EzDevInfo.com

How to test if user can upload and download files in given port range

For shell script which installs a daemon I need to make sure that the newly created daemon user has the rights to use the port range that is needed for a daemon. How can I check this?

Getting "000004DC: LdapErr: DSID-0C0906E8, " error when configuring proftp with ldap

I tried to find a lot (I've already spent one complete day on this) to find the reason for following error:

000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1

I've windows AD setup as LDAP server and using this for authentication in sftp using proftpd+ldap in Linux machines.

I've two machines (machine#1 and machine#2), where proftpd+ldap is configured. In both the machines all the required configuration (such as proftpd.conf and ldap.conf) is exactly same.

However, when I try to sftp to machine#1, it is able to do it successfully and shows no error in wireshark (tcpdump). However, when I try to sftp to machine#2, it gives me following error. Below is the tcpdump collected from LDAP server.

What I am unable to figure out is, why in failure case (machine#2) only, I am seeing bindRequest "<ROOT>" simple but not in successful case (machine#1).

There is clear indication that there is something in client (machine#2), which is causing this, but not able to figure out what?

Help will be highly appreciated.

Using ProFTPD as Authentication for Site

I'm working on a site that when a user registers they will have a ftp user created using proftpd and mysql. What I want to know how to do is authenticate a user as I've never seen a password stored this way before.

INSERT INTO `ftpuser` (`id`, `userid`, `passwd`, `uid`, `gid`,`homedir`,`shell`, `count`, `accessed`, `modified`)
 VALUES ('', 'newuser', ENCRYPT('password'), 2001, 2001, '/var/www/accounts/newuser', '/sbin/nologin', 0, '', '');

From here on out I'll have php create the directory and then create a new corresponding table that gives the user all their account details, (IE userprofile with email options etc etc) So from here the way I've always stored passwords has been sha1("username:password"), so the statement has been

$hashpass = sha1(strtoupper($_POST['username']));
$query = <<<SQL
SELECT id
FROM accounts
WHERE password = :hashpass
SQL;
$resource = $this->db->db->prepare( $query );
$resource->execute( array (
":hashpass" => $hashpass,
));
if($resource->rowCount() == 0 ) {
return "Error";
}
else {
//Set the Session
}

What I have no clue on how to do is how to query the password that proftpd stores. Any input would be appreciated.

configuration Fail2ban with Proftpd on Puppet

• I want to change the variable "enabled" in jail.conf of Fail2ban according to the status of Proftpd on the agent machine.
• Ex: If on the agent machine, Proftpd is running, "enable = true" (Fail2ban will monitor Proftpd) If Proftpd is stopped, "enable = false" (Fail2ban won't monitor Proftpd)

• My init.pp file :

  class fail2ban { package { "fail2ban": ensure => "installed", }

  service { "fail2ban":
          ensure => "running",
          enable => "true",
          require => Package["fail2ban"],
  }
  $path = "/var/run/proftpd.pid"
  $status = inline_template("<% if File.exist?(@path) -%>true<% else -%>false<%end -%>")
  file { "jail.conf":
          path    => '/etc/fail2ban/jail.conf',
      ensure  => file,
      require => Package['fail2ban'],
      content => template("fail2ban/jail.conf.erb"),
  notify  => Service['fail2ban'],
  }
  

My template jail.conf.erb file:

[proftpd]
enabled  = <%= $status %>
port     = ftp,ftp-data,ftps,ftps-data
filter   = proftpd
logpath  = /var/log/proftpd/proftpd.log
maxretry = 5

The problem is that my "enabled" result is according to the check on Puppet Master, not the agent machine, while I need to do the check on the agent machine.

Can anyone help me ?

error: unable to open /dev/null for stdin: No such file or directory

I cannot get a simple trigger on proftpd working. Here is what I did:

 <IfModule mod_exec.c>
  ExecEngine on
  ExecOptions logStderr logStdout
  ExecLog /var/log/proftpd/exec.log
  ExecOnCommand APPE,STOR /usr/local/bin/proftptest.sh %u %f
 </IfModule>

however it keeps on failing with:

Jan 21 17:31:07 mod_exec/0.9.9[22514]: already saw this Exec, skipping
Jan 21 17:31:07 mod_exec/0.9.9[22514]: already saw this Exec, skipping
Jan 21 17:31:07 mod_exec/0.9.9[22514]: preparing to execute '/usr/local/bin/proftptest.sh' with uid 117 (euid 117), gid 65534 (egid 65534)
Jan 21 17:31:07 mod_exec/0.9.9[22514]:  + '/usr/local/bin/proftptest.sh': argv[1] = ftp
Jan 21 17:31:07 mod_exec/0.9.9[22514]:  + '/usr/local/bin/proftptest.sh': argv[2] = /home/ftp/incoming/Examples.txt
Jan 21 17:31:07 mod_exec/0.9.9[22514]: error: unable to open /dev/null for stdin: No such file or directory
Jan 21 17:31:07 mod_exec/0.9.9[22514]: STOR ExecOnCommand '/usr/local/bin/proftptest.sh' failed: No such file or directory
Jan 21 17:31:07 mod_exec/0.9.9[22514]: already saw this Exec, skipping
Jan 21 17:31:07 mod_exec/0.9.9[22514]: already saw this Exec, skipping

However the script seems fine (running from my user session, default env):

$ ls -al /usr/local/bin/proftptest.sh
-rwxr-xr-x 1 root root 97 Jan 21 17:25 /usr/local/bin/proftptest.sh

I am NOT using DefaultRoot:

$ grep Default /etc/proftpd/proftpd.conf
DefaultServer           on
# DefaultRoot           ~

What could I possibly be missing ?

ProFTPd unable to seteuid

i'm trying to figure out this problem:

2014-04-07 14:00:58,628 srv proftpd[10143] srv (pfsense.localdomain[192.168.0.1]): FTP session opened.
2014-04-07 14:01:13,779 srv proftpd[10091] srv (pfsense.localdomain[192.168.0.1]): Preparing to chroot to directory '/srv/user1'
2014-04-07 14:01:13,779 srv proftpd[10091] srv (pfsense.localdomain[192.168.0.1]): USER user1: Login successful.
2014-04-07 14:01:13,779 srv proftpd[10091] srv (pfsense.localdomain[192.168.0.1]): ROOT PRIVS: unable to seteuid(): Operation not permitted
2014-04-07 14:01:13,779 srv proftpd[10091] srv (pfsense.localdomain[192.168.0.1]): ROOT PRIVS: unable to setegid(): Operation not permitted
2014-04-07 14:01:13,782 srv proftpd[10091] srv (pfsense.localdomain[192.168.0.1]): RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
2014-04-07 14:01:13,782 srv proftpd[10091] srv (pfsense.localdomain[192.168.0.1]): FTP session closed.

I have made a folder on my filesystem 'srv' with sub folders like 'user1', 'user2' and so on.

drwxrwxrwx  19 root root  4096 Mar  5 20:05 srv

Each user has their home directoty set to 'user1', 'user2' and so on.

drwx---r-x 189 user1   users     4096 Apr  3 11:34 user1

proftp conf:

Include /etc/proftpd/modules.conf
ServerName          "SRV"
ServerType standalone
DeferWelcome            off
MultilineRFC2228 on
DefaultServer           on
ShowSymlinks on
TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200
DisplayLogin                    welcome.msg
DisplayChdir .message true
ListOptions "-l"
DenyFilter          \*.*/
DefaultRoot         ~
Port                21
User                proftpd
Group               nogroup
Umask 022 022
AllowOverwrite          on
TransferLog /var/log/proftpd/xferlog
SystemLog   /var/log/proftpd/proftpd.log
<IfModule mod_quotatab.c>
 QuotaEngine off
</IfModule>
<IfModule mod_ratio.c>
 Ratios off
</IfModule>
<IfModule mod_delay.c>
 DelayEngine on
</IfModule>
<IfModule mod_ctrls.c>
 ControlsEngine        off
 ControlsMaxClients    2
 ControlsLog           /var/log/proftpd/controls.log
 ControlsInterval      5
 ControlsSocket        /var/run/proftpd/proftpd.sock
</IfModule>
<IfModule mod_ctrls_admin.c>
 AdminControlsEngine off
</IfModule>
Include /etc/proftpd/conf.d/
<Global>
 PassivePorts 65400 65535
</Global>

More:

Ubuntu server 13.10
Webmin 1.680
ProFTPD Version 1.3.5rc3

Regexp: ProFTPD auth-logs

I've configurated ProFTPD to log all authentifications on a Plesk powered server. This setting is not set by default since Plesk 10 (whyever...). I want to configure fail2ban, to detect unsuccessful login-attempts for Brute Force prevention.

/etc/proftpd.include:

ExtendedLog         /var/log/proftpd/auth.log AUTH auth 
LogFormat           auth "%v [%h] %s"

Example of unsuccessfull login (530):

/var/log/proftpd/auth.log:

ProFTPD [12.89.47.3] 331
ProFTPD [12.89.47.3] 530

What's the correct regexp for fail2ban ? My configuration seems not to match the pattern:

/etc/fail2ban/filter.d/proftpd.conf:

failregex = ProFTPD(.)+\[<HOST>\] 530$

<HOST> seems to be a fail2ban variable, and $ ends up a rule (if you want to set several rules inside the failregex = variable).

How do you upload a core PHP file via FTP without interrupting a visitor to your site

Whenever an active PHP based site I look after needs an urgent code change, I change the code offline, test it on my local server and then when happy, upload the updated file to the production server via FTP.

This obviously works, but I have found that when I do this on a busy site, if someone accesses the file in their browser at exactly the same time I am uploading, they will receive a PHP parse error. I assume that this is because the upload via FTP hasn't completed at the point when they try to access it.

I can't wait until a quiet period to upload my new files as the site is busy 24/7, so how can I avoid this? Do certain FTP servers handle this better than others or am I going about deploying to the production server in the wrong way?

CENTOS 6.6, Apache, ProFTPd/PureFTPd, PHP 5.3

Can the user of proftpd change the password themself not by admin?

I have read all the command on ftp which contains no command to change passwd.
I am a user of proftpd ,how can change my password after logining into proftpd by myself not by admin?
User can change it's own password in ssh service ,not by admin,it is convenient.

Proftpd verify complete upload

I was wondering whether there was a best practice for checking if an upload to your ftp server was successful.

The system I'm working with has an upload directory which contains subdirectories for every user where the files are uploaded.

Files in these directories are only temporary, they're disposed of once handled.

The system loops through each of these subdirectories and new files in them and for each file checks whether it's been modified for 10 seconds. If it hasn't been modified for 10 seconds the system assumed the file was uploaded successfully.

I don't like the way the system currently handles these situations, because it will try and handle the file and fail if the file upload was incomplete, instead of waiting and allowing the user to resume the upload until it's complete. It might be fine for small files which doesn't take a lot of time to upload, but if the file is big I'd like to be able to resume the upload.

I also don't like the loops of directories and files, the system idles at a high cpu usage, so I've implemented pyinotify to trigger an action when a file is written. I haven't really looked at the source code, I can only assume it is more optimized than the current implementation (which does more than I've described).

However I still need to check whether the file was successfully uploaded.

I know I can parse the xferlog to get all complete uploads. Like:

awk '($12 ~ /^i$/ && $NF ~ /^c$/){print $9}' /var/log/proftpd/xferlog

This would make pyinotify unnecessary since I can get the path for complete and incomplete uploads if I only tail the log.

So my solution would be to check the xferlog in my run-loop and only handle complete files.

Unless there's a best practice or simply a better way to do this?

What would the disadvantages be with this method?

I run my app on a debian server and proftpd is installed on the same server. Also, I have no control over clients sending the file.

List files with pyftp - proftpd vs. pyftpdlib behavior

I have a test code which uses an FTP stub with pyftpdlib, which to my surprise failed in production. The reason for this is that proftpd returns the directory name in response to NLST. Here is the response from pyftpdlib FTP stub:

In [10]: local_conn.login('user', '12345')
Out[10]: '230 Login successful.'

In [11]: import ftplib

In [12]: local_conn = ftplib.FTP()

In [13]: local_conn.connect('localhost', 2121)
Out[13]: '220 pyftpdlib 1.4.0 ready.'

In [14]: local_conn.login('user', '12345')
Out[14]: '230 Login successful.'

In [15]: local_conn.nlst('structuredata_advanced')
Out[15]: 
['Report_20150618.csv',
 'Report_20150618.fin',
 'Report_20150619.csv',
 'Report_20150619.fin',
 'Report_20150620.csv',
 'Report_20150620.fin']

Here is the response from proftpd:

In [16]: remote_conn = ftplib.FTP()

In [17]: remote_conn.connect('A1B.7Y.XX.XX', 21)
Out[17]: '220 ProFTPD 1.3.4a Server (vztd3.company.com) [A1B.7Y.XX.XX]'

In [18]: remote_conn.login('remoteuser', 'verysecret')
Out[18]: '230 User yougov logged in'

In [19]: remote_conn.nlst('structuredata_advanced')
Out[19]: 
['structuredata_advanced/Report_20150624.csv',
 'structuredata_advanced/Report_20150629.csv',
 'structuredata_advanced/Report_20150625.fin',
 'structuredata_advanced/Report_20150628.fin',
 'structuredata_advanced/Report_20150627.fin',
 'structuredata_advanced/Report_20150620.fin',
 'structuredata_advanced/Report_20150619.csv', 
  ...]

It's easy enough to remove those directory names:

    # this code works both in production and testing 
    files = conn.nlst(basedir)
    # proftd is weired it returns the basedir name too
    files = [f.split('/')[-1] for f in files]

but I would like to understand if this is something that pyftpdlib does wrong?
Is this something that can be configured in ProFTPD?
Is there something I need to know about the FTP protocol and NLST command?

update

I just tested another ftp server called uftpd it behaves like pyftpdlib when issuing NLST.

Debian / Proftp 550 Permission denied

I've recently installed proftp on my debian squeeze linode. It works so far but I'm facing several issues now.

In an FTP client such as FileZilla, I am able to access the server and download files without problems, but upload isn't prossible. Trying results in 550 test.txt: Permission denied.

I'm also trying to download/upload directly from NetBeans, but NetBeans reports a 550 permission denied message in both cases. See below the result when downloading a file.

Connection can be established successfully unless sub directories are specified in the settings.

220 ProFTPD 1.3.3a Server (Debian) [::ffff:178.79.184.96]
USER userftp
331 Password required for userftp
PASS ******
230 User userftp logged in
TYPE I
200 Type set to I
CWD /site.co.uk/public_html
550 /site.co.uk/public_html: No such file or directory
CWD /
250 CWD command successful
CWD site.co.uk
550 site.co.uk: No such file or directory
MKD site.co.uk
550 gwerks.vegetav.co.uk: Permission denied
QUIT
221 Goodbye.

The following is appended to the proftp.conf file:

#VALID LOGINS
<Limit LOGIN>
AllowUser userftp
DenyALL
</Limit>

<Directory /srv/www/>
Umask 022 022
AllowOverwrite on
        <Limit MKD STOR DELE XMKD RNEF RNTO RMD XRMD CWD>
        AllowAll
        </Limit>
</Directory>

Proftpd - SFTP with Virtual Users

I'm trying to configure a SFTP with Proftpd. I've successfully configured the SFTP with Unix Users, but now I'd like to use virtual users, as I'll have an important amount of users to add/delete. I want the users to login with username/password.

For this, I've first followed the tutorial Using SFTP with ProFTPd then tried others.

Here is the configuration for the SFTP server :

Include /etc/proftpd/modules.conf


ServerName                      "Nom du FTP"
ServerType                      standalone
DefaultServer                   on

# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask                           022

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd).
MaxInstances                    30

RequireValidShell               off

# Set the user and group under which the server will run.
User                            proftpd
Group                           nogroup

SFTPEngine         on

Port               2222
SFTPLog            /var/log/proftpd/sftp.log
TransferLog        /var/log/proftpd/sftp-xferlog

# Host Keys
SFTPHostKey        /etc/ssh/ssh_host_rsa_key
SFTPHostKey        /etc/ssh/ssh_host_dsa_key

# Auth methods
SFTPAuthMethods    password
AuthUserFile       /etc/proftpd/sftp.passwd
AuthGroupFile      /etc/proftpd/sftp.group

# SFTP specific configuration
DefaultRoot        ~

# Normally, we want files to be overwriteable.
<Directory />
  AllowOverwrite                on
</Directory>

I've generated the passwords using the command ftpasswd --hash.

But, when I try to connect using FileZilla, I've got the message :

Authentification failed
Critical error
Can't establish a connection to the server

When I look into the logs of proftpd :

2014-09-08 15:13:53,636 mod_sftp/0.9.9[6343]: error using DisplayLogin 'welcome.msg': No such file or directory

2014-09-08 15:13:53,637 mod_sftp/0.9.9[6343]: sent server version 'SSH-2.0-mod_sftp/0.9.9'

2014-09-08 15:13:53,704 mod_sftp/0.9.9[6343]: received client version 'SSH-2.0-PuTTY_Local:_Jun__1_2014_11:08:49'

2014-09-08 15:13:53,704 mod_sftp/0.9.9[6343]: handling connection from SSH2 client 'PuTTY_Local:_Jun__1_2014_11:08$

2014-09-08 15:13:53,711 mod_sftp/0.9.9[6343]:  + Session key exchange: diffie-hellman-group-exchange-sha256

2014-09-08 15:13:53,711 mod_sftp/0.9.9[6343]:  + Session server hostkey: ssh-rsa

2014-09-08 15:13:53,711 mod_sftp/0.9.9[6343]:  + Session client-to-server encryption: aes256-ctr

2014-09-08 15:13:53,711 mod_sftp/0.9.9[6343]:  + Session server-to-client encryption: aes256-ctr

2014-09-08 15:13:53,711 mod_sftp/0.9.9[6343]:  + Session client-to-server MAC: hmac-sha2-256

2014-09-08 15:13:53,711 mod_sftp/0.9.9[6343]:  + Session server-to-client MAC: hmac-sha2-256

2014-09-08 15:13:53,711 mod_sftp/0.9.9[6343]:  + Session client-to-server compression: none

2014-09-08 15:13:53,711 mod_sftp/0.9.9[6343]:  + Session server-to-client compression: none

2014-09-08 15:13:54,142 mod_sftp/0.9.9[6343]: sending acceptable userauth methods: password

2014-09-08 15:13:56,764 mod_sftp/0.9.9[6343]: sending userauth failure; remaining userauth methods: password

2014-09-08 15:13:56,764 mod_sftp/0.9.9[6343]: client sent SSH_MSG_IGNORE message (160 bytes)

2014-09-08 15:13:56,832 mod_sftp/0.9.9[6343]: error reading from client (fd 0): Connection reset by peer

2014-09-08 15:13:56,832 mod_sftp/0.9.9[6343]: disconnecting client (Connection reset by peer)

I don't understand why it doesn't work. If I simply delete the lines :

AuthUserFile       /etc/proftpd/sftp.passwd
AuthGroupFile      /etc/proftpd/sftp.group

The connection works perfectly with the Unix users. Have I forgotten anything ?

I'm using Ubuntu server 14.04.

Another FTP daemon is already running?

I'm running the xampp on os x mavericks Xampp doesn't start the ProFTPD server. when i tried to start it always failed.

In application log it says

 Starting ProFTPD...
 Checking syntax of configuration file
 /Applications/XAMPP/xamppfiles/proftpd/scripts/ctl.sh : proftpd started

Even after reinstalling the XAMPP ProFTPD doesn't start

ProFTPD killed (signal 15) error - how to fix logrotate restart error? [closed]

ProFTPD on Ubuntu is being killed unexpectedly.

Log message:

$ tail /var/log/proftpd/proftpd.log.1
...
... ProFTPD killed (signal 15)
... ProFTPD 1.3.5rc3 standalone mode SHUTDOWN

Diagnosis: the time of the message is the same time that cron runs the logrotate command.

Google searches turn up various info about ProFTPD having a glitch on Debian-based systems due to log files, log rotations, and the ProFTPD server not restarting.

I will add a bounty for a solution to this. I've posted a workaround answer too, in case it's helpful for others.