[Proftpd-user] Exceptional slowness and lost connections 1.3.6b vs 1.3.5e

We've been using 1.3.5e for a long time without issue. However when we
attempted to shift to 1.3.6b many of our users are suddenly unable to
complete their authentications and timing out, and those that can get
that far encounter exceptionally long lags on doing simple 'dir/ls'
commands, on the order of 2-4 minutes to get returns. These problems
cease as soon as we fail back to 1.3.5e, so it is not something with
our network or firewalls.

The configuration file used is the same one, it's not two different
identical files, it is literally the same file. Other than sanitizing
it for IP addresses and names (and pulling out comments) it is posted
below.

The system in question is running CentOS 6.10 (Final) with the latest
kernel, 2.6.32-754.24.3.el6.x86_64.

The two versions were built the same way other than the --prefix
statement, e.g.:

1.3.5e (config.log)
  $ ./configure --enable-openssl
--with-modules=mod_wrap:mod_rewrite:mod_ifsession:mod_sftp:mod_tls
--prefix=/panfs-pps/local/proftpd-1.3.5e-ftps


1.3.6b (config.log)
  $ ./configure --enable-openssl
--with-modules=mod_wrap:mod_rewrite:mod_ifsession:mod_sftp:mod_tls
--prefix=/panfs-pps/local/proftpd-1.3.6b-ftps

Here is the config file for the site:
---------------------------------------------------------------------------------------------------------------------------
ServerName        "Open"
ServerType        standalone
DefaultServer        on
ServerIdent       on "FTP Server ready"
PidFile /PANFS/local/ha_scripts/web/proftpd/var/run/web_proftpd.pid
ScoreboardFile /PANFS/local/ha_scripts/web/proftpd/var/run/web_proftpd.scoreboard
DelayTable /PANFS/local/ha_scripts/web/proftpd/var/run/web_proftpd.delay
DeferWelcome    off
Port        21
Umask                   002
TimeoutLogin            120
TimeoutIdle             300
TimeoutNoTransfer       600
TimeoutStalled          1800
PassivePorts            64000 65000
AllowForeignAddress off
UseIPv6        on
UseReverseDNS   off
IdentLookups   off
MaxInstances         300
User           nobody
Group          nobody
DefaultRoot ~ virtftp
DefaultRoot ~ eosdis
AllowOverwrite    on
TransferLog     /var/log/proftpd/distribution_xferlog
LogFormat   default "%h %l %u %t \"%r\" %s %b"
LogFormat   auth    "%v [%P] %h %t \"%r\" %s"
LogFormat   write   "%h %l %u %t \"%r\" %s %b"
LogFormat   full    "%{%Y%m%d:%T:%Z}t|%h|%v|%P|\"%r\"|%F|%s|%b|"
LogFormat   fulluser    "%{%Y%m%d:%T:%Z}t|%h|%U|%P|\"%r\"|%F|%s|%b|"
LogFormat   debug "%{%Y%m%d:%T:%Z}t|%h||%P|\"%r\"|%F|%s|%b|***|%m|%J|%p|%S|%T|"
<Limit SITE_CHMOD>
  DenyAll
</Limit>
<Limit WRITE>
   Order allow, deny
   Deny from All
</Limit>
<Limit LOGIN>
  AllowGroup virtftp
  AllowGroup ppxuser
  AllowUser  thoronline
  AllowUser  disc
  DenyAll
</Limit>
<Global>
        ServerIdent             on "FTP Server ready"
        DisplayConnect          /etc/ftpissue
        DisplayLogin            welcome.msg
        DisplayChdir            readme true
        ExtendedLog
/var/log/proftpd/distribution_access.log WRITE,READ write
        ExtendedLog             /var/log/proftpd/distribution_auth.log AUTH auth
        ExtendedLog             /var/log/proftpd/distribution_all.log ALL full
        ExtendedLog             /var/log/proftpd/arturo_alluser.log ALL fulluser
        MaxClients         500
        MaxClientsPerHost   20 "This IP address has too many open connections"
        MaxClientsPerUser    3 "This account has too many open connections"
        AllowForeignAddress off
   AuthUserFile
/PANFS/local/ha_scripts/web/proftpd/etc/proftpd.virtualuser.passwd
   <IfGroup virtftp>
      <Limit WRITE>
         DenyAll
      </Limit>
   </IfGroup>
   <IfGroup ppxuser>
      <Limit WRITE>
         DenyAll
      </Limit>
   </IfGroup>
   <IfUser thoronline>
      <Limit LOGIN>
         Order Allow,Deny
         Allow from xxx.yyy.zzz.,aaa.bbb.ccc.,192.168.1.,127.0.0.1
         DenyAll
      </Limit>
   </IfUser>
</Global>
---------------------------------------------------------------------------------------------------------------------------

Because this is a production FTP server, we can't leave it in the
1.3.6b unusable state and so we're constantly falling back to 1.3.5e
after we try something to fix it and it fails. I attempted to turn on
the proftpd debug option (--debug 8) within the init.d script, but it
didn't appear to increase the verbosity of logging that is sent to
/var/log/messages at all.

For the record I also tried 1.3.6a and 1.3.7rc2, and both suffered
similar slowness and connection losses. Basically everything
subsequent to 1.3.5e seems to have this problem.

My first question is, is this a known issue? I can't find anybody else
reporting anything similar in the forums. Secondly, can anyone think
of something to try in terms of debugging that might help identify
where the problem is? Since 1.3.5e is almost 3 years old at this
point, our security folks are on us to upgrade, but the latest
versions are basically unusable for our user community until this
issue is solved. Please let me know what I can do to help solve this
issue.

Thanks in advance for your help!


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html