In my system FTP is running as nobody and is User:Group-> ftp:ftp
in your system it’s running as ftp:nogroup. That may cause it as it may not have the correct permissions?
This one is a red herring. It’s different on different operating systems. It’s just different user and group names. The fundamentals of how they work is the same.
We’d want to see the secure.log and possibly and proftpd logs.
I’m not aware of creating a virtual server or user called FTP.
Here are the proftpd logs.
Jun 16 01:52:49 mclaughlan.info proftpd[11551] parkwebwin-v01.prod.mesa1.secureserver.net: ProFTPD 1.3.1 (stable) (built Thu Feb 21 04:21:14 UTC 2008) standalone mode STARTUP
Jun 16 01:53:12 mclaughlan.info proftpd[11551] parkwebwin-v01.prod.mesa1.secureserver.net: ProFTPD killed (signal 15)
Jun 16 01:53:12 mclaughlan.info proftpd[11551] parkwebwin-v01.prod.mesa1.secureserver.net: ProFTPD 1.3.1 standalone mode SHUTDOWN
Jun 16 01:53:13 mclaughlan.info proftpd[13015] parkwebwin-v01.prod.mesa1.secureserver.net: ProFTPD 1.3.1 (stable) (built Thu Feb 21 04:21:14 UTC 2008) standalone mode STARTUP
Jun 16 04:11:34 mclaughlan.info proftpd[26556] parkwebwin-v01.prod.mesa1.secureserver.net (::ffff:95.154.210.61[::ffff:95.154.210.61]): FTP session opened.
Jun 16 04:11:34 mclaughlan.info proftpd[26557] parkwebwin-v01.prod.mesa1.secureserver.net (::ffff:95.154.210.61[::ffff:95.154.210.61]): FTP session opened.
Jun 16 04:11:35 mclaughlan.info proftpd[26557] parkwebwin-v01.prod.mesa1.secureserver.net (::ffff:95.154.210.61[::ffff:95.154.210.61]): FTP session closed.
Jun 16 04:11:35 mclaughlan.info proftpd[26556] parkwebwin-v01.prod.mesa1.secureserver.net (::ffff:95.154.210.61[::ffff:95.154.210.61]): FTP session closed.
Jun 16 05:00:17 mclaughlan.info proftpd[27388] parkwebwin-v01.prod.mesa1.secureserver.net (::ffff:77.240.118.43[::ffff:77.240.118.43]): FTP session opened.
Jun 16 05:00:17 mclaughlan.info proftpd[27388] parkwebwin-v01.prod.mesa1.secureserver.net (::ffff:77.240.118.43[::ffff:77.240.118.43]): FTP session closed.
Jun 16 05:00:17 mclaughlan.info proftpd[27389] parkwebwin-v01.prod.mesa1.secureserver.net (::ffff:77.240.118.43[::ffff:77.240.118.43]): FTP session opened.
Jun 16 05:00:17 mclaughlan.info proftpd[27389] parkwebwin-v01.prod.mesa1.secureserver.net (::ffff:77.240.118.43[::ffff:77.240.118.43]): FTP session closed.
Jun 16 21:54:30 mclaughlan.info proftpd[25801] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session opened.
Jun 16 21:54:30 mclaughlan.info proftpd[25801] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): USER admin: Login successful.
Jun 16 21:55:43 mclaughlan.info proftpd[25801] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session closed.
Jun 16 21:55:53 mclaughlan.info proftpd[25822] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session opened.
Jun 16 21:55:53 mclaughlan.info proftpd[25822] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): USER admin: Login successful.
Jun 16 21:56:42 mclaughlan.info proftpd[25822] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session closed.
Jun 16 21:56:52 mclaughlan.info proftpd[25823] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session opened.
Jun 16 21:56:52 mclaughlan.info proftpd[25823] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): SECURITY VIOLATION: root login attempted.
Jun 16 21:56:52 mclaughlan.info proftpd[25823] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session closed.
Jun 16 22:20:55 mclaughlan.info proftpd[26231] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session opened.
Jun 16 22:20:55 mclaughlan.info proftpd[26231] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): USER admin: Login successful.
Jun 16 22:21:40 mclaughlan.info proftpd[26232] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session opened.
Jun 16 22:21:40 mclaughlan.info proftpd[26232] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): USER admin: Login successful.
Jun 16 22:24:00 mclaughlan.info proftpd[26231] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session closed.
Jun 16 22:31:43 mclaughlan.info proftpd[26232] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP no transfer timeout, disconnected
Jun 16 22:31:43 mclaughlan.info proftpd[26232] parkwebwin-v01.prod.mesa1.secureserver.net (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session closed.
Jun 17 00:51:11 mclaughlan.info proftpd[30050] parkwebwin-v01.prod.mesa1.secureserver.net (s15313712.onlinehome-server.info[::ffff:87.106.54.138]): FTP session opened.
Jun 17 00:51:11 mclaughlan.info proftpd[30051] parkwebwin-v01.prod.mesa1.secureserver.net (s15313712.onlinehome-server.info[::ffff:87.106.54.138]): FTP session opened.
Jun 17 00:51:11 mclaughlan.info proftpd[30050] parkwebwin-v01.prod.mesa1.secureserver.net (s15313712.onlinehome-server.info[::ffff:87.106.54.138]): FTP session closed.
Jun 17 00:51:11 mclaughlan.info proftpd[30051] parkwebwin-v01.prod.mesa1.secureserver.net (s15313712.onlinehome-server.info[::ffff:87.106.54.138]): FTP session closed.
Jun 17 03:54:03 mclaughlan.info proftpd[13015] parkwebwin-v01.prod.mesa1.secureserver.net: ProFTPD killed (signal 15)
Jun 17 03:54:03 mclaughlan.info proftpd[13015] parkwebwin-v01.prod.mesa1.secureserver.net: ProFTPD 1.3.1 standalone mode SHUTDOWN
Jun 17 20:19:08 ns1.flirtsnflings.com proftpd[1667] 94.76.201.163: ProFTPD 1.3.1 (stable) (built Thu Feb 21 04:21:14 UTC 2008) standalone mode STARTUP
Jun 17 22:30:32 ns1.flirtsnflings.com proftpd[1667] 94.76.201.163: ProFTPD killed (signal 15)
Jun 17 22:30:32 ns1.flirtsnflings.com proftpd[1667] 94.76.201.163: ProFTPD 1.3.1 standalone mode SHUTDOWN
Jun 17 22:33:20 ns1.flirtsnflings.com proftpd[1664] ns1.flirtsnflings.com: ProFTPD 1.3.1 (stable) (built Thu Feb 21 04:21:14 UTC 2008) standalone mode STARTUP
Jun 17 22:46:25 ns1.flirtsnflings.com proftpd[1664] ns1.flirtsnflings.com: ProFTPD killed (signal 15)
Jun 17 22:46:25 ns1.flirtsnflings.com proftpd[1664] ns1.flirtsnflings.com: ProFTPD 1.3.1 standalone mode SHUTDOWN
Jun 17 22:49:22 ns1.flirtsnflings.com proftpd[1692] ns1.flirtsnflings.com: ProFTPD 1.3.1 (stable) (built Thu Feb 21 04:21:14 UTC 2008) standalone mode STARTUP
Jun 18 06:43:07 ns1.flirtsnflings.com proftpd[18012] ns1.flirtsnflings.com (::ffff:78.111.76.119[::ffff:78.111.76.119]): FTP session opened.
Jun 18 06:43:07 ns1.flirtsnflings.com proftpd[18013] ns1.flirtsnflings.com (::ffff:78.111.76.119[::ffff:78.111.76.119]): FTP session opened.
Jun 18 06:43:08 ns1.flirtsnflings.com proftpd[18012] ns1.flirtsnflings.com (::ffff:78.111.76.119[::ffff:78.111.76.119]): FTP session closed.
Jun 18 06:43:08 ns1.flirtsnflings.com proftpd[18013] ns1.flirtsnflings.com (::ffff:78.111.76.119[::ffff:78.111.76.119]): FTP session closed.
Jun 18 11:03:33 ns1.flirtsnflings.com proftpd[28045] ns1.flirtsnflings.com (s15313712.onlinehome-server.info[::ffff:87.106.54.138]): FTP session opened.
Jun 18 11:03:33 ns1.flirtsnflings.com proftpd[28044] ns1.flirtsnflings.com (s15313712.onlinehome-server.info[::ffff:87.106.54.138]): FTP session opened.
Jun 18 11:03:33 ns1.flirtsnflings.com proftpd[28045] ns1.flirtsnflings.com (s15313712.onlinehome-server.info[::ffff:87.106.54.138]): FTP session closed.
Jun 18 11:03:33 ns1.flirtsnflings.com proftpd[28044] ns1.flirtsnflings.com (s15313712.onlinehome-server.info[::ffff:87.106.54.138]): FTP session closed.
Jun 18 16:42:26 ns1.flirtsnflings.com proftpd[9844] ns1.flirtsnflings.com (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session opened.
Jun 18 16:42:26 ns1.flirtsnflings.com proftpd[9844] ns1.flirtsnflings.com (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): USER joomlaplazza: Login successful.
Jun 18 16:53:07 ns1.flirtsnflings.com proftpd[9844] ns1.flirtsnflings.com (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP no transfer timeout, disconnected
Jun 18 16:53:07 ns1.flirtsnflings.com proftpd[9844] ns1.flirtsnflings.com (82-41-170-249.cable.ubr03.linl.blueyonder.co.uk[::ffff:82.41.170.249]): FTP session closed.
Jun 18 18:54:27 ns1.flirtsnflings.com proftpd[13350] ns1.flirtsnflings.com (ip217-46-212-87.adsl2.static.versatel.nl[::ffff:87.212.46.217]): FTP session opened.
Jun 18 18:54:27 ns1.flirtsnflings.com proftpd[13350] ns1.flirtsnflings.com (ip217-46-212-87.adsl2.static.versatel.nl[::ffff:87.212.46.217]): FTP session closed.
Jun 18 23:13:13 ns1.flirtsnflings.com proftpd[1692] ns1.flirtsnflings.com: ProFTPD killed (signal 15)
Jun 18 23:13:13 ns1.flirtsnflings.com proftpd[1692] ns1.flirtsnflings.com: ProFTPD 1.3.1 standalone mode SHUTDOWN
cant find secure.log its not in /var/log/ that I see.
If you’re using Debian or Ubuntu, you may need to take a peek in /var/log/auth.log and /var/log/syslog, as they don’t use a logfile named “secure” by default.
-Eric
I dont think I want to post them openly on the forum as I can see from those logs Iv already been the victim of several attacks on the server with people trying to login with a lot of usernames and ports ect…
what should I be looking for in the log files.
What should you be looking for? Anything unusual 
I guess I’d try both starting up and connecting to FTP, and looking for messages in the logs that may relate to the problem you’re having.
Sorry, the problem could be anything, so it’s hard to say what specifically to look for 
-Eric
But that’s problem FTP wont start up. So surly trying to connect to FTP will just show as trying to connect to unknown service or something like that and Iv very little idea what most of the log entries mean so I wouldn’t know what’s unusual and whats not, Id need something specific to look for that might identify why proftp wont start!
Sure, then what you’d do is try launching FTP, and when it doesn’t work, it should immediately dump some info into the logs.
Unfortunately, the problem could be anything – so the best info I can offer is that look right after you try launching FTP, and hopefully you’ll see something odd in there, perhaps relating to FTP
-Eric
Still struggling with this issue! cant find anything dumped in the logs when it fails.
Is ununstalling and reinstalling proftp an option?
I would say yes, but then you may not know what the issue was and might appear again after reinstallation.
I may be able to have a look on friday or per haps Eric/Joe want to free up some time.
I tried to uninstall via the command line but it said the entire virtualmin tree would have to be removed. Is there a way to uninstall it from within virtualmin/webmin?
i think you can do with the --nodeps but joe/eric would know the exact way of removing proftp
Yeah, how to remove it would depend on the distro – I’m not sure I see which one we’re working with in the thread above.
It baffles me that this is happening at all though, I’m a bit suspicious that it’s a configuration issue outside of ProFTP.
In your first post, you mention a series of errors that pop up – I know you’ve attempted to correct some/all of those. So at this point, when you’re launching ProFTP, do any errors at all show up?
-Eric
hi eric
it’s a VPS that’s got Ubuntu 8.10 installed and has two ip addresses. I logged in once to fix the dns issues/hostname/networking, this all works fine afaik.
then there was a postfix issue which I fix by commenting #myorigin
I noticed then that ftp wouldn’t start and it complains it can not find a hostname. Per haps it is listening on the wrong IP for that hostname. No other errors show up
If it was my vps to play around with I would contemplate on reimageing it with centos and reinstall virtualmin. Initially the errors seemed due to not having a FQDN so I guess a lot of stuff has errors unknown at this time.
Im not sure were to look for with proftp and once it is fixed there may be other errors turning up later.
edit: intodns.com gives perfect results on the fqdn.
Is ununstalling and reinstalling proftp an option?
What useful thing would you expect that to do? (That’s my snarky way of saying, “I don’t think uninstalling and reinstalling is a useful use of your time”.)
That, of course, assumes you have a non-broken ProFTPd package. There are a number of broken proftpd packages in various third party repos for CentOS. If you have one of those, then you’d want to switch to ours which is known to work or the EPEL package (which I’m pretty sure also works).
It seems to have sorted itself out now!
I noticed an update package for SSH was available via virtualmin so I installed it and rebooted the server and now the proftp issues has gone…weird!
that is good news. likely the reboot fixed whatever was wrong with proftp.
I had tried rebooting before but it made no difference so dunno, as long as its working now.
actually just noticed that it changed my hostname back to the default name. But only the hostname it did’nt seem to alter any of the other settings we setup thankfully.