gmane.network.proftpd.user

Re: [Proftpd-user] proftpd-1.3.4a won't follow a symlink if it has a double slash as target

Dat Head — 2013-05-16T18:35:58

On Thu, May 16, 2013 at 1:01 PM, Matus UHLAR - fantomas
<uhlar< at >fantomas.sk>wrote:


no mod_vroot - i do use ShowSymlinks

attached is complete proftpd.conf

it is an easy test to repeat
------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Re: [Proftpd-user] proftpd-1.3.4a won't follow a symlink if it has a double slash as target

TJ Saunders — 2013-05-16T18:30:15


It's a bug; it was fixed in proftpd-1.3.4c (and later).

Cheers,
TJ

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   The Universe is change; life is opinion.

   -Marcus Aurelius

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d
_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Re: [Proftpd-user] proftpd-1.3.4a won't follow a symlink if it has a double slash as target

Matus UHLAR - fantomas — 2013-05-16T17:01:35


On 16.05.13 12:22, Dat Head wrote:

do you use mod_vroot? I can't imagine how could this not work with standard
chroot ...

Re: [Proftpd-user] proftpd-1.3.4a won't follow a symlink if it has a double slash as target

Dat Head — 2013-05-16T16:22:44

On Thu, May 16, 2013 at 11:35 AM, Matus UHLAR - fantomas
<uhlar< at >fantomas.sk>wrote:



yes, and it works fine from outside ftp, as it should,
and if we fix the link to contain only one slash then
it works for proftp also (which shows it is something in the proftp code)
------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Re: [Proftpd-user] tls connection time out

Matus UHLAR - fantomas — 2013-05-16T15:56:01

Apparently firewall(/NAT) problem. Stateful firewalls with FTP support can
analyze FTP data stream and allow data connection that would otherwise be
denied.

With encrypted connection, this is impossible, unless the client turns off
encryption using CCC command, which is not supported/used by all TLS-aware
FTP clients.

You can try turning passive mode on/off, so the firewall would not complain.
With PORT mode, data connection is open from server, which often causes
troubles at the clients firewall side.
wth PASV (passive) mode, data connection is made from client to server, so
firewall on server can deny the connection.

With firewall on both sides, you need either explicitly allow ports on
server and tell the server to use these ports, or you _need_ client using
CCC command - otherwise you can't use TLS.

However, using firewalls at server side in such case is quite
conterproductive, especially when it denies clients from using TLS

Re: [Proftpd-user] SFTP hung sessions and error "Server unexpectedly closed network connection" for only one user

Ezsra McDonald — 2013-05-16T15:30:30

They have Core ftp version 2.2 build 1771


We have the following in our config file as well.

# General sftp client fixes from the mod_sftp forum
SFTPClientMatch ".*WS_FTP.*" channelWindowSize 1GB #WS_FTP initial window
size
SFTPClientMatch ".*ClientSftp" sftpProtocolVersion 3 #CuteFTPPro8
SFTPClientMatch ".*WinSCP.*" sftpProtocolVersion 3 #upload/download fix for
WinSCP
#
# SecureBlackbox (SSH-2.0-SecureBlackbox.7)
# http://www.eldos.com/sbb/download-release.php
SFTPClientMatch ".*SecureBlackbox.*" sftpProtocolVersion 3
#
# GoAnywhere (SSH-2.0-1.0)
# http://www.goanywheremft.com/products
SFTPClientMatch "1.0" sftpProtocolVersion 3 channelWindowSize 1GB
#
# JaSFtp (SSH-2.0-J2SSH_Maverick_1.2.10_Sterling Commerce)
# http://www.hiteksoftware.com/jasf/
SFTPClientMatch ".*J2SSH_Maverick.*" channelWindowSize 1GB
#
# Robo-FTP (SSH-2.0-WeOnlyDo)
# http://www.robo-ftp.com/
SFTPClientMatch ".*WeOnlyDo.*" sftpProtocolVersion 3 channelWindowSize 1GB
#
# Network Automation (SSH-2.0-EldoS.SSHBlackbox.3)
# http://www.net

Re: [Proftpd-user] proftpd-1.3.4a won't follow a symlink if it has a double slash as target

Matus UHLAR - fantomas — 2013-05-16T15:35:11

does dir1 exist?

Re: [Proftpd-user] SFTP hung sessions and error "Server unexpectedly closed network connection" for only one user

Josh Ghiloni — 2013-05-16T15:22:45

Could they be using an older client that doesn't handle the default SFTP
channel window of 4GB? we had that with a few of our clients and had to
drop the default to 1gb to ensure that all our clients can connect
successfully.
------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

[Proftpd-user] SFTP hung sessions and error "Server unexpectedly closed network connection" for only one user

Ezsra McDonald — 2013-05-16T15:17:10

Greetings,

We have 100's of Core_FTP clients that access our FTP server on SFTP port
2222. For some reason one of them is consistently leaving sessions open and
the server is not killing them.

Customer is reporting the following message:
"Server unexpectedly closed network connection"

This is how the user sessions look from a ftpwho query:

ftphost:~$ ftpwho
standalone FTP daemon [29724], up for 4 days, 10 hrs 26 min
17010 theUser  [ 50h2m] (n/a) READDIR /
14165 theUser  [25h55m] (n/a) READDIR /
23548 theUser  [22h17m] (n/a) LIST
23186 theUser  [22h25m] (n/a) READDIR /
24414 theUser  [21h57m] (n/a) READDIR /
23224 theUser  [22h24m] (n/a) LIST
23251 theUser  [22h23m] (n/a) LIST
23444 theUser  [22h19m] (n/a) LIST

We have to restart the server for the user to regain access.

Our config has the following timeout settings:

TimeoutIdle             800
TimeoutLogin            300
TimeoutNoTransfer       800


RPM: proftpd-1.3.4b-1

Any suggestions?

--Ezsra
-----------------------------------------------------

[Proftpd-user] tls connection time out

Pol Hallen — 2013-05-15T16:08:26

Hi all! Again here :-)

On a debian server I've proftpd-basic 1.3.3a.

Runs perfectly if I use it without TLS.

When I enable TLS, my clients goes to time out:

Command:MLSD
Error:Connection timed out
Error:Failed to retrieve directory listing

Half or more aftertoon to search with google but I didn't find any
solution :-(((

thanks for the help!

tail -f /var/log/proftpd/tls.log

May 15 17:58:38 mod_tls/2.4.2[20385]: using default OpenSSL verification
locations (see $SSL_CERT_DIR environment variable)
May 15 17:58:38 mod_tls/2.4.2[20385]: TLS/TLS-C requested, starting TLS
handshake
May 15 17:58:38 mod_tls/2.4.2[20385]: TLSv1/SSLv3 connection accepted,
using cipher DHE-RSA-AES128-SHA (128 bits)
May 15 17:58:38 mod_tls/2.4.2[20385]: Protection set to Private

My config:

openssl req -new -x509 -days 365 -nodes -out
/etc/proftpd/ssl/proftpd.cert.pem -keyout /etc/proftpd/ssl/proftpd.key.pem

tls.conf

<IfModule mod_tls.c>

TLSEngine                               on
TLSLog                                  /va

[Proftpd-user] proftpd-1.3.4a won't follow a symlink if it has adouble slash as target

Dat Head — 2013-05-15T16:00:56

if we have a symlink such as this (does not point outside the chroot),
note has double slash:

foo -> dir1//bar

proftp 1.3.4a will not deliver the file - says "file not found"

it is legal to have double slash in linux, and although i admit
it isn't great to have, it came about by accident and stopped a lot
of files from being able to be retrieved until we fixed all the links
(and no errors in log, just on ftp client side)

is this a buglet or a security feature ;-)
------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-u

Re: [Proftpd-user] chroot and symlinks

Pol Hallen — 2013-05-15T16:00:48

Yep :-O

solved... thanks boy!

:-)

Pol


------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d
_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Re: [Proftpd-user] chroot and symlinks

Josh Ghiloni — 2013-05-15T13:53:23

You didn't read very closely then :)

You need to specifically check out this section: Filesystem Tricks

Right above that you see:
"If your symlink does need to go above the DefaultRoot directory, then
you need to use one of the other tricks described below."

Hopefully that section will help you out.

------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d
_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

[Proftpd-user] chroot and symlinks

2013-05-15T13:24:19

Hi all :-)

I installed proftpd 1.3.4a (debian 7).

I read this page: http://www.proftpd.org/docs/howto/Chroot.html but I
can't see symlinks :-(((

/home/user1

mkdir /home/user1/www

ln -s /var/www/user1 www

"www" is a directory: ls -l

drwxr-xr-x 2 user1 user1 4096 May 15 09:16 www

and ls -l www is:

lrwxrwxrwx 1 user1 user1 24 May 15 09:16 www.example.com ->
/var/www/www.example.com

When I try to connect, after login:

ncftp / > ls www

www is empty :-///

Thanks for the help!

Pol

cat /etc/proftpd/proftpd.conf

Include /etc/proftpd/modules.conf

UseIPv6on
IdentLookupsoff
ServerName"Debian"
ServerTypestandalone
DeferWelcomeoff
MultilineRFC2228on
DefaultServeron
ShowSymlinkson
TimeoutNoTransfer600
TimeoutStalled600
TimeoutIdle1200
DisplayLogin                    welcome.msg
DisplayChdir               .message true
ListOptions                "-l"
DenyFilter\*.*/
DefaultRoot~
Port21
<IfModule mod_dynmasq.c>
# DynMasqRefresh 28800
</IfModule>
MaxInstances30
U

Re: [Proftpd-user] Segfault using mod_ldap (fwd)

Josh Ghiloni — 2013-05-09T20:37:04

The post-script to all of this is that it was FIPS -- I recompiled
against non-openssl fips in our non-prod environment and everything
was hunky dory. FIPS will just have to be a bridge we cross at a later
date.

On Wed, May 8, 2013 at 6:59 PM, Josh Ghiloni <ghiloni< at >gmail.com> wrote:

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Re: [Proftpd-user] Segfault using mod_ldap (fwd)

Josh Ghiloni — 2013-05-09T00:59:53

god, gmail is the WORST. i have an idea i'm going to exercise, TJ,
based on an idea we'd had a few months ago when mod_sftp was
segfaulting, and it turned out mod_sftp was compiled against FIPS
openssl, but was running against non-FIPS openssl. i suspect something
similar is happening now.

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

[Proftpd-user] unsubscribe

Raman, Pattabhi — 2013-05-08T23:52:41

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Re: [Proftpd-user] Segfault using mod_ldap

Josh Ghiloni — 2013-05-08T22:00:47

ok, looks like it was created with MD5 ... since we have to use Oracle
Wallet to create the certificate, i'll look into how to create one
with sha-1. thanks for the tip -- i'll give 'er a shot.

On Wed, May 8, 2013 at 3:56 PM, Josh Ghiloni <ghiloni< at >gmail.com> wrote:

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Re: [Proftpd-user] Segfault using mod_ldap

TJ Saunders — 2013-05-08T21:57:43



You might use something like:

  $ openssl x509 -noout -text < /path/to/cert | grep Signature

For example, running this on a cert I had lying around showed:

  $ openssl x509 -noout -text < ~/cert-tool/ocsp-ca.pem | grep Signature
        Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

Cheers,
TJ

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   Music, the greatest good that mortals know,
    And all of heaven we have below.

   -Joseph Addison

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_________________________________

Re: [Proftpd-user] Segfault using mod_ldap

Josh Ghiloni — 2013-05-08T21:56:30

that was a monumentally dumb question, given the existence of google.
i'm sorry i even asked it.

On Wed, May 8, 2013 at 3:52 PM, Josh Ghiloni <ghiloni< at >gmail.com> wrote:

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Re: [Proftpd-user] Segfault using mod_ldap

Josh Ghiloni — 2013-05-08T21:52:42

You might be on to something with the MD5 vs SHA -- how can I
determine the digest the cert uses?

On Wed, May 8, 2013 at 3:46 PM, TJ Saunders <tj< at >castaglia.org> wrote:

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
ProFTPD Users List   <proftpd-users< at >proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html