCRIPT >></p>
  
  <pre><code>ftp -niv $FTP_HOST &lt;&lt;END_SCRIPT &gt; $FTP_LOG
  quote USER $FTP_USER
  quote PASS $FTP_PASSWD
  quit
  END_SCRIPT
  </code></pre>
  
  <p>Now if we see the log generated from the script, we can see the below information:</p>
  
  <p>LOG >></p>
  
  <pre><code>::::: DATE/TIME = Wed Apr 23 17:35:00 UTC 2014 :::::
  Step 1 complete : Initialised log file ~/ftp_support_23_Apr_2014.log
  Step 2 complete : Completed check for ftp login
  FTP connection to 127.0.0.2 is ok.
  Step 3 completed. Deleted ftp.log
  
  ::::: DATE/TIME = Wed Apr 23 17:35:15 UTC 2014 :::::
  Step 1 complete : Initialised log file ~/ftp_support_23_Apr_2014.log
  Step 2 complete : Completed check for ftp login
  FTP user username is locked on 127.0.0.2.
  Step 3 completed. Deleted ftp.log
  
  ----- SAME OUTPUT AS ABOVE EVERY 15 SECONDS TILL USER IS UNLOCKED ------
  </code></pre>
  
  <p>Here the ftp user was unlocked by the SA.</p>
  
  <pre><code>::::: DATE/TIME = Wed Apr 23 17:41:40 UTC 2014 :::::
  Step 1 complete : Initialised log file ~/ftp_support_23_Apr_2014.log
  Step 2 complete : Completed check for ftp login
  FTP connection to 127.0.0.2 is ok.
  Step 3 completed. Deleted ftp.log
  </code></pre>
  
  <p>Now the question that we all have is what could have happened in 15 seconds causing the user to get locked? At 17:35:00 UTC the connection is ok, at 17:35:15 UTC, the connection goes dead. The log which is mailed to the stake holders is as below -</p>
  
  <p>MAILED FTP LOG >></p>
  
  <pre><code>Connected to 127.0.0.2.
  220 (vsFTPd 2.0.5)
  530 Please login with USER and PASS.
  530 Please login with USER and PASS.
  331 Please specify the password.
  530 Login incorrect.
  221 Goodbye.
  </code></pre>
  
  <p>Now we know for sure, that the password is read from a encrypted config file and used by the program. If it works every 10 mins, then there is no problem with the program sending the password to the ftp user. And any system user is not typing in the password incorrectly. Hence the question here is <strong>what do we need to check at our end?</strong> </p>
  
  <p>How do we interpret the <code>530 Login incorrect.</code> error message? Can anyone suggest what we have to do here? Has the SA changed any setting on the ftp server? What can we ask them to check at OS level or for the ftp service?</p>
  
  <p>If the output of any command is needed or if any running service needs to be checked, let me know.</p>