centos 7 上 proftpd 与 proftp-mysql：用户可以登录/上传文件，但无法检索文件或 CWD

Question

我找不到任何遇到这个奇怪问题的人：ftp 用户能够上传文件但无法检索它们。

请提供任何线索来解决这个问题。谢谢

“ftpuser1”是在 proftp-mysql 表中定义的用户，其主目录为： /srv/ftp/users/ftpuser1

当“ftpuser1”启动 ftp 会话时，他被正确地 chrooted，因此他上传文件并创建目录，/srv/ftp/users/ftpuser1 但是当他尝试 cwd 或检索文件时，他收到 500 错误，似乎他正在尝试读取/

虚拟用户 ftpuser1 映射到 uid/gid 2001/2001 这里是所有目录权限

# ls -aldn /srv /srv/ftp /srv/ftp/users /srv/ftp/users/ftpuser1 
/srv/ftp/users/ftpuser1/directory1/
drwxr-xr-x. 3    0    0 16 May 23  2016 /srv
drwxr-xr-x. 3    0    0 18 May 23  2016 /srv/ftp
drwxr-xr-x. 6   99   99 67 Sep  9 08:03 /srv/ftp/users
drwx------. 3 2001 2001 23 Sep  9 08:04 /srv/ftp/users/ftpuser1
drwxr-xr-x. 2 2001 2001  6 Sep  9 08:03 /srv/ftp/users/ftpuser1/directory1/

此外，使用 -Z 选项，似乎 se linux 标志是可以的

# ls -aldnZ /srv /srv/ftp /srv/ftp/users /srv/ftp/users/ftpuser1 
/srv/ftp/users/ftpuser1/directory1/
drwxr-xr-x.    0    0 system_u:object_r:var_t:s0       /srv
drwxr-xr-x.    0    0 unconfined_u:object_r:public_content_t:s0 /srv/ftp
drwxr-xr-x.   99   99 unconfined_u:object_r:public_content_rw_t:s0 /srv/ftp/users
drwx------. 2001 2001 unconfined_u:object_r:public_content_rw_t:s0 /srv/ftp/users/ftpuser1
drwxr-xr-x. 2001 2001 unconfined_u:object_r:public_content_rw_t:s0 /srv/ftp/users/ftpuser1/directory1/

我已经禁用了 selinux，但没有任何变化，我在 proftpd 日志或审计日志中没有发现任何内容

我在 centos 7 上使用此软件包

proftpd
Arch        : x86_64
Version     : 1.3.5e
Release     : 2.el7

proftpd-mysql
Arch        : x86_64
Version     : 1.3.5e
Release     : 2.el7


From repo   : epel

proftpd + mod_mysql 日志带调试 10

proftpd.conf 和 mod_mysql

# This is the ProFTPD configuration file

# Trace logging, disabled by default for performance reasons
# (http://www.proftpd.org/docs/howto/Tracing.html)
TraceLog            /var/log/proftpd/trace.log
Trace               DEFAULT:0
TransferLog /var/log/proftpd/xferlog
SystemLog   /var/log/proftpd/proftpd.log


ServerName      "ProFTPD server"
ServerIdent     on "FTP Server ready."
ServerAdmin     root@localhost
DefaultServer       on
ListOptions     "-l"

DenyFilter          \*.*/

# Use this to jail all users in their homes 
DefaultRoot         ~

# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
# RequireValidShell     off

# Port 21 is the standard FTP port.
Port                21
PassivePorts        1024 1048

# Don't do reverse DNS lookups (hangs on DNS problems)
UseReverseDNS       off

# Set the user and group that the server runs as
User                nobody
Group               nobody
CreateHome          true


# To prevent DoS attacks, set the maximum number of child processes
# to 20.  If you need to allow more than 20 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode; in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances            20

# Disable sendfile by default since it breaks displaying the download speeds in
# ftptop and ftpwho
UseSendfile         off

# Define the log formats
LogFormat           default "%h %l %u %t \"%r\" %s %b"
LogFormat           auth    "%v [%P] %h %t \"%r\" %s"

# Dynamic Shared Object (DSO) loading
# See README.DSO and howto/DSO.html for more details
#
# General database support (http://www.proftpd.org/docs/contrib/mod_sql.html)
   LoadModule mod_sql.c

# Mysql support (requires proftpd-mysql package)
# (http://www.proftpd.org/docs/contrib/mod_sql.html)
   LoadModule mod_sql_mysql.c

# Quota support (http://www.proftpd.org/docs/contrib/mod_quotatab.html)
   LoadModule mod_quotatab.c


# SQL database "driver" for storing quota table information in SQL tables
# (http://www.proftpd.org/docs/contrib/mod_quotatab_sql.html)
   LoadModule mod_quotatab_sql.c

# Administrative control actions for the ftpdctl program
# (http://www.proftpd.org/docs/contrib/mod_ctrls_admin.html)
LoadModule mod_ctrls_admin.c
#

# Implement a virtual chroot capability that does not require root privileges
# (http://www.castaglia.org/proftpd/modules/mod_vroot.html)
# Using this module rather than the kernel's chroot() system call works
# around issues with PAM and chroot (http://bugzilla.redhat.com/506735)
LoadModule mod_vroot.c

# Allow only user root to load and unload modules, but allow everyone
# to see which modules have been loaded
# (http://www.proftpd.org/docs/modules/mod_dso.html#ModuleControlsACLs)
ModuleControlsACLs      insmod,rmmod allow user root
ModuleControlsACLs      lsmod allow user *

# Enable basic controls via ftpdctl
# (http://www.proftpd.org/docs/modules/mod_ctrls.html)
ControlsEngine          on
ControlsACLs            all allow user root
ControlsSocketACL       allow user *
ControlsLog         /var/log/proftpd/controls.log

# Enable admin controls via ftpdctl
# (http://www.proftpd.org/docs/contrib/mod_ctrls_admin.html)
<IfModule mod_ctrls_admin.c>
  AdminControlsEngine       on
  AdminControlsACLs     all allow user root
</IfModule>

# Enable mod_vroot by default for better compatibility with PAM
# (http://bugzilla.redhat.com/506735)
<IfModule mod_vroot.c>
  VRootEngine           on
</IfModule>


# Dynamic ban lists (http://www.proftpd.org/docs/contrib/mod_ban.html)
# Enable this with PROFTPD_OPTIONS=-DDYNAMIC_BAN_LISTS in /etc/sysconfig/proftpd
<IfDefine DYNAMIC_BAN_LISTS>
  LoadModule            mod_ban.c
  BanEngine         on
  BanLog            /var/log/proftpd/ban.log
  BanTable          /var/run/proftpd/ban.tab

  # If the same client reaches the MaxLoginAttempts limit 2 times
  # within 10 minutes, automatically add a ban for that client that
  # will expire after one hour.
  BanOnEvent            MaxLoginAttempts 2/00:10:00 01:00:00

  # Inform the user that it's not worth persisting
  BanMessage            "Host %a has been banned"

  # Allow the FTP admin to manually add/remove bans
  BanControlsACLs       all allow user ftpadm
</IfDefine>

# Set networking-specific "Quality of Service" (QoS) bits on the packets used
# by the server (contrib/mod_qos.html)
<IfDefine QOS>
  LoadModule            mod_qos.c
  # RFC791 TOS parameter compatibility
  QoSOptions            dataqos throughput ctrlqos lowdelay
  # For a DSCP environment (may require tweaking)
  #QoSOptions           dataqos CS2 ctrlqos AF41
</IfDefine>

# Global Config - config common to Server Config and all virtual hosts
# See: http://www.proftpd.org/docs/howto/Vhost.html
<Global>

  # Umask 022 is a good standard umask to prevent new dirs and files
  # from being group and world writable
  Umask             022

  # Allow users to overwrite files and change permissions
  AllowOverwrite        yes
</Global>

#
# Proftpd sample configuration for SQL-based authentication.
#
# (This is not to be used if you prefer a PAM-based SQL authentication)
#

<IfModule mod_sql.c>

DefaultRoot                     ~   
#
# Choose a SQL backend among MySQL or PostgreSQL.
# Both modules are loaded in default configuration, so you have to specify the backend 
# or comment out the unused module in /etc/proftpd/modules.conf.
# Use 'mysql' or 'postgres' as possible values.
#
SQLBackend  mysql
#
SQLEngine on
SQLAuthenticate on
#
# Use both a crypted or plaintext password 
#SQLAuthTypes Crypt Plaintext
#
# Use a backend-crypted or a crypted password
#SQLAuthTypes Backend Crypt 
# 
SQLAuthTypes OpenSSL Crypt Plaintext

# Connection 
#SQLConnectInfo [email protected] proftpd_user proftpd_password
SQLConnectInfo ftp@localhost dedalo dedalo
#
# Describes both users/groups tables
#
SQLUserInfo ftpuser userid passwd uid gid homedir shell
SQLGroupInfo ftpgroup groupname gid members

# set min UID and GID - otherwise these are 999 each
SQLMinID    98


SQLNamedQuery updatecount UPDATE "count=count+1, accessed=now() WHERE userid='%u'" ftpuser

# Update modified everytime user uploads or deletes a file
SQLLog  STOR,DELE modified
SQLNamedQuery modified UPDATE "modified=now() WHERE userid='%u'" ftpuser

# User quotas
# ===========
QuotaEngine on
QuotaDirectoryTally on
QuotaDisplayUnits Mb
QuotaShowQuotas on
SQLNamedQuery get-quota-limit SELECT "name, quota_type, per_session, limit_type, bytes_in_avail, bytes_out_avail, bytes_xfer_avail, files_in_avail, files_out_avail, files_xfer_avail FROM ftpquotalimits WHERE name = '%{0}' AND quota_type = '%{1}'"
SQLNamedQuery get-quota-tally SELECT "name, quota_type, bytes_in_used, bytes_out_used, bytes_xfer_used, files_in_used, files_out_used, files_xfer_used FROM ftpquotatallies WHERE name = '%{0}' AND quota_type = '%{1}'"
SQLNamedQuery update-quota-tally UPDATE "bytes_in_used = bytes_in_used + %{0}, bytes_out_used = bytes_out_used + %{1}, bytes_xfer_used = bytes_xfer_used + %{2}, files_in_used = files_in_used + %{3}, files_out_used = files_out_used + %{4}, files_xfer_used = files_xfer_used + %{5} WHERE name = '%{6}' AND quota_type = '%{7}'" ftpquotatallies
SQLNamedQuery insert-quota-tally INSERT "%{0}, %{1}, %{2}, %{3}, %{4}, %{5}, %{6}, %{7}" ftpquotatallies
QuotaLimitTable sql:/get-quota-limit
QuotaTallyTable sql:/get-quota-tally/update-quota-tally/insert-quota-tally
SqlLogFile /var/log/proftpd/sql.log

</IfModule>

Answer 1

我发现这是 mod_vroot 模块的问题。在配置文件中停用它 - 注释行 LoadModule mod_vroot.c。然后它就可以正常工作了。

Answer 2

我认为问题是由于某种原因，您的权限/srv/ftp/users/ftpuser1不正确。您应该验证您是否ftpuser1对该文件夹具有完全控制权。

• 运行ls -l /src/ftp/users | grep ftpuser1并查看它具有什么权限以及谁拥有该文件夹。

• 如果ftpuser1不拥有该文件夹，请尝试使用 获取所有权sudo chown ftpuser1:ftpuser1 /srv/ftp/users/ftpuser1。

• 重新启动 ProFTPD 并重试。

其他人在这里遇到了类似的问题： 无法删除或编辑 ProFTPD 服务器上的文件

发布您的配置文件也会对我们有很大帮助。

此外，当您的用户已CHROOT启用并且客户端表示他们正尝试从 读取/写入时/。它指的/是他们当前的工作目录，而不是操作系统本身的实际根目录。

Answer 3

解决了 ！

我做了一个yum-y 更新，我建议对特定系统库中所有已安装的软件包进行全面更新

这个新软件包解决了我在虚拟用户方面遇到的问题：

proftpd
Arch        : x86_64
Version     : 1.3.5e
Release     : 4.el7

proftpd-mysql
Arch        : x86_64
Version     : 1.3.5e
Release     : 4.el7


From repo   : epel