{"record":{"id":"322fbe8dcc4893b3","repo":"apache/hadoop","slug":"login-failed-on-server-host-port-port-as","errorCode":null,"errorMessage":"Login failed on server - {host}, port - {port} as user '{user}'","messagePattern":"Login failed on server - (.+?), port - (.+?) as user '(.+?)'","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/ftp/FTPFileSystem.java","lineNumber":162,"sourceCode":"    String host = conf.get(FS_FTP_HOST);\n    int port = conf.getInt(FS_FTP_HOST_PORT, FTP.DEFAULT_PORT);\n    String user = conf.get(FS_FTP_USER_PREFIX + host);\n    String password = conf.get(FS_FTP_PASSWORD_PREFIX + host);\n    client = new FTPClient();\n    client.connect(host, port);\n    int reply = client.getReplyCode();\n    if (!FTPReply.isPositiveCompletion(reply)) {\n      throw NetUtils.wrapException(host, port,\n                   NetUtils.UNKNOWN_HOST, 0,\n                   new ConnectException(\"Server response \" + reply));\n    } else if (client.login(user, password)) {\n      client.setFileTransferMode(getTransferMode(conf));\n      client.setFileType(FTP.BINARY_FILE_TYPE);\n      client.setBufferSize(DEFAULT_BUFFER_SIZE);\n      setTimeout(client, conf);\n      setDataConnectionMode(client, conf);\n    } else {\n      throw new IOException(\"Login failed on server - \" + host + \", port - \"\n          + port + \" as user '\" + user + \"'\");\n    }\n\n    return client;\n  }\n\n  /**\n   * Set the FTPClient's timeout based on configuration.\n   * FS_FTP_TIMEOUT is set as timeout (defaults to DEFAULT_TIMEOUT).\n   */\n  @VisibleForTesting\n  void setTimeout(FTPClient client, Configuration conf) {\n    long timeout = conf.getLong(FS_FTP_TIMEOUT, DEFAULT_TIMEOUT);\n    client.setControlKeepAliveTimeout(timeout);\n  }\n\n  /**\n   * Set FTP's transfer mode based on configuration. Valid values are","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/ftp/FTPFileSystem.java#L144-L180","documentation":"The TCP connection and control-channel greeting succeeded (positive completion reply), but FTPClient.login(user, password) returned false — the server rejected the credentials. FTPFileSystem takes user/password from the URI userinfo or from the fs.ftp.user.<host> / fs.ftp.password.<host> keys (note the host suffix).","triggerScenarios":"Every filesystem operation calls connect(); wrong user or password, expired/locked account, or credentials read from the wrong config key (host suffix mismatch) all end here. Note initialize() requires both user and password non-null (it splits userinfo on ':' and requires two parts).","commonSituations":"Password rotated on the FTP server but not in job config; fs.ftp.user.<host> configured with a different host string than fs.ftp.host; passwords containing ':' or '@' breaking the URI userinfo split; server disallowing anonymous logins.","solutions":["Verify credentials outside Hadoop first: curl -u user:pass ftp://host/ or lftp ftp://user@host","Set credentials explicitly with the correct host suffix: conf.set(\"fs.ftp.user.\" + host, user) and conf.set(\"fs.ftp.password.\" + host, password)","Avoid embedding passwords with ':' or '@' in the URI userinfo; use the config keys instead","Check whether the account is locked/expired or the server requires a specific auth mechanism"],"exampleFix":"// before\nconf.set(\"fs.ftp.host\", \"ftp.example.com\");\nconf.set(\"fs.ftp.user.ftp.example.com\", \"alice\");\nconf.set(\"fs.ftp.password.example.com\", \"secret\"); // wrong suffix -> login fails\n\n// after\nconf.set(\"fs.ftp.host\", \"ftp.example.com\");\nconf.set(\"fs.ftp.user.ftp.example.com\", \"alice\");\nconf.set(\"fs.ftp.password.ftp.example.com\", \"secret\");","handlingStrategy":"try-catch","validationCode":"// preflight credentials with a raw client before running the job\ntry (FTPClient probe = new FTPClient()) {\n  probe.connect(host, port);\n  if (!probe.login(user, password)) {\n    throw new IllegalArgumentException(\"FTP credentials rejected for \" + user);\n  }\n  probe.logout();\n}","typeGuard":null,"tryCatchPattern":"try {\n  fs = path.getFileSystem(conf);\n  fs.open(someFile);\n} catch (IOException e) {\n  if (e.getMessage() != null && e.getMessage().startsWith(\"Login failed\")) {\n    // fail fast with actionable message instead of retrying\n    throw new IOException(\"FTP login rejected - check fs.ftp.user.<host>/fs.ftp.password.<host>\", e);\n  }\n  throw e;\n}","preventionTips":["Keep the host suffix consistent across fs.ftp.host, fs.ftp.user.<host> and fs.ftp.password.<host>","Prefer config keys over URI userinfo when passwords contain ':' or '@'","Preflight the login once at job start rather than discovering it per operation"],"tags":["ftp","authentication","credentials","login"],"backgroundTag":"authentication-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}