FTP Login is being refused ...

[#1]

Since I changed the time of collection of my WebStats (via a cron-jobbed-script)  to 0530 from an earlier time, I have been suffering from quite frequent refusals of the login. When this fails, of course the WebStats are not collected. This time I was away and so couldn't carry oput my usual daily check before processing them.

If you look at your security reports, you will see my failed FTP login at 0530 this morning. It also happened over two days last week.

So - can anyone tell me what's going on and why? And better still, correct it?

Thanks, in hope ...

Kenneth Spencer

[#2]

Possibly not the same issue, but I also cannot get into my FTP area.

ftp.plus.net always reports an incorrect password (even though it isn't, honest)

ccgi.<username>.plus.com is not responding at all.

The website pages are gone too, so I don't know if the content and space have been deleted?

Could this be something to do with moving from DSL to Fibre?

[#3]

Hi there, 

We're not aware of any issues relating to our FTP server. I've just tested using my own account details and could log in fine. I can't think of a reason why moving to fibre would cause an issue with this. 

Could you please both check if you're able to log in using a browser? (assuming you've been using an FTP client) edge/internet explorer should support that. 

[#4]

Thanks for the reply, Adam.

It is all a bit odd, although the fibre suspicion doesn't apply to me as I have been on PlusNet fibre since 2011 (and PlusNet itself sice 2003).

I will do some more checks of the scripts, although nothing has changed recently other than I shifted the cron-job time on to 0530 as I sometimes missed the webstat delivery if they ran a bit late. What is strange is that I can log in manually via my FTP client, and when I run the scripts by hand it all worked, including the scripted logs-in.

It seems to be the scripts which fail but definitely not every day - they worked on 1st - 3rd April, but not on the 7th or 8th. The time was unusual on the 4th & 5th. Unfortunately I was away for several days whilst this was going on - but there is no evidence of a crash or an Internet failure (but that is of course a possible reason).

I may say that the scripts have been running for years and years!

Thanks alot - don't spend too much non-productive time on the issue - I will check it all again tomorrow.

Kenneth Spencer

[#5]

Hi @kaspencer, I've discussed this with someone in the relevant team, they've advised that there aren't any issues with the FTP or webstat side of things that we're aware of, and as you're having no issues running the scripts manually,  that it's quite likely whatever is being used to automate the scripts is likely the cause.

[#6]

Thanks Lauren ...

... - in that case the plot thickens!

This morning all was well, and everything functioned as it has done for several years.

I have checked my router logs (which I retain indefinitely) for disconnections on the failure days around 0500-0600 and none occurred. The scripts are unchanged. The cron-jobs are unchanged. The password is unchanged (it is actually a password error which was reported to be the cause of the failure in all of these recent incidents).

Could the server be slow to accept a log-in sometimes?
Your server does get the request for a login, and clearly refuses.
Could I send you (in confidence) an example of my logs produced by my scripts demonstrating what happens with success and failure?
Do you have a record of failed logs-in?
It would be good to get a resolution ...

Best wishes

Kenneth Spencer

[#7]

Hi @kaspencer, thanks for getting back to us.

Could the server be slow to accept a log-in sometimes?

Potentially yes, although as mentioned there are no widespread issues that we're aware of. If you haven't noticed this problem until changing the automated cronjob it does seem to be related to the change somewhat. Have you reverted back to the previous time this cronjob executed at all to see if the login issue persists?
 

Could I send you (in confidence) an example of my logs produced by my scripts demonstrating what happens with success and failure?

Of course, feel free to PM me at your convenience.

Do you have a record of failed logs-in? 

I'm not 100% sure but will happily find out upon speaking with relevant team in regards to your bounce back messages.
 

[#8]

@kaspencer, I've refreshed your FTP credentials at this side. No guarantee it will help, but it's worth a shot. 

[#9]

Thanks Bob and Oscar.

I have sent Oscar two days of the LOG of my Webstat Retrievals by PM.

Today it all worked, as it also did yesteday. You probably do have a record of the failed login which might reveal why ot failed.

Thanks,

Kenneth Spencer

[#10]

Thanks a lot Kenneth, we're glad to see that resolved it for you. Please let us know if there's anything else we can help with. - Adam 

[@LaurenB]

I am sorry (very sorry actually) to report that assumptions that my FTP login issues were resolved were in error.

This morning, my script ran in the usual way at the usual time, but the login failed. here is the top of the log which my script generates:

.
Processing of webstats started at Monday, 20190415 05:30:01.
Connected to homepages.plus.net.
220-PLEASE NOTE: If you have a non-subscription account you
 will only be able to login to this ftp server if you are
 dialled into our network.
 
 A Maximum of 4 concurrent connections are allowed to this
 server, each session is limited to 256KB/s downloads.
 
220 Plus.Net FTP Server #1 ready
331 Password required for kaspencer
530 Login incorrect.
Login failed.
Local directory now /media/seagate_2tb/Data/Data_I/SHEETS/kaspencer/raw_logs
530 Please login with USER and PASS
local: www.kaspencer.com.gz remote: www.kaspencer.com.gz
530 Please login with USER and PASS
local: www.atworth.org.uk.gz remote: www.atworth.org.uk.gz
530 Please login with USER and PASS
221 Goodbye.
[... rest of log is not relevant to this issue...]

So PLEASE,  @LaurenB,  @bobpullen @OskarPapa @adamwalker, could you look again at this and have it resolved asap. Obviously something is not working as it should, and it really doesn't seem to be at my end, as this script has been running daily and has only failed due to issues at your end.

So, over to you ...

Kenneth Spencer

[#12]

I can see the error in the logs:

2019-04-15 05:30:03,458 homepagesv06 proftpd[13634] 84.93.228.145 (84.93.228.38[84.93.228.38]): USER [REDACTED]: no such user found from 84.93.228.38 [84.93.228.38] to 84.93.228.145:5024

Looking back, first instance seen is from March 10th (although that said, the logs only go back to Feb).

Looking at total volume of these events across all traffic doesn't indicate anything widespread (but that's not an overly conclusive view, to be honest)

This isn't something I'm able to look into further at the moment I'm afraid so one of the guys will need to raise it with our ops team to take a look at.

[#13]

Thanks for the assist with this one @bobpullen.

@kaspencer  - As per Bobs suggestion, I've raised the task with our NetOps team for further investigation.

I'll be notified with any updates, at which point, I'll contact you directly either via Community or via the ticket I've just opened. If you do need anything else in the meantime, please don't hesitate to get back in touch.

[#14]

@forum_user, forgot to mention: I've fixed your CGI space as well. It was a problem with your DNS records so I expect it will spring back into life tomorrow.

[#15]

Thanks, @bobpullen - I'll let you know how it goes tomorrow and into the future.

I ran the scripts manually to get the webstats earlier today and it worked. So its a bit strange that it only fails sometimes. Or perhaps its not strange if you know what's actually happening.

Thanks

Kenneth Spencer