Discussion:
[Proftpd-user] umask not taken into account when sunique is on
BROCKHOVEN Werner (EXT)
2016-01-26 12:16:54 UTC
Permalink
Hi all,

It seems that when using STOU (sunique on), the uploaded file do not follow the umask setting.
Is this the expacted behaviour?
Is there a configuration that can be done to have STOU also follow the umask setting?


A quick look in the code (modules/mod_xfer.c), shows the following:

/* xfer_post_stou() is a POST_CMD handler that changes the mode of the
* STOU file from 0600, which is what mkstemp() makes it, to 0666,
* the default for files uploaded via STOR. This is to prevent users
* from being surprised.
*/


However while testing with a newly compiled instance, based on https://dl.fedoraproject.org/pub/epel/7/SRPMS/p/proftpd-1.3.5a-2.el7.src.rpm , we notice that uploaded files keep permission 0600. When testing a previous version proftpd-1.3.4d, the behaviour is according to the comment in mod_xfer.c and the resulting uploaded file get permission 0666.

Regards,

Werner Brockhoven

NM CIP MS (22.138)

Email: ***@eurocontrol.int<mailto:***@eurocontrol.int>
Tel CIP MS: 92662
Tel CIP MS: +32 (0)2 730 26 62

EUROCONTROL
96 Rue de la Fusée, 1130 Brussels, Belgium

Follow us on:
Web<http://www.eurocontrol.int/> | Twitter<http://www.twitter.com/eurocontrol> | Facebook<http://www.facebook.com/eurocontrol> | Youtube<http://www.youtube.com/eurocontroltv> | Flickr<http://www.flickr.com/photos/eurocontrol> | Linkedin<http://www.linkedin.com/company/eurocontrol>

____

This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful.

Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy.

Any views expressed in this message are those of the sender.
TJ Saunders
2016-01-26 18:29:18 UTC
Permalink
Post by BROCKHOVEN Werner (EXT)
It seems that when using STOU (sunique on), the uploaded file do not
follow the umask setting.
Is this the expacted behaviour?
No, it is not. This is a bug; I've filed this as:

http://bugs.proftpd.org/show_bug.cgi?id=4223
Post by BROCKHOVEN Werner (EXT)
However while testing with a newly compiled instance, based on
https://dl.fedoraproject.org/pub/epel/7/SRPMS/p/proftpd-1.3.5a-2.el7.src.rpm, we notice that uploaded files keep permission 0600.
What's the full proftpd.conf you're using with the above? Are there any
errors logged when uploading using STOU that might
explain this? Any SELinux settings that might be involved?

Cheers,
TJ

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
ProFTPD Users List <proftpd-***@proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
BROCKHOVEN Werner (EXT)
2016-01-26 19:29:37 UTC
Permalink
Hi,

These are the settings that we were using at the time.

Trace DEFAULT:0
ServerName "Eurocontrol CFMU - ProFTPD server"
ServerIdent on "FTP Server"
ServerType standalone
Systemlog /var/log/proftpd/proftpd.log
DefaultServer on
Port 21
UseIPv6 off
DefaultRoot ~
<IfModule mod_auth_pam.c>
AuthPAM on
AuthPAMConfig proftpd
AuthOrder mod_auth_pam.c* mod_auth_unix.c
</IfModule>
PersistentPasswd off
UseReverseDNS off
User nobody
Group nobody
Umask 022
MaxInstances 300
UseSendfile off
LogFormat default "%h %l %u %t \"%r\" %s %b"
LogFormat auth "%v [%P] %h %t \"%r\" %s"
LoadModule mod_ctrls_admin.c
LoadModule mod_vroot.c
<IfModule mod_vroot.c>
VRootEngine on
</IfModule>
<Global>
Umask 022
AllowOverwrite yes
<Limit SITE_CHMOD>
DenyAll
</Limit>
</Global>

During troubleshouting, I also built a version, based on the distributed proftpd.spec file, and this build did seem to adhere the 0666 rule.

I'll rebuild with your fix and let you know if ok.

Regards,

Werner

-----Original Message-----
From: TJ Saunders [mailto:***@castaglia.org]
Sent: 26 January, 2016 19:29
To: proftp-***@lists.sourceforge.net
Subject: Re: [Proftpd-user] umask not taken into account when sunique is on
Post by BROCKHOVEN Werner (EXT)
It seems that when using STOU (sunique on), the uploaded file do not
follow the umask setting.
Is this the expacted behaviour?
No, it is not. This is a bug; I've filed this as:

http://bugs.proftpd.org/show_bug.cgi?id=4223
Post by BROCKHOVEN Werner (EXT)
However while testing with a newly compiled instance, based on
https://dl.fedoraproject.org/pub/epel/7/SRPMS/p/proftpd-1.3.5a-2.el7.src.rpm, we notice that uploaded files keep permission 0600.
What's the full proftpd.conf you're using with the above? Are there any errors logged when uploading using STOU that might explain this? Any SELinux settings that might be involved?

Cheers,
TJ

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
ProFTPD Users List <proftpd-***@proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
____

This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful.

Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy.

Any views expressed in this message are those of the sender.

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
ProFTPD Users List <proftpd-***@proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
TJ Saunders
2016-01-26 23:38:56 UTC
Permalink
The fix only seems to work without
DefaultRoot ~
With DefaultRoot configured as above, I get the following error.
error: unable to chmod 'ftpcPOLbo' to 0644: No such file or directory
I'm unable to reproduce the above behavior using the proftpd code from
the master branch on GitHub; are you patching some other version of the
source code, to see the above?

Cheers,
TJ

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
ProFTPD Users List <proftpd-***@proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
BROCKHOVEN Werner (EXT)
2016-01-26 23:44:24 UTC
Permalink
TJ,

I'm working of https://dl.fedoraproject.org/pub/epel/7/SRPMS/p/proftpd-1.3.5a-2.el7.src.rpm

Regards,

Werner

-----Original Message-----
From: TJ Saunders [mailto:***@castaglia.org]
Sent: 27 January, 2016 00:39
To: BROCKHOVEN Werner (EXT); proftp-***@lists.sourceforge.net
Cc: CIP Unix Team
Subject: Re: [Proftpd-user] umask not taken into account when sunique is on
The fix only seems to work without
DefaultRoot ~
With DefaultRoot configured as above, I get the following error.
error: unable to chmod 'ftpcPOLbo' to 0644: No such file or directory
I'm unable to reproduce the above behavior using the proftpd code from the master branch on GitHub; are you patching some other version of the source code, to see the above?

Cheers,
TJ
____

This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful.

Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy.

Any views expressed in this message are those of the sender.

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
ProFTPD Users List <proftpd-***@proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
TJ Saunders
2016-01-26 23:52:06 UTC
Permalink
Post by BROCKHOVEN Werner (EXT)
I'm working of
https://dl.fedoraproject.org/pub/epel/7/SRPMS/p/proftpd-1.3.5a-2.el7.src.rpm
Hrm. I don't usually use RPMs for building/debugging issues.

I recall, though, that a lot of the distributed Fedora proftpd RPMs
include mod_vroot; does your proftpd.conf
have "VRootEngine on" in it?

TJ

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
ProFTPD Users List <proftpd-***@proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
BROCKHOVEN Werner (EXT)
2016-01-26 23:56:05 UTC
Permalink
Yes, it includes vrootengine on.
In there src.rpm there are following patches which are being applied.

Patch2: proftpd.conf-no-memcached.patch
Patch4: proftpd-1.3.4rc1-mod_vroot-test.patch
Patch5: proftpd-1.3.4-utf8.patch
Patch6: proftpd-1.3.5a-bug-4210.patch
Patch27: proftpd-mod-vroot-0.9.2-bug3841.patch



-----Original Message-----
From: TJ Saunders [mailto:***@castaglia.org]
Sent: 27 January, 2016 00:52
To: BROCKHOVEN Werner (EXT); proftp-***@lists.sourceforge.net
Cc: CIP Unix Team
Subject: Re: [Proftpd-user] umask not taken into account when sunique is on
Post by BROCKHOVEN Werner (EXT)
I'm working of
https://dl.fedoraproject.org/pub/epel/7/SRPMS/p/proftpd-1.3.5a-2.el7.s
rc.rpm
Hrm. I don't usually use RPMs for building/debugging issues.

I recall, though, that a lot of the distributed Fedora proftpd RPMs include mod_vroot; does your proftpd.conf have "VRootEngine on" in it?

TJ
____

This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful.

Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy.

Any views expressed in this message are those of the sender.

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
ProFTPD Users List <proftpd-***@proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
TJ Saunders
2016-01-27 00:02:27 UTC
Permalink
Post by BROCKHOVEN Werner (EXT)
Yes, it includes vrootengine on.
You might try changing that to be "VRootEngine off", and verifying that
the STOU has the expected permissions.

TJ

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
ProFTPD Users List <proftpd-***@proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
BROCKHOVEN Werner (EXT)
2016-01-27 00:06:06 UTC
Permalink
With vrootengine off, the permissions are correct.

-----Original Message-----
From: TJ Saunders [mailto:***@castaglia.org]
Sent: 27 January, 2016 01:02
To: BROCKHOVEN Werner (EXT); proftp-***@lists.sourceforge.net
Cc: CIP Unix Team
Subject: Re: [Proftpd-user] umask not taken into account when sunique is on
Post by BROCKHOVEN Werner (EXT)
Yes, it includes vrootengine on.
You might try changing that to be "VRootEngine off", and verifying that the STOU has the expected permissions.

TJ
____

This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful.

Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy.

Any views expressed in this message are those of the sender.

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
ProFTPD Users List <proftpd-***@proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
TJ Saunders
2016-01-27 00:20:49 UTC
Permalink
Post by BROCKHOVEN Werner (EXT)
With vrootengine off, the permissions are correct.
OK, thanks for confirming.

I suspect this is an issue, then, in mod_vroot. I've opened an issue
about this; see:

https://github.com/Castaglia/proftpd-mod_vroot/issues/9

In the mean time, I've attached a patch, for mod_vroot, which might
address this:

$ cd /path/to/proftpd
$ patch -p0 < /path/to/vroot-chmod.patch
$ make

Cheers,
TJ
BROCKHOVEN Werner (EXT)
2016-01-27 00:37:32 UTC
Permalink
Hi TJ,

I can confirm that the vroot-chmod.patch works.
Thanks a lot for the help.

Regards,

Werner

-----Original Message-----
From: TJ Saunders [mailto:***@castaglia.org]
Sent: 27 January, 2016 01:21
To: BROCKHOVEN Werner (EXT); proftp-***@lists.sourceforge.net
Cc: CIP Unix Team
Subject: Re: [Proftpd-user] umask not taken into account when sunique is on
Post by BROCKHOVEN Werner (EXT)
With vrootengine off, the permissions are correct.
OK, thanks for confirming.

I suspect this is an issue, then, in mod_vroot. I've opened an issue about this; see:

https://github.com/Castaglia/proftpd-mod_vroot/issues/9

In the mean time, I've attached a patch, for mod_vroot, which might address this:

$ cd /path/to/proftpd
$ patch -p0 < /path/to/vroot-chmod.patch
$ make

Cheers,
TJ
____

This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful.

Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy.

Any views expressed in this message are those of the sender.

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
ProFTPD Users List <proftpd-***@proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Continue reading on narkive:
Search results for '[Proftpd-user] umask not taken into account when sunique is on' (Questions and Answers)
4
replies
____ 3. In FTP, ASCII and binary are the two file transfer ____.?
started 2007-11-30 12:46:38 UTC
programming & design
Loading...