我们正在使用 PROFTPD（版本 1.3.3e），并且刚刚注意到，如果我们通过 FTP 连接到服务器，我们可以看到 mod_wrap 正在被调用：
来自 proftpd.log
May 27 10:46:16 li46 proftpd[10592] FTP session opened.
May 27 10:46:16 li46 proftpd[10592] mod_wrap/1.2.3: using access files: .hosts.allow, .hosts.deny
May 27 10:46:16 li46 proftpd[10592] mod_wrap/1.2.3: allowed connection from xxx
May 27 10:46:16 li46 proftpd[10592] Preparing to chroot to directory '/XXX'
May 27 10:46:16 li46 proftpd[10592] : USER XXX: Login successful.
但是通过 SFTP 连接时，mod_wrap 没有被调用：
来自 proftpd.log
May 27 11:21:47 li46 proftpd[11081] FTP session opened.
May 27 11:21:49 li46 proftpd[11081] Preparing to chroot to directory '/home/XXX'
May 27 11:21:49 li46 proftpd[11081] USER XXX: Login successful
来自 sftp.log
May 27 11:21:47 mod_sftp/0.9.7[11081]: + Session server-to-client compression: none
May 27 11:21:47 mod_sftp/0.9.7[11081]: + Session client-to-server language:
May 27 11:21:47 mod_sftp/0.9.7[11081]: + Session server-to-client language:
May 27 11:21:48 mod_sftp/0.9.7[11081]: sending acceptable userauth methods: publickey,password
May 27 11:21:49 mod_sftp/0.9.7[11081]: sending userauth success
May 27 11:21:49 mod_sftp/0.9.7[11081]: user 'XXX' authenticated via 'password' method
May 27 11:21:49 mod_sftp/0.9.7[11081]: client sent SSH_MSG_IGNORE message (160 bytes)
May 27 11:21:49 mod_sftp/0.9.7[11081]: unsupported '[email protected]' channel requested, ignoring
May 27 11:21:49 mod_sftp/0.9.7[11081]: 'subsystem' channel request for 'sftp' subsystem
May 27 11:21:49 mod_sftp/0.9.7[11081]: using SFTP protocol version 3 for this session (channel ID 0)
有人能提供任何关于为什么会出现这种情况的指导吗？我搜索了论坛和文档，但找不到关于 mod_wrap 是否与 mod_sftp 一起使用的参考资料。
proftpd.conf文件如下：
# Includes DSO modules
Include /etc/proftpd/modules.conf
SetEnv TZ XXX/XXX
# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
UseIPv6 off
# If set on you can experience a longer connection delay in many cases.
IdentLookups off
ServerName "XXX"
ServerType standalone
DeferWelcome off
MultilineRFC2228 on
DefaultServer on
ShowSymlinks on
# We want to hide our dot files for a reason
# - BITS, 6th October 2010
ListOptions "" strict
<Limit All>
IgnoreHidden on
</Limit>
#
# ---
#
<Global>
DefaultTransferMode binary
SyslogLevel warn
DefaultRoot ~
DeleteAbortedStores on
HiddenStores on
</Global>
DirFakeGroup on ~
DirFakeUser on ~
tcpNoDelay on
#
# ---
#
TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200
DisplayLogin welcome.msg
DisplayChdir .message true
#ListOptions "+R -h"
DenyFilter \*.*/
# Use this to jail all users in their homes
DefaultRoot ~
# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
RequireValidShell off
# Port 21 is the standard FTP port.
Port 21
#UseReverseDNS on
# This is useful for masquerading address with dynamic IPs:
# refresh any configured MasqueradeAddress directives every 8 hours
<IfModule mod_dynmasq.c>
# DynMasqRefresh 28800
</IfModule>
# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 60
# Set the user and group that the server normally runs at.
User proftpd
Group nogroup
# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask 002 002
# Normally, we want files to be overwriteable.
AllowOverwrite on
TransferLog /var/log/proftpd/xferlog
SystemLog /var/log/proftpd/proftpd.log
<IfModule mod_quotatab.c>
QuotaEngine off
</IfModule>
<IfModule mod_ratio.c>
Ratios off
</IfModule>
#
# We want to use hosts.allow and hosts.deny in individual home dirs
# for finer control on FTP logins - note these are dot files, which
# are no hidden to the users - BITS, 6th October 2010
<IfModule mod_wrap.c>
TCPAccessFiles ~/.hosts.allow ~/.hosts.deny
</IfModule>
# Delay engine reduces impact of the so-called Timing Attack described in
# http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02
# It is on by default.
<IfModule mod_delay.c>
DelayEngine on
</IfModule>
<IfModule mod_ctrls.c>
ControlsEngine off
ControlsMaxClients 2
ControlsLog /var/log/proftpd/controls.log
ControlsInterval 5
ControlsSocket /var/run/proftpd/proftpd.sock
</IfModule>
<IfModule mod_ctrls_admin.c>
AdminControlsEngine off
</IfModule>
#
# Alternative authentication frameworks
#
#Include /etc/proftpd/ldap.conf
#Include /etc/proftpd/sql.conf
#
# This is used for FTPS connections
#
#Include /etc/proftpd/tls.conf
#
# ---- Configure SFTP module here
#
<IfModule mod_sftp.c>
<VirtualHost X.X.X.X>
SFTPEngine on
SFTPLog /var/log/proftpd/sftp.log
# Configure the server to listen on the normal SSH2 port, port 22
Port 22
# Configure both the RSA and DSA host keys, using the same host key
# files that OpenSSH uses.
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_key
# Configure the file used for comparing authorized public keys of users.
SFTPAuthorizedUserKeys file:~/.ssh/authorized_keys
# Enable compression
SFTPCompression delayed
RequireValidShell off
# Allow the same number of authentication attempts as OpenSSH.
#
# It is recommended that you explicitly configure MaxLoginAttempts
# for your SSH2/SFTP instance to be higher than the normal
# MaxLoginAttempts value for FTP, as there are more ways to authenticate
# using SSH2.
MaxLoginAttempts 6
# Default Values
# channelPacketSize 32KB channelWindowSize 4GB sftpProtocolVersion 1-6
#
# General fixes from the mod_sftp forum
SFTPClientMatch ".*WS_FTP.*" channelWindowSize 1GB #WS_FTP initial window size
SFTPClientMatch ".*ClientSftp" sftpProtocolVersion 3 #CuteFTPPro8
SFTPClientMatch ".*WinSCP.*" sftpProtocolVersion 3 #upload/download fix for WinSCP
#
# SecureBlackbox (SSH-2.0-SecureBlackbox.7)
# http://www.eldos.com/sbb/download-release.php
SFTPClientMatch ".*SecureBlackbox.*" sftpProtocolVersion 3
#
# GoAnywhere (SSH-2.0-1.0)
# http://www.goanywheremft.com/products
SFTPClientMatch "1.0" sftpProtocolVersion 3 channelWindowSize 1GB
#
# JaSFtp (SSH-2.0-J2SSH_Maverick_1.2.10_Sterling Commerce)
# http://www.hiteksoftware.com/jasf/
SFTPClientMatch ".*J2SSH_Maverick.*" channelWindowSize 1GB
#
# Robo-FTP (SSH-2.0-WeOnlyDo)
# http://www.robo-ftp.com/
SFTPClientMatch ".*WeOnlyDo.*" sftpProtocolVersion 3 channelWindowSize 1GB
#
# Network Automation (SSH-2.0-EldoS.SSHBlackbox.3)
# http://www.networkautomation.com/
SFTPClientMatch ".*EldoS.SSHBlackbox.3.*" sftpProtocolVersion 3 channelWindowSize 1GB
#
# /n Software BizTalk SFTP Receive (SSH-2.0-IP*Works! SSH Client v8.0)
# http://www.nsoftware.com/products/biztalk/adapters/sftp.aspx
SFTPClientMatch ".*IP.Works.*" channelWindowSize 1GB
#
# JSch - Java Secure Channel (SSH-2.0-JSCH-0.1.39)
# http://www.jcraft.com/jsch/
SFTPClientMatch "JSCH.*" channelWindowSize 1GB
</VirtualHost>
</IfModule>
答案1
与 Apache 不同，在 ProFTPD 配置文件中，不在任何<Global>或<VirtualHost>部分内的指令是不是自动全局应用；这涵盖在虚拟主机使用方法。
这意味着您的mod_wrap配置：
<IfModule mod_wrap.c>
TCPAccessFiles ~/.hosts.allow ~/.hosts.deny
</IfModule>
应用于 FTP 会话（通过“服务器配置”部分）。但是，您的 SFTP 会话由<VirtualHost>配置底部的显式配置处理，这是不同的配置部分。
要配置/使用mod_wrap您的 SFTP 会话，您可以复制<IfModule mod_wrap.c>部分之内SFTP<VirtualHost>部分，或者您可以将其放在<IfModule mod_wrap.c>一个<Global>部分内，以便将其应用于全部虚拟主机：
<Global>
<IfModule mod_wrap.c>
TCPAccessFiles ~/.hosts.allow ~/.hosts.deny
</IfModule>
</Global>
希望这可以帮助！