Index: lib/libfetch/common.c
===================================================================
--- lib/libfetch/common.c	(revision 333572)
+++ lib/libfetch/common.c	(working copy)
@@ -1392,14 +1392,18 @@
 fetch_netrc_auth(struct url *url)
 {
 	const char *word;
+	int serrno;
 	FILE *f;
 
-	if (url->netrcfd == -2)
+	if (url->netrcfd < 0)
 		url->netrcfd = fetch_netrc_open();
 	if (url->netrcfd < 0)
 		return (-1);
-	if ((f = fdopen(url->netrcfd, "r")) == NULL)
+	if ((f = fdopen(url->netrcfd, "r")) == NULL) {
+		close(url->netrcfd);
+		url->netrcfd = -1;
 		return (-1);
+	}
 	rewind(f);
 	while ((word = fetch_read_word(f)) != NULL) {
 		if (strcmp(word, "default") == 0) {
@@ -1441,9 +1445,13 @@
 		}
 	}
 	fclose(f);
+	url->netrcfd = -1;
 	return (0);
- ferr:
+ferr:
+	serrno = errno;
 	fclose(f);
+	url->netrcfd = -1;
+	errno = serrno;
 	return (-1);
 }
 
Index: lib/libfetch/fetch.c
===================================================================
--- lib/libfetch/fetch.c	(revision 333572)
+++ lib/libfetch/fetch.c	(working copy)
@@ -272,6 +272,7 @@
 		fetch_syserr();
 		return (NULL);
 	}
+	u->netrcfd = -1;
 
 	if ((u->doc = strdup(doc ? doc : "/")) == NULL) {
 		fetch_syserr();
@@ -286,7 +287,6 @@
 	seturl(pwd);
 #undef seturl
 	u->port = port;
-	u->netrcfd = -2;
 
 	return (u);
 }
@@ -352,7 +352,7 @@
 		fetch_syserr();
 		return (NULL);
 	}
-	u->netrcfd = -2;
+	u->netrcfd = -1;
 
 	/* scheme name */
 	if ((p = strstr(URL, ":/"))) {
Index: lib/libfetch/ftp.c
===================================================================
--- lib/libfetch/ftp.c	(revision 333572)
+++ lib/libfetch/ftp.c	(working copy)
@@ -911,11 +911,14 @@
 	/* XXX FTP_AUTH, and maybe .netrc */
 
 	/* send user name and password */
+	DEBUG(fprintf(stderr, "netrcfd == %d\n", url->netrcfd));
 	if (url->user[0] == '\0')
 		fetch_netrc_auth(url);
 	user = url->user;
-	if (*user == '\0')
+	if (*user == '\0') {
 		user = getenv("FTP_LOGIN");
+		DEBUG(fprintf(stderr, "FTP_LOGIN=%s\n", user));
+	}
 	if (user == NULL || *user == '\0')
 		user = FTP_ANONYMOUS_USER;
 	if (purl && url->port == fetch_default_port(url->scheme))
@@ -928,8 +931,10 @@
 	/* did the server request a password? */
 	if (e == FTP_NEED_PASSWORD) {
 		pwd = url->pwd;
-		if (*pwd == '\0')
+		if (*pwd == '\0') {
 			pwd = getenv("FTP_PASSWORD");
+			DEBUG(fprintf(stderr, "FTP_PASSWORD=%s\n", pwd));
+		}
 		if (pwd == NULL || *pwd == '\0') {
 			if ((logname = getlogin()) == NULL)
 				logname = FTP_ANONYMOUS_USER;