☰

ProFTPd：SFTP“get”命令被拒绝（“put”命令可以正常工作）

tag-icon • tag-icon redhat sftp proftpd
ProFTPd：SFTP“get”命令被拒绝（“put”命令可以正常工作）

我在 RHEL 8.6 上使用 proftpd 1.3.8a 时遇到了这个问题

我有一个 proftpd 服务器设置，其中有一个名为 IFTPTEST 的用户。在其主目录中，该用户有 2 个目录，in/ 和 out/。我的目标是：我将文件放在 out/ 目录中，然后用户连接到服务器（使用用户/密码）来获取文件。

当用户连接时，它可以进入 out/ 目录，列出目录的内容并将文件放入目录中。但是，当它尝试获取文件时，我有一个没有权限错误 ：

sftp> ls -al
drwxrwxr-x    3 IFTPTEST 1000         4096 Nov  9 10:02 .
drwxrwxr-x    3 IFTPTEST 1000         4096 Nov  9 10:02 ..
drwxrwxr-x    2 IFTPTEST 1000         4096 Nov  9 10:08 in
drwxrwxrwx    2 IFTPTEST 1000         4096 Nov  9 10:05 out
sftp> cd out
sftp> ls -al
drwxrwxrwx    2 IFTPTEST 1000         4096 Nov  9 10:05 .
drwxrwxr-x    3 IFTPTEST 1000         4096 Nov  9 10:02 ..
-rwxrwxrwx    1 IFTPTEST 1000           13 Nov  9 10:05 test
sftp> get test test.txt
Fetching /out/test to test.txt
remote open("/out/test"): Permission denied

即使 out/ 目录和具有 777 权限的测试文件，我还是得到了没有权限。

在 sftp.log 中，我可以看到：

OPEN command for '/out/test' blocked by 'RETR' handler

在 /var/log/messages 中：

RETR /appli_var/XFRF/xfrf_files/ftpusers/IFTPTEST/out/test denied by <Limit> configuration

我不明白这一点，因为我的 proftpd.conf 中的 out/ 目录有 RETR 设置（见下文）。

这是一个已知问题吗？我的配置有问题吗？

proftpd.conf的内容（我没有放整个文件）：

# Proftpd server configuration

[...]

LoadModule mod_vroot.c
<Global>
   VRootEngine              on
   VRootLog                 /appli_var/XFRF/proftpd/vroot.log
   VRootOptions             allowSymlinks
   DefaultRoot ~
</Global>

[...]

# Directory limits
<Global>
   <Directory />
      <Limit ALL>
         DenyAll
      </Limit>
      <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD STAT XCUP XPWD OPENDIR READDIR REALPATH LSTAT FSTAT SETSTAT STOR SITE_CHMOD>
         AllowAll
      </Limit>
   </Directory>
   <Directory /in>
      <Limit ALL>
         DenyAll
      </Limit>
      <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD STAT XCUP XPWD RETR SIZE APPE DELE RNFR RNTO STOR STOU SITE_CHMOD SETSTAT FSETSTAT LSTAT FSTAT READ>
         AllowAll
      </Limit>
   </Directory>
   <Directory /out>
      <Limit ALL>
         DenyAll
      </Limit>
      <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD STAT XCUP XPWD RETR SIZE DELE SITE_CHMOD SETSTAT FSETSTAT LSTAT FSTAT READ>
         AllowAll
      </Limit>
   </Directory>
</Global>

[...]

LoadModule mod_sftp.c
# SFTP virtual server (user/password authentication)
# ----------------------------------------------------
<VirtualHost 10.19.xx.xxx>
    <Limit LOGIN>
      AllowAll
    </Limit>
    ServerName                  "SFTP Server"
    Port                        20022
    AccessGrantMsg              "Welcome to SFTP %u"
    SFTPEngine                  on
    SFTPHostKey                 /appli/XFRF/proftpd/etc/ssh/proftpd_dsa_key
    SFTPHostKey                 /appli/XFRF/proftpd/etc/ssh/proftpd_rsa_key
    SFTPHostKey                 /appli/XFRF/proftpd/etc/ssh/proftpd_ecdsa_key
    SFTPAuthMethods             password
    SFTPCompression             delayed
    SFTPLog                     /appli_var/XFRF/proftpd/sftp.log
    ExtendedLog                 /appli_var/XFRF/proftpd/sftp_extended.log
    TransferLog                 /appli_var/XFRF/proftpd/sftp_transfer.log
    ServerLog                   /appli_var/XFRF/proftpd/sftp_server.log
</VirtualHost>

[...]

如果有必要，我可以在 /var/log/messages 中查看更多信息：

dispatching PRE_CMD command 'LSTAT /out/test' to mod_tls
dispatching PRE_CMD command 'LSTAT /out/test' to mod_exec
dispatching PRE_CMD command 'LSTAT /out/test' to mod_core
dispatching PRE_CMD command 'LSTAT /out/test' to mod_core
in dir_check(): setting umask to 0022 (was 0022)
dispatching POST_CMD command 'LSTAT /out/test' to mod_exec
dispatching LOG_CMD command 'LSTAT /out/test' to mod_log
dispatching PRE_CMD command 'STAT /out/test' to mod_tls
dispatching PRE_CMD command 'STAT /out/test' to mod_exec
dispatching PRE_CMD command 'STAT /out/test' to mod_core
dispatching PRE_CMD command 'STAT /out/test' to mod_core
in dir_check(): setting umask to 0022 (was 0022)
dispatching POST_CMD command 'STAT /out/test' to mod_exec
dispatching LOG_CMD command 'STAT /out/test' to mod_log
dispatching PRE_CMD command 'RETR /out/test' to mod_tls
dispatching PRE_CMD command 'RETR /out/test' to mod_exec
dispatching PRE_CMD command 'RETR /out/test' to mod_core
dispatching PRE_CMD command 'RETR /out/test' to mod_core
dispatching PRE_CMD command 'RETR /out/test' to mod_vroot
dispatching PRE_CMD command 'RETR /out/test' to mod_vroot
dispatching PRE_CMD command 'RETR /out/test' to mod_auth
dispatching PRE_CMD command 'RETR /out/test' to mod_xfer
in dir_check_full(): path = '/appli_var/XFRF/xfrf_files/ftpusers/IFTPTEST/out/test', fullpath = '/appli_var/XFRF/xfrf_files/ftpusers/IFTPTEST/out/test'
RETR /appli_var/XFRF/xfrf_files/ftpusers/IFTPTEST/out/test denied by <Limit> configuration
dispatching POST_CMD_ERR command 'RETR /out/test' to mod_exec
dispatching POST_CMD_ERR command 'RETR /out/test' to mod_vroot
dispatching POST_CMD_ERR command 'RETR /out/test' to mod_auth
dispatching LOG_CMD_ERR command 'RETR /out/test' to mod_log
dispatching LOG_CMD_ERR command 'RETR /out/test' to mod_xfer
dispatching POST_CMD_ERR command 'OPEN /out/test' to mod_exec
dispatching LOG_CMD_ERR command 'OPEN /out/test' to mod_log

答案1

RETR（以及）命令READ必须添加到“/”部分，而不仅仅是“/ou”部分。因此，经过更正后，它看起来像这样：

# Directory limits
<Global>
   <Directory />
      <Limit ALL>
         DenyAll
      </Limit>
      <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD STAT XCUP XPWD OPENDIR READDIR REALPATH LSTAT FSTAT SETSTAT STOR SITE_CHMOD READ RETR>
         AllowAll
      </Limit>
   </Directory>
   <Directory /in>
      <Limit ALL>
         DenyAll
      </Limit>
      <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD STAT XCUP XPWD RETR SIZE APPE DELE RNFR RNTO STOR STOU SITE_CHMOD SETSTAT FSETSTAT LSTAT FSTAT READ>
         AllowAll
      </Limit>
   </Directory>
   <Directory /out>
      <Limit ALL>
         DenyAll
      </Limit>
      <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD STAT XCUP XPWD RETR SIZE DELE SITE_CHMOD SETSTAT FSETSTAT LSTAT FSTAT READ>
         AllowAll
      </Limit>
   </Directory>
</Global>

这样，GET命令就可以毫无问题地运行了。

相关内容