Home / Browse / ProFTPD Server Software / Mail / Archive

ProFTPD Server Software

Email Archive: proftp-committers (read-only)

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-04 21:39

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tanya@...  2003-12-04 16:39 -------
Although I don't use ldap authentication, the version I'm using does include the module in the 
build as well as TLS

  $ ./configure --prefix=/ngs/app/ftpprod --with-modules=mod_tls:mod_ldap





------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

Thread View

Thread	Author	Date
[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.	<bugzilla-daemon@ho...>

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-02 18:42

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tanya@...  2003-12-02 13:42 -------
Here is the debugging output. In attempts to reproduce the problem in our test environment I 
found that the problem is with chroot-ing the user. The problem does not exist if the server is not 
configured to Chroot to ~

cartman.apple.com (scrappy.apple.com[17.216.21.133]) - USER untitled_1: Login successful.
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - ROOT PRIVS at mod_auth.c:1174
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - opening TransferLog '/var/log/xferlog'
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - RELINQUISH PRIVS at mod_auth.c:1203
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - USER PRIVS 1027 at mod_auth.c:701
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "getpwnam" to 
module mod_ldap
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "getpwnam" to 
module mod_auth_file
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "getpwnam" to 
module mod_auth_unix
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - RELINQUISH PRIVS at mod_auth.c:705
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "setpwent" to 
module mod_ldap
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "setpwent" to 
module mod_auth_file
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "setpwent" to 
module mod_auth_unix
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "setgrent" to 
module mod_ldap
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "setgrent" to 
module mod_auth_file
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "setgrent" to 
module mod_auth_unix
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "getpwent" to 
module mod_auth_file
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "getpwent" to 
module mod_auth_unix
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "getgrent" to 
module mod_auth_file
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "getgrent" to 
module mod_auth_unix
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - Preparing to chroot() the environment, 
path = '~/'
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - ROOT PRIVS at mod_auth.c:62
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - FS: using system chroot()
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - RELINQUISH PRIVS at mod_auth.c:64
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - untitled_1 chroot("~/"): No such file or 
directory
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - error: unable to set default root 
directory
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "endpwent" to 
module mod_ldap
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "endpwent" to 
module mod_auth_file
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "endpwent" to 
module mod_auth_unix
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "endgrent" to 
module mod_ldap
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "endgrent" to 
module mod_auth_file
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "endgrent" to 
module mod_auth_unix
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - FTP session closed.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-02 19:31

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tj@...  2003-12-02 14:31 -------
OK.  This message in particular:

  cartman.apple.com (scrappy.apple.com[17.216.21.133]) - untitled_1
chroot("~/"):No such file or directory

means that proftpd is having trouble interpolating '~' to be the user's real
home directory.  When proftpd does this interpolation, it checks that the home
directory is reachable using the user's privileges (not as root), before doing
the actual chroot.  This check is to prevent users from being inadvertently
chrooted into directories in which they can do nothing.  What are the
permissions and ownership of the home directory in question?



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-02 19:54

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tanya@...  2003-12-02 14:54 -------
The user does have access to their own home directory, proven by being able to access the sayem 
system via ssh and get a shell without a "permission denied" error.

Sorry for the longer-than-8-char username and group. It makes this potentially a bit confusing but 
the group and owner below is "untitled_1", not "untitled". 

[scrappy:~] tanya% ssh cartman -l untitled_1
untitled_1@... password: 
Welcome to Darwin!
[cartman:~] untitled_1% pwd
/Users/tanya/homedir/dir
[cartman:~] untitled_1% ls -ld /Users/tanya/homedir/dir
drwx------  2 untitled  untitled  68 Dec  2 10:15 /Users/tanya/homedir/dir
[cartman:~] untitled_1% ls -ld /Users/tanya/homedir/
drwxrwx---  3 tanya  untitled  102 Dec  2 10:15 /Users/tanya/homedir/
[cartman:~] untitled_1% ls -ld /Users/tanya/
drwxr-xr-x  41 tanya  staff  1394 Dec  2 10:15 /Users/tanya/
[cartman:~] untitled_1% ls -ld /Users/
drwxrwxr-t  9 root  wheel  306 Sep 30 17:07 /Users/
[cartman:~] untitled_1% ls -ld /
drwxrwxr-t  34 root  admin  1156 Sep  3 08:19 /

untitled_1:x:1027:1026::0:0:FTP User2:/Users/tanya/homedir/dir:/bin/tcsh
untitled_1::1026:





------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-02 19:56

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tanya@...  2003-12-02 14:56 -------
To reiterate, the behavior changed suddenly when upgrading from 1.2.8 to 1.2.9. Groups of users 
who were previously able to log in were now being denied.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-02 20:18

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tj@...  2003-12-02 15:18 -------
Hmm.  Do you have 'PersistentPasswd off' in your proftpd.conf?  I seem to recall
this being needed for some OSX setups for the netinfo service...



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-02 20:25

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tj@...  2003-12-02 15:25 -------
Created an attachment (id=1948)
 --> (http://bugs.proftpd.org/attachment.cgi?id=1948&action=view)
Adds logging of failed DefaultRoot path resolution

This patch adds some debug logging in the case where a DefaultRoot path is not
resolved properly; hopefully it will provide a better idea of what is happening
on your system...



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-02 21:56

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tanya@...  2003-12-02 16:55 -------
Tried applying the included patch. Hunk #2 fails with the patch command so I introduced the code 
changes by hand.

As-is, the build fails:

ld: Undefined symbols:
_pr_log_pri
make: *** [proftpd] Error 1

I made the assumption that it should have been log_pri instead of pr_log_pri, made the code 
change and complied a new binary.

The behavior this time was a hanging on the client side after entering the password and the 
following information in debug.

cartman.apple.com (scrappy.apple.com[17.216.21.133]) - ROOT PRIVS at mod_auth.c:1180
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - opening TransferLog '/var/log/xferlog'
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - RELINQUISH PRIVS at mod_auth.c:1209
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - USER PRIVS 1027 at mod_auth.c:702
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "getpwnam" to 
module mod_ldap
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "getpwnam" to 
module mod_auth_file
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - dispatching auth request "getpwnam" to 
module mod_auth_unix
cartman.apple.com (scrappy.apple.com[17.216.21.133]) - RELINQUISH PRIVS at mod_auth.c:706

hangs for a couple seconds

cartman.apple.com - scrubbing scoreboard
cartman.apple.com - ROOT PRIVS at mod_core.c:194
cartman.apple.com - RELINQUISH PRIVS at mod_core.c:201
cartman.apple.com - ROOT PRIVS at mod_core.c:223
cartman.apple.com - RELINQUISH PRIVS at mod_core.c:251
cartman.apple.com - FS: using system lstat()

hangs for about 10 seconds

cartman.apple.com - scrubbing scoreboard
cartman.apple.com - ROOT PRIVS at mod_core.c:194
cartman.apple.com - RELINQUISH PRIVS at mod_core.c:201
cartman.apple.com - ROOT PRIVS at mod_core.c:223
cartman.apple.com - RELINQUISH PRIVS at mod_core.c:251
cartman.apple.com - FS: using system lstat()

repeats above after hanging for a while again, several times until cntrl-c





------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-02 23:18

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tj@...  2003-12-02 18:18 -------
Very odd -- that patch should introduce no "hangs".  The scrubbing messages are
from the daemon process, not the session process, and are simply reports that
the daemon process is scrubbing the scoreboard file for dead sessions.  The
absence of the added log message implies that dir_realpath() is indeed returning
a string -- just not the one expected.  Hrm.

Do you have 'PersistentPasswd off' in your proftpd.conf?



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-02 23:37

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tanya@...  2003-12-02 18:37 -------
I do not have the setting PersistentPasswd in my config file. It is very close to the default provided 
with the software.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-03 00:37

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tj@...  2003-12-02 19:37 -------
Ok.  Could you try adding 'PersistentPasswd off' to your proftpd.conf, to see if
that makes a difference?



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-03 17:40

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tanya@...  2003-12-03 12:40 -------
I added this line to my proftpd.conf:

PersistentPasswd                off

It did not make a difference to the behavior. It still went through the same hang as before.

It did not mention the new parameter in the debug mode at startup but I checked it in the file a 
couple times:

cartman.apple.com - Config for ProFTPD Default Installation:
cartman.apple.com - /
cartman.apple.com -  AllowOverwrite
cartman.apple.com -  Umask
cartman.apple.com - DefaultServer
cartman.apple.com - Umask
cartman.apple.com - UserID
cartman.apple.com - UserName
cartman.apple.com - GroupID
cartman.apple.com - GroupName
cartman.apple.com - DefaultRoot
cartman.apple.com - TLSEngine
cartman.apple.com - TLSLog
cartman.apple.com - TLSRequired
cartman.apple.com - TLSRSACertificateFile
cartman.apple.com - TLSRSACertificateKeyFile
cartman.apple.com - TLSCACertificateFile
cartman.apple.com - TLSVerifyClient
cartman.apple.com - dispatching auth request "getgroups" to module mod_ldap
cartman.apple.com - dispatching auth request "getgroups" to module mod_auth_file
cartman.apple.com - dispatching auth request "getgroups" to module mod_auth_unix
cartman.apple.com - SETUP PRIVS at main.c:2704
cartman.apple.com - ROOT PRIVS at main.c:1956
cartman.apple.com - RELINQUISH PRIVS at main.c:1962
cartman.apple.com - ROOT PRIVS at main.c:2323
cartman.apple.com - opening scoreboard '/ngs/app/ftpprod/var/proftpd/proftpd.scoreboard'
cartman.apple.com - RELINQUISH PRIVS at main.c:2347
cartman.apple.com - ROOT PRIVS at inet.c:402
cartman.apple.com - RELINQUISH PRIVS at inet.c:417
cartman.apple.com - ROOT PRIVS at inet.c:452
cartman.apple.com - RELINQUISH PRIVS at inet.c:510
cartman.apple.com - ProFTPD 1.2.9 (stable) (built Tue Dec 2 13:53:28 PST 2003) standalone mode 
STARTUP




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2003-12-04 21:39

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tanya@...  2003-12-04 16:39 -------
Although I don't use ldap authentication, the version I'm using does include the module in the 
build as well as TLS

  $ ./configure --prefix=/ngs/app/ftpprod --with-modules=mod_tls:mod_ldap





------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2004-02-23 19:59

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tj@...  2004-02-23 14:22 -------
Hmm.  Can you use the current CVS sources and obtain the debugging output again,
using -d10?  This new debugging level reports on the GIDs found for the
logging-in user, and it sounds like this may be related to a problem with
discovering all of the groups for user2.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2004-03-02 19:34

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tanya@...  2004-03-02 14:29 -------
Request noted. I'll try to get to it soon.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2004-04-22 16:34

http://bugs.proftpd.org/show_bug.cgi?id=2293

tj@... changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |waiting





------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2004-05-07 17:24

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tj@...  2004-05-07 13:24 -------
Any luck with this?



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2004-05-07 20:51

http://bugs.proftpd.org/show_bug.cgi?id=2293





------- Additional Comments From tanya@...  2004-05-07 16:51 -------
I am no longer able to reproduce this problem. I am not running a newer copy of proftpd but I am 
running a newer rev of OSX 10.2. 



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2004-05-07 21:00

http://bugs.proftpd.org/show_bug.cgi?id=2293

tj@... changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
           Keywords|waiting                     |
         Resolution|                            |WORKSFORME



------- Additional Comments From tj@...  2004-05-07 17:00 -------
OK.  I'll close this report, then; please reopen if you see that behavior again.
 Thanks!



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[ProFTPD-committers] [Bug 2293] Odd login rejections based on directory permissions.

From: <bugzilla-daemon@ho...> - 2004-05-07 21:00

http://bugs.proftpd.org/show_bug.cgi?id=2293

tj@... changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED





------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.