ACZoom  ·  Archive-2016

Hi, I'm also getting this problem. VSFTPd hangs immediately after login.

I've installed using BlockHosts-1.0.3-1.noarch.rpm and used the sample /etc/hosts.allow file listed in http://www.aczoom.com/tools/blockhosts/INSTALL . I have NOT altered /etc/blockhosts.cfg .

The only thing I have changed is that I have added vsftp and --debug in the hosts.allow file, thus:

sshd, proftpd, in.proftpd, vsftpd: ALL: spawn (/usr/bin/blockhosts.py --verbose --debug --echo "%c-%s" >> /var/log/blockhosts.log 2>&1 )& : allow

FTP sessions then hang after the client enters the password, thus:

$ ftp thoth.nam-vets.org
Connected to thoth.nam-vets.org (82.163.126.22).
220 (vsFTPd 1.2.1)
Name (thoth.nam-vets.org:aoakley): aoakley
331 Please specify the password.
Password:
(Hangs forever here until I hit ^z)
[1]+ Stopped ftp thoth.nam-vets.org

Here are the results of my /var/log/blockhosts.log file:

blockhosts 1.0.3 started: 2006-02-14 10:54:55
... echo tag: 207.210.77.4-vsftpd@192.168.0.253
return ("<%s at 0x%x: %r>"
Debug mode enabled.
from config file, got logfiles: ('/var/log/secure',)
File lock obtained (/tmp/blockhosts.lock) for excluding other instances
1: got line: # allowed to use the local INET services, as decided
1: got line: # by the '/usr/sbin/tcpd' server.
1: got line: ALL: 192.168.0. : allow
1: got line: # Always allow from MessageLabs/Star
1: got line: ALL: 62.231.149. : allow
1: got line: #---- BlockHosts Additions
... seen all state 1 lines, now inside blockhosts markers at offset 282
2: ignore line ALL: 71.198.151.6 : deny
2: got host-count-date 69.36.185.183 2 2006-02-14 10:27:00
2: got host-count-date 71.198.151.6 1569 2006-02-14 10:23:00
2: found logfile name line: /var/log/secure
... found both markers, count of hosts being watched: 2
block-file: Got previous abusive hosts data:
{'71.198.151.6': HostData(1569, datetime.datetime(2006, 2, 14, 10, 23)), '69.36.185.183': HostData(2, datetime.datetime(2006, 2, 14, 10, 27))}
-------------------
block-file: Got remaining lines:
['\n', '# Command to execute the blockhosts script\n', '# Denies access to IPs who repeatedly get SSH/FTP passwords wrong\n', 'sshd, proftpd, in.proftpd, vsftpd: ALL: spawn (/usr/bin/blockhosts.py --verbose --debug --echo "%c-%s" >> /var/log/blockhosts.log 2>&1 )& : allow\n']
-------------------
------- looking into log file: /var/log/secure
SecureLog open:
first_line: Feb 12 05:14:00 thoth vsftpd[9681]: pam_succeed_if: requirement "uid < 100" not met by user "aoakley"
file length: 291133
... securelog, loading: /var/log/secure 291133
------- finished looking into log file: /var/log/secure
------- collecting block file updates ---
Collecting abusive_hosts counts info for block-file
Collecting log file offset info for block-file
... updates: counts: hosts to block: 1; hosts being watched: 2

If I remove vsftpd from the hosts.allow blockhosts.py line then this problem goes away- FTP clients log in and can work with no problems. Any hints much appreciated, thanks.

The original posting was missing <user> and <host> after the ?P due to forum software display issues, now fixed it, if you cut-n-paste the regexp again, should work fine now.

Same thing happening here, I get lots of ftp attacks and was hoping blockhosts would stop them. With this line:

vsftpd: ALL: spawn (/usr/bin/blockhosts.py --verbose --mail --echo "%c-%s" --check-ip "%h" >> /var/log/blockhosts.log 2>&1 )& : allow

ftp login attempts just time out after sending the password. With this line:

vsftpd: ALL: spawn (/bin/echo "Testing: %c-%s" >> /var/log/blockhosts.log 2>&1 )& : allow

I get "Service not available" when trying to connect.

The logs make it appear that blockhost is indeed completing its job.

With no vsftpd: line, ftp connects just fine.

Would running /usr/bin/blockhosts.py --verbose --mail --echo "%c-%s" --check-ip "%h" >> /var/log/blockhosts.log in a cron every minute instead of in hosts.allow be a possible workarond? I would rather not do that, but if it's the only way to make it work with vsftp...