proftpd

[root@server24974 sotariz]# cat /etc/redhat-release 
CentOS release 6.5 (Final)
[root@server24974 sotariz]# rpm -qa | grep proftpd
proftpd-1.3.4a-1.el6.rf.x86_64

sotariz@sotariz ~ $ ftp atieye 
Connected to atieye.
220 FTP Server ready.
Name (atieye:sotariz): alexg
331 Password required for alexg
Password:
530 Login incorrect.
Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.

[root@server24974 sotariz]# proftpd -nd10
server24974.localhost.com proftpd[22903]: using TCP receive buffer size of 87380 bytes
server24974.localhost.com proftpd[22903]: using TCP send buffer size of 65536 bytes
server24974.localhost.com proftpd[22903]: testing Unix domain socket using S_ISFIFO
server24974.localhost.com proftpd[22903]: testing Unix domain socket using S_ISSOCK
server24974.localhost.com proftpd[22903]: using S_ISSOCK macro for Unix domain socket detection
server24974.localhost.com proftpd[22903]: mod_tls/2.4.3: using OpenSSL 1.0.0-fips 29 Mar 2010
server24974.localhost.com proftpd[22903]: retrieved UID 99 for user 'nobody'
server24974.localhost.com proftpd[22903]: retrieved GID 99 for group 'nobody'
server24974.localhost.com proftpd[22903]: UseReverseDNS off, returning IP address instead of DNS name
server24974.localhost.com proftpd[22903] 10.10.10.1: 
server24974.localhost.com proftpd[22903] 10.10.10.1: Config for ProFTPD server:
server24974.localhost.com proftpd[22903] 10.10.10.1: ServerIdent
server24974.localhost.com proftpd[22903] 10.10.10.1: DefaultServer
server24974.localhost.com proftpd[22903] 10.10.10.1: AccessGrantMsg
server24974.localhost.com proftpd[22903] 10.10.10.1: DeferWelcome
server24974.localhost.com proftpd[22903] 10.10.10.1: DefaultRoot
server24974.localhost.com proftpd[22903] 10.10.10.1: AuthPAMConfig
server24974.localhost.com proftpd[22903] 10.10.10.1: AuthOrder
server24974.localhost.com proftpd[22903] 10.10.10.1: IdentLookups
server24974.localhost.com proftpd[22903] 10.10.10.1: Umask
server24974.localhost.com proftpd[22903] 10.10.10.1: ListOptions
server24974.localhost.com proftpd[22903] 10.10.10.1: AllowRetrieveRestart
server24974.localhost.com proftpd[22903] 10.10.10.1: AllowStoreRestart
server24974.localhost.com proftpd[22903] 10.10.10.1: UserID
server24974.localhost.com proftpd[22903] 10.10.10.1: UserName
server24974.localhost.com proftpd[22903] 10.10.10.1: GroupID
server24974.localhost.com proftpd[22903] 10.10.10.1: GroupName
server24974.localhost.com proftpd[22903] 10.10.10.1: UseSendfile
server24974.localhost.com proftpd[22903] 10.10.10.1: Limit
server24974.localhost.com proftpd[22903] 10.10.10.1:  AllowAll
server24974.localhost.com proftpd[22903] 10.10.10.1: AllowOverwrite
server24974.localhost.com proftpd[22903] 10.10.10.1: ROOT PRIVS at mod_delay.c:425
server24974.localhost.com proftpd[22903] 10.10.10.1: RELINQUISH PRIVS at mod_delay.c:430
server24974.localhost.com proftpd[22903] 10.10.10.1: retrieved group ID: 99
server24974.localhost.com proftpd[22903] 10.10.10.1: setting group ID: 99
server24974.localhost.com proftpd[22903] 10.10.10.1: SETUP PRIVS at main.c:3325
server24974.localhost.com proftpd[22903] 10.10.10.1: ROOT PRIVS at main.c:2295
server24974.localhost.com proftpd[22903] 10.10.10.1: RELINQUISH PRIVS at main.c:2304
server24974.localhost.com proftpd[22903] 10.10.10.1: ROOT PRIVS at main.c:2662
server24974.localhost.com proftpd[22903] 10.10.10.1: opening scoreboard '/var/run/proftpd.score'
server24974.localhost.com proftpd[22903] 10.10.10.1: RELINQUISH PRIVS at main.c:2688
server24974.localhost.com proftpd[22903] 10.10.10.1: ROOT PRIVS at mod_ctrls.c:1209
server24974.localhost.com proftpd[22903] 10.10.10.1: RELINQUISH PRIVS at mod_ctrls.c:1211
server24974.localhost.com proftpd[22903] 10.10.10.1: ROOT PRIVS at inet.c:347
server24974.localhost.com proftpd[22903] 10.10.10.1: RELINQUISH PRIVS at inet.c:410
server24974.localhost.com proftpd[22903] 10.10.10.1: ProFTPD 1.3.4a (maint) (built Fri Jan 20 2012 17:30:05 EST) standalone mode STARTUP
server24974.localhost.com proftpd[22903] 10.10.10.1: ROOT PRIVS at pidfile.c:47
server24974.localhost.com proftpd[22903] 10.10.10.1: RELINQUISH PRIVS at pidfile.c:49
server24974.localhost.com proftpd[22903] 10.10.10.1: ROOT PRIVS at mod_ctrls.c:707
server24974.localhost.com proftpd[22903] 10.10.10.1: RELINQUISH PRIVS at mod_ctrls.c:711
server24974.localhost.com proftpd[22911] 10.10.10.1: ROOT PRIVS at main.c:1261
server24974.localhost.com proftpd[22911] 10.10.10.1: RELINQUISH PRIVS at main.c:1265
server24974.localhost.com proftpd[22911] 10.10.10.1: no matching vhost found for ::ffff:СКРЫТ#21, using 'ProFTPD server' listening on wildcard address
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): ROOT PRIVS at main.c:1076
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): SETUP PRIVS at main.c:1081
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): session requested from client in unknown class
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): performing module session initializations
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): mod_cap/1.1: adding CAP_AUDIT_WRITE capability
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): mod_ident/1.0: ident lookup disabled
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): ROOT PRIVS at mod_delay.c:1650
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): RELINQUISH PRIVS at mod_delay.c:1655
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): ROOT PRIVS at mod_auth.c:129
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): opening scoreboard '/var/run/proftpd.score'
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): RELINQUISH PRIVS at mod_auth.c:131
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): AuthOrder in effect, resetting auth module order
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): connected - local  : ::ffff:109.75.163.144:21
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): connected - remote : СКРЫТ:45180
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): FTP session opened.
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'USER alexg' to mod_tls
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'USER alexg' to mod_core
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'USER alexg' to mod_core
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'USER alexg' to mod_delay
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'USER alexg' to mod_auth
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching CMD command 'USER alexg' to mod_auth
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching POST_CMD command 'USER alexg' to mod_delay
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching LOG_CMD command 'USER alexg' to mod_log
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'PASS (hidden)' to mod_tls
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'PASS (hidden)' to mod_core
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'PASS (hidden)' to mod_core
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'PASS (hidden)' to mod_delay
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'PASS (hidden)' to mod_auth
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching CMD command 'PASS (hidden)' to mod_auth
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): retrieved UID 506 for user 'alexg'
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): retrieved group IDs: 506, 50
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): retrieved group names: alexg, ftp
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): ROOT PRIVS at mod_auth_pam.c:311
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): RELINQUISH PRIVS at mod_auth_pam.c:481
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): USER alexg (Login failed): Incorrect password.
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching POST_CMD_ERR command 'PASS (hidden)' to mod_delay
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_log
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching LOG_CMD_ERR command 'PASS (hidden)' to mod_auth
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'SYST' to mod_tls
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'SYST' to mod_core
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching PRE_CMD command 'SYST' to mod_core
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching CMD command 'SYST' to mod_core
server24974.localhost.com proftpd[22911] 10.10.10.1 (СКРЫТ[СКРЫТ]): dispatching LOG_CMD command 'SYST' to mod_log

[root@server24974 home]# cat /etc/proftpd.conf
# This is the ProFTPD configuration file
# $Id: proftpd.conf,v 1.1 2004/02/26 17:54:30 thias Exp $
ServerName            "ProFTPD server"
ServerIdent            on "FTP Server ready."
ServerAdmin            root@localhost
ServerType            standalone
#ServerType            inetd
DefaultServer            on
AccessGrantMsg            "User %u logged in."
#DisplayConnect            /etc/ftpissue
#DisplayLogin            /etc/ftpmotd
#DisplayGoAway            /etc/ftpgoaway
DeferWelcome            off
# Use this to excude users from the chroot
DefaultRoot            ~ !adm
# Use pam to authenticate (default) and be authoritative
AuthPAMConfig            proftpd
AuthOrder            mod_auth_pam.c* mod_auth_unix.c
# Do not perform ident nor DNS lookups (hangs when the port is filtered)
IdentLookups            off
UseReverseDNS            off
# Port 21 is the standard FTP port.
Port                21
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask                022
# Default to show dot files in directory listings
ListOptions            "-a"
# See Configuration.html for these (here are the default values)
#MultilineRFC2228        off
#RootLogin            off
#LoginPasswordPrompt        on
#MaxLoginAttempts        3
#MaxClientsPerHost        none
#AllowForeignAddress        off    # For FXP
# Allow to resume not only the downloads but the uploads too
AllowRetrieveRestart        on
AllowStoreRestart        on
# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances            20
# Set the user and group that the server normally runs at.
User                nobody
Group                nobody
# Disable sendfile by default since it breaks displaying the download speeds in
# ftptop and ftpwho
UseSendfile            no
# This is where we want to put the pid file
ScoreboardFile            /var/run/proftpd.score
# Normally, we want users to do a few things.
<Global>
  AllowOverwrite        yes
  <Limit ALL SITE_CHMOD>
    AllowAll
  </Limit>
</Global>
# Define the log formats
LogFormat            default    "%h %l %u %t \"%r\" %s %b"
LogFormat            auth    "%v [%P] %h %t \"%r\" %s"
# TLS
# Explained at http://www.castaglia.org/proftpd/modules/mod_tls.html
#TLSEngine            on
#TLSRequired            on
#TLSRSACertificateFile        /etc/pki/tls/certs/proftpd.pem
#TLSRSACertificateKeyFile    /etc/pki/tls/certs/proftpd.pem
#TLSCipherSuite            ALL:!ADH:!DES
#TLSOptions            NoCertRequest
#TLSVerifyClient        off
##TLSRenegotiate        ctrl 3600 data 512000 required off timeout 300
#TLSLog                /var/log/proftpd/tls.log
# SQL authentication Dynamic Shared Object (DSO) loading
# See README.DSO and howto/DSO.html for more details.
#<IfModule mod_dso.c>
#   LoadModule mod_sql.c
#   LoadModule mod_sql_mysql.c
#   LoadModule mod_sql_postgres.c
#</IfModule>
# A basic anonymous configuration, with an upload directory.
#<Anonymous ~ftp>
#  User                ftp
#  Group                ftp
#  AccessGrantMsg        "Anonymous login ok, restrictions apply."
#
#  # We want clients to be able to login with "anonymous" as well as "ftp"
#  UserAlias            anonymous ftp
#
#  # Limit the maximum number of anonymous logins
#  MaxClients            10 "Sorry, max %m users -- try again later"
#
#  # Put the user into /pub right after login
#  #DefaultChdir            /pub
#
#  # We want 'welcome.msg' displayed at login, '.message' displayed in
#  # each newly chdired directory and tell users to read README* files. 
#  DisplayLogin            /welcome.msg
#  DisplayFirstChdir        .message
#  DisplayReadme            README*
#
#  # Some more cosmetic and not vital stuff
#  DirFakeUser            on ftp
#  DirFakeGroup            on ftp
#
#  # Limit WRITE everywhere in the anonymous chroot
#  <Limit WRITE SITE_CHMOD>
#    DenyAll
#  </Limit>
#
#  # An upload directory that allows storing files but not retrieving
#  # or creating directories.
#  <Directory uploads/*>
#    AllowOverwrite        no
#    <Limit READ>
#      DenyAll
#    </Limit>
#
#    <Limit STOR>
#      AllowAll
#    </Limit>
#  </Directory>
#
#  # Don't write anonymous accesses to the system wtmp file (good idea!)
#  WtmpLog            off
#
#  # Logging for the anonymous transfers
#  ExtendedLog        /var/log/proftpd/access.log WRITE,READ default
#  ExtendedLog        /var/log/proftpd/auth.log AUTH auth
#
#</Anonymous>

RequireValidShell off

/bin/false