DSM-G600, DNS-3xx and NSA-220 Hack Forum

After spending several days getting reacquainted with my old friend linux I've both experienced this issue and seen many others on the web have the same message as johnx
The fix is to take shadowandy's script on his site (or your own pure-ftpd script) and add the -l unix (that's lower case L) to the pure-ftpd command you are executing
"correct" version of shadowandy's command:
pure-ftpd -P ${ip_add} -p ${pureftp_passive} -S ,${pureftp_ftpport} -A -B -C 10 -I 2 -E -l unix -T ${pureftp_bandwidth}

the reason is whoever compiled pure-ftpd on dns-343 (i don't know about 323 or any other DNS or DNS-like server) included PAM support. After a cursory glance and maybe noobish assumption, it seems that PAM shared objects were statically linked to some original creator's home directory.

After enabling syslogd (thank you so much for including this in fun_plug!!) showed that a user logged in and suddenly there were several lines of PAM objects and directories not being found.

Jun 22 20:49:03 Fileserver ftp.info pure-ftpd: (?@192.168.1.106) [INFO] New connection from 192.168.1.106
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM unable to dlopen(/home/jerry/gmail343_321/linuxpam/lib/security/pam_listfile.so)
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM [error: /home/jerry/gmail343_321/linuxpam/lib/security/pam_listfile.so: cannot open shared object file: No such file or directory]
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM adding faulty module: /home/jerry/gmail343_321/linuxpam/lib/security/pam_listfile.so
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM unable to dlopen(/home/jerry/gmail343_321/linuxpam/lib/security/pam_unix.so)
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM [error: /home/jerry/gmail343_321/linuxpam/lib/security/pam_unix.so: cannot open shared object file: No such file or directory]
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM adding faulty module: /home/jerry/gmail343_321/linuxpam/lib/security/pam_unix.so
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM unable to dlopen(/home/jerry/gmail343_321/linuxpam/lib/security/pam_shells.so)
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM [error: /home/jerry/gmail343_321/linuxpam/lib/security/pam_shells.so: cannot open shared object file: No such file or directory]
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM adding faulty module: /home/jerry/gmail343_321/linuxpam/lib/security/pam_shells.so
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM unable to dlopen(/home/jerry/gmail343_321/linuxpam/lib/security/pam_nologin.so)
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM [error: /home/jerry/gmail343_321/linuxpam/lib/security/pam_nologin.so: cannot open shared object file: No such file or directory]
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM adding faulty module: /home/jerry/gmail343_321/linuxpam/lib/security/pam_nologin.so
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: PAM _pam_init_handlers: no default config /etc/pam.d/other
Jun 22 20:49:03 Fileserver authpriv.debug pure-ftpd: pam_winbind(pure-ftpd:auth): getting password (0x00000000)
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: pam_winbind(pure-ftpd:auth): pam_winbind_request: write to socket failed!
Jun 22 20:49:03 Fileserver authpriv.err pure-ftpd: pam_winbind(pure-ftpd:auth): internal module error (retval = 3, user = 'ftpuser')
Jun 22 20:49:03 Fileserver ftp.warn pure-ftpd: (?@192.168.1.106) [WARNING] Authentication failed for user [ftpuser]
Jun 22 20:49:08 Fileserver ftp.info pure-ftpd: (?@192.168.1.106) [INFO] Logout.

Pure-ftpd's page indicated that if PAM support was enabled, this form of authentication would be tried FIRST. The site's FAQ page was misleading to me when it stated "every method is tried in order" but it was referring to chaining together methods of authentication. The butter zone was struck when I read the next section

If you don't specify any -l option, PAM is assumed by default if the server
is compiled with PAM support and Unix is assumed by default otherwise.

Thus if you receive the following error

Status:    Connection established, waiting for welcome message...
Response:    220---------- Welcome to Pure-FTPd [TLS] ----------
Response:    220-You are user number 2 of 4 allowed.
Response:    220-Local time is now 10:13. Server port: 20021.
Response:    220-This is a private system - No anonymous login
Response:    220 You will be disconnected after 2 minutes of inactivity.
Command:    USER XXXXXX
Response:    331 User XXXXXX OK. Password required
Command:    PASS *******
Response:    530 Login authentication failed

you MUST specify -l unix to use your /etc/passwd instead of the unavailable PAM modules

sorry for the lengthy post but i wanted to make very sure that no one else runs into this issue again

P.S. to Jerry, from the logs, I want my five days back I spent researching this

DNS-343