Eu descobri que isso é problema do módulo mod_vroot. Desativar no arquivo de configuração - linha de comentário LoadModule mod_vroot.c. Então está funcionando bem como esperado.
Não consigo encontrar ninguém que tenha esse problema estranho: Usuários de ftp podem fazer upload de arquivos, mas não são capazes de recuperá-los.
Por favor, dê-me qualquer pista para resolver este problema. Obrigado
"ftpuser1" é um usuário definido na tabela proftp-mysql com home:
/srv/ftp/users/ftpuser1
quando "ftpuser1" inicia uma sessão de ftp, ele é chrooted corretamente
então ele envia arquivos e cria diretórios em /srv/ftp/users/ftpuser1
mas quando ele tenta cwd ou recuperar um arquivo ele tem 500 erros e parece que ele está tentando ler de /
usuário virtual ftpuser1 é mapeado para uid / gid 2001/2001 aqui estão todas as permissões de diretório
# ls -aldn /srv /srv/ftp /srv/ftp/users /srv/ftp/users/ftpuser1
/srv/ftp/users/ftpuser1/directory1/
drwxr-xr-x. 3 0 0 16 May 23 2016 /srv
drwxr-xr-x. 3 0 0 18 May 23 2016 /srv/ftp
drwxr-xr-x. 6 99 99 67 Sep 9 08:03 /srv/ftp/users
drwx------. 3 2001 2001 23 Sep 9 08:04 /srv/ftp/users/ftpuser1
drwxr-xr-x. 2 2001 2001 6 Sep 9 08:03 /srv/ftp/users/ftpuser1/directory1/
Além disso, com a opção -Z, parece que as flags do se linux estão ok
# ls -aldnZ /srv /srv/ftp /srv/ftp/users /srv/ftp/users/ftpuser1
/srv/ftp/users/ftpuser1/directory1/
drwxr-xr-x. 0 0 system_u:object_r:var_t:s0 /srv
drwxr-xr-x. 0 0 unconfined_u:object_r:public_content_t:s0 /srv/ftp
drwxr-xr-x. 99 99 unconfined_u:object_r:public_content_rw_t:s0 /srv/ftp/users
drwx------. 2001 2001 unconfined_u:object_r:public_content_rw_t:s0 /srv/ftp/users/ftpuser1
drwxr-xr-x. 2001 2001 unconfined_u:object_r:public_content_rw_t:s0 /srv/ftp/users/ftpuser1/directory1/
Eu desabilitei o selinux e nada muda Eu não encontrei nada nos logs do proftpd ou log de auditoria
Estou usando este pacote no centos 7
proftpd
Arch : x86_64
Version : 1.3.5e
Release : 2.el7
proftpd-mysql
Arch : x86_64
Version : 1.3.5e
Release : 2.el7
From repo : epel
proftpd + log mod_mysql com depuração 10
proftpd.conf com mod_mysql
# This is the ProFTPD configuration file
# Trace logging, disabled by default for performance reasons
# (http://www.proftpd.org/docs/howto/Tracing.html)
TraceLog /var/log/proftpd/trace.log
Trace DEFAULT:0
TransferLog /var/log/proftpd/xferlog
SystemLog /var/log/proftpd/proftpd.log
ServerName "ProFTPD server"
ServerIdent on "FTP Server ready."
ServerAdmin root@localhost
DefaultServer on
ListOptions "-l"
DenyFilter \*.*/
# Use this to jail all users in their homes
DefaultRoot ~
# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
# RequireValidShell off
# Port 21 is the standard FTP port.
Port 21
PassivePorts 1024 1048
# Don't do reverse DNS lookups (hangs on DNS problems)
UseReverseDNS off
# Set the user and group that the server runs as
User nobody
Group nobody
CreateHome true
# To prevent DoS attacks, set the maximum number of child processes
# to 20. If you need to allow more than 20 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode; in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 20
# Disable sendfile by default since it breaks displaying the download speeds in
# ftptop and ftpwho
UseSendfile off
# Define the log formats
LogFormat default "%h %l %u %t \"%r\" %s %b"
LogFormat auth "%v [%P] %h %t \"%r\" %s"
# Dynamic Shared Object (DSO) loading
# See README.DSO and howto/DSO.html for more details
#
# General database support (http://www.proftpd.org/docs/contrib/mod_sql.html)
LoadModule mod_sql.c
# Mysql support (requires proftpd-mysql package)
# (http://www.proftpd.org/docs/contrib/mod_sql.html)
LoadModule mod_sql_mysql.c
# Quota support (http://www.proftpd.org/docs/contrib/mod_quotatab.html)
LoadModule mod_quotatab.c
# SQL database "driver" for storing quota table information in SQL tables
# (http://www.proftpd.org/docs/contrib/mod_quotatab_sql.html)
LoadModule mod_quotatab_sql.c
# Administrative control actions for the ftpdctl program
# (http://www.proftpd.org/docs/contrib/mod_ctrls_admin.html)
LoadModule mod_ctrls_admin.c
#
# Implement a virtual chroot capability that does not require root privileges
# (http://www.castaglia.org/proftpd/modules/mod_vroot.html)
# Using this module rather than the kernel's chroot() system call works
# around issues with PAM and chroot (http://bugzilla.redhat.com/506735)
LoadModule mod_vroot.c
# Allow only user root to load and unload modules, but allow everyone
# to see which modules have been loaded
# (http://www.proftpd.org/docs/modules/mod_dso.html#ModuleControlsACLs)
ModuleControlsACLs insmod,rmmod allow user root
ModuleControlsACLs lsmod allow user *
# Enable basic controls via ftpdctl
# (http://www.proftpd.org/docs/modules/mod_ctrls.html)
ControlsEngine on
ControlsACLs all allow user root
ControlsSocketACL allow user *
ControlsLog /var/log/proftpd/controls.log
# Enable admin controls via ftpdctl
# (http://www.proftpd.org/docs/contrib/mod_ctrls_admin.html)
<IfModule mod_ctrls_admin.c>
AdminControlsEngine on
AdminControlsACLs all allow user root
</IfModule>
# Enable mod_vroot by default for better compatibility with PAM
# (http://bugzilla.redhat.com/506735)
<IfModule mod_vroot.c>
VRootEngine on
</IfModule>
# Dynamic ban lists (http://www.proftpd.org/docs/contrib/mod_ban.html)
# Enable this with PROFTPD_OPTIONS=-DDYNAMIC_BAN_LISTS in /etc/sysconfig/proftpd
<IfDefine DYNAMIC_BAN_LISTS>
LoadModule mod_ban.c
BanEngine on
BanLog /var/log/proftpd/ban.log
BanTable /var/run/proftpd/ban.tab
# If the same client reaches the MaxLoginAttempts limit 2 times
# within 10 minutes, automatically add a ban for that client that
# will expire after one hour.
BanOnEvent MaxLoginAttempts 2/00:10:00 01:00:00
# Inform the user that it's not worth persisting
BanMessage "Host %a has been banned"
# Allow the FTP admin to manually add/remove bans
BanControlsACLs all allow user ftpadm
</IfDefine>
# Set networking-specific "Quality of Service" (QoS) bits on the packets used
# by the server (contrib/mod_qos.html)
<IfDefine QOS>
LoadModule mod_qos.c
# RFC791 TOS parameter compatibility
QoSOptions dataqos throughput ctrlqos lowdelay
# For a DSCP environment (may require tweaking)
#QoSOptions dataqos CS2 ctrlqos AF41
</IfDefine>
# Global Config - config common to Server Config and all virtual hosts
# See: http://www.proftpd.org/docs/howto/Vhost.html
<Global>
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable
Umask 022
# Allow users to overwrite files and change permissions
AllowOverwrite yes
</Global>
#
# Proftpd sample configuration for SQL-based authentication.
#
# (This is not to be used if you prefer a PAM-based SQL authentication)
#
<IfModule mod_sql.c>
DefaultRoot ~
#
# Choose a SQL backend among MySQL or PostgreSQL.
# Both modules are loaded in default configuration, so you have to specify the backend
# or comment out the unused module in /etc/proftpd/modules.conf.
# Use 'mysql' or 'postgres' as possible values.
#
SQLBackend mysql
#
SQLEngine on
SQLAuthenticate on
#
# Use both a crypted or plaintext password
#SQLAuthTypes Crypt Plaintext
#
# Use a backend-crypted or a crypted password
#SQLAuthTypes Backend Crypt
#
SQLAuthTypes OpenSSL Crypt Plaintext
# Connection
#SQLConnectInfo [email protected] proftpd_user proftpd_password
SQLConnectInfo ftp@localhost dedalo dedalo
#
# Describes both users/groups tables
#
SQLUserInfo ftpuser userid passwd uid gid homedir shell
SQLGroupInfo ftpgroup groupname gid members
# set min UID and GID - otherwise these are 999 each
SQLMinID 98
SQLNamedQuery updatecount UPDATE "count=count+1, accessed=now() WHERE userid='%u'" ftpuser
# Update modified everytime user uploads or deletes a file
SQLLog STOR,DELE modified
SQLNamedQuery modified UPDATE "modified=now() WHERE userid='%u'" ftpuser
# User quotas
# ===========
QuotaEngine on
QuotaDirectoryTally on
QuotaDisplayUnits Mb
QuotaShowQuotas on
SQLNamedQuery get-quota-limit SELECT "name, quota_type, per_session, limit_type, bytes_in_avail, bytes_out_avail, bytes_xfer_avail, files_in_avail, files_out_avail, files_xfer_avail FROM ftpquotalimits WHERE name = '%{0}' AND quota_type = '%{1}'"
SQLNamedQuery get-quota-tally SELECT "name, quota_type, bytes_in_used, bytes_out_used, bytes_xfer_used, files_in_used, files_out_used, files_xfer_used FROM ftpquotatallies WHERE name = '%{0}' AND quota_type = '%{1}'"
SQLNamedQuery update-quota-tally UPDATE "bytes_in_used = bytes_in_used + %{0}, bytes_out_used = bytes_out_used + %{1}, bytes_xfer_used = bytes_xfer_used + %{2}, files_in_used = files_in_used + %{3}, files_out_used = files_out_used + %{4}, files_xfer_used = files_xfer_used + %{5} WHERE name = '%{6}' AND quota_type = '%{7}'" ftpquotatallies
SQLNamedQuery insert-quota-tally INSERT "%{0}, %{1}, %{2}, %{3}, %{4}, %{5}, %{6}, %{7}" ftpquotatallies
QuotaLimitTable sql:/get-quota-limit
QuotaTallyTable sql:/get-quota-tally/update-quota-tally/insert-quota-tally
SqlLogFile /var/log/proftpd/sql.log
</IfModule>
Acredito que o problema é que, por algum motivo, suas permissões em /srv/ftp/users/ftpuser1 não estão corretas. Você deve verificar se ftpuser1 tem controle total sobre a pasta.
Execute ls -l /src/ftp/users | grep ftpuser1 e veja quais permissões ele possui e quem é o proprietário da pasta.
Se ftpuser1 não possui a pasta, tente apropriar-se de sudo chown ftpuser1:ftpuser1 /srv/ftp/users/ftpuser1 .
Alguém mais teve um problema semelhante aqui: Não é possível excluir ou editar arquivos no servidor ProFTPD
Postar seu arquivo de configuração também nos ajudará muito mais.
Além disso, quando seus usuários tiverem CHROOT ativado e o cliente disser que estão tentando ler / gravar em / . Ele está se referindo a / como seu diretório de trabalho atual NÃO a raiz real do próprio SO.
RESOLVIDO!
Eu fiz um yum -y update , eu recomendo uma atualização completa de todos os pacotes instalados em bibliotecas específicas do sistema
Este novo pacote resolveu os problemas que eu tinha em usuários virtuais:
proftpd
Arch : x86_64
Version : 1.3.5e
Release : 4.el7
proftpd-mysql
Arch : x86_64
Version : 1.3.5e
Release : 4.el7
From repo : epel
Tags proftpd