Ao conectar-se ao PROFTPD via SFTP, o mod_wrap não está sendo invocado

Question

Estamos usando o PROFTPD (versão 1.3.3e) e acabamos de notar que, se nos conectarmos ao servidor via FTP, podemos ver que o mod_wrap está sendo invocado:

De proftpd.log

May 27 10:46:16 li46 proftpd[10592] FTP session opened.
May 27 10:46:16 li46 proftpd[10592] mod_wrap/1.2.3: using access files: .hosts.allow, .hosts.deny
May 27 10:46:16 li46 proftpd[10592]  mod_wrap/1.2.3: allowed connection from xxx
May 27 10:46:16 li46 proftpd[10592] Preparing to chroot to directory '/XXX'
May 27 10:46:16 li46 proftpd[10592] : USER XXX: Login successful.

mas ao se conectar via SFTP, o mod_wrap não está sendo chamado:

De proftpd.log

May 27 11:21:47 li46 proftpd[11081] FTP session opened.
May 27 11:21:49 li46 proftpd[11081]  Preparing to chroot to directory '/home/XXX'
May 27 11:21:49 li46 proftpd[11081]  USER XXX: Login successful

De sftp.log

May 27 11:21:47 mod_sftp/0.9.7[11081]:  + Session server-to-client compression: none
May 27 11:21:47 mod_sftp/0.9.7[11081]:  + Session client-to-server language:
May 27 11:21:47 mod_sftp/0.9.7[11081]:  + Session server-to-client language:
May 27 11:21:48 mod_sftp/0.9.7[11081]: sending acceptable userauth methods: publickey,password
May 27 11:21:49 mod_sftp/0.9.7[11081]: sending userauth success
May 27 11:21:49 mod_sftp/0.9.7[11081]: user 'XXX' authenticated via 'password' method
May 27 11:21:49 mod_sftp/0.9.7[11081]: client sent SSH_MSG_IGNORE message (160 bytes)
May 27 11:21:49 mod_sftp/0.9.7[11081]: unsupported '[email protected]' channel requested, ignoring
May 27 11:21:49 mod_sftp/0.9.7[11081]: 'subsystem' channel request for 'sftp' subsystem
May 27 11:21:49 mod_sftp/0.9.7[11081]: using SFTP protocol version 3 for this session (channel ID 0)   

Alguém pode fornecer alguma orientação sobre por que isso está se comportando dessa maneira? Eu vasculhei fóruns e documentação e não encontrei nenhuma referência sobre se mod_wrap trabalha com mod_sftp ou não.

Os arquivos proftpd.conf são os seguintes:

# Includes DSO modules
Include /etc/proftpd/modules.conf

SetEnv TZ XXX/XXX

# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
UseIPv6 off
# If set on you can experience a longer connection delay in many cases.
IdentLookups off

ServerName "XXX"
ServerType standalone
DeferWelcome off

MultilineRFC2228 on
DefaultServer on
ShowSymlinks on
# We want to hide our dot files for a reason
# - BITS, 6th October 2010
ListOptions "" strict
<Limit All>
IgnoreHidden on
</Limit>
#
# ---
#
<Global>
  DefaultTransferMode binary
  SyslogLevel warn
  DefaultRoot ~
  DeleteAbortedStores on
  HiddenStores on
</Global>

DirFakeGroup on ~
DirFakeUser on ~
tcpNoDelay on
#
# ---
#
TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200

DisplayLogin welcome.msg
DisplayChdir .message true
#ListOptions "+R -h"

DenyFilter          \*.*/

# Use this to jail all users in their homes 
DefaultRoot ~

# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
RequireValidShell off

# Port 21 is the standard FTP port.
Port 21

#UseReverseDNS on



# This is useful for masquerading address with dynamic IPs:
# refresh any configured MasqueradeAddress directives every 8 hours
<IfModule mod_dynmasq.c>
# DynMasqRefresh 28800
</IfModule>

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 60

# Set the user and group that the server normally runs at.
User                proftpd
Group               nogroup

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask 002 002
# Normally, we want files to be overwriteable.
AllowOverwrite          on




TransferLog /var/log/proftpd/xferlog
SystemLog /var/log/proftpd/proftpd.log

<IfModule mod_quotatab.c>
QuotaEngine off
</IfModule>

<IfModule mod_ratio.c>
Ratios off
</IfModule>
#
# We want to use hosts.allow and hosts.deny in individual home dirs
# for finer control on FTP logins - note these are dot files, which
# are no hidden to the users - BITS, 6th October 2010
<IfModule mod_wrap.c>
TCPAccessFiles ~/.hosts.allow ~/.hosts.deny
</IfModule>

# Delay engine reduces impact of the so-called Timing Attack described in
# http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02
# It is on by default. 
<IfModule mod_delay.c>
DelayEngine on
</IfModule>

<IfModule mod_ctrls.c>
ControlsEngine        off
ControlsMaxClients    2
ControlsLog           /var/log/proftpd/controls.log
ControlsInterval      5
ControlsSocket        /var/run/proftpd/proftpd.sock
</IfModule>

<IfModule mod_ctrls_admin.c>
  AdminControlsEngine off
</IfModule>

#
# Alternative authentication frameworks
#
#Include /etc/proftpd/ldap.conf
#Include /etc/proftpd/sql.conf

#
# This is used for FTPS connections
#
#Include /etc/proftpd/tls.conf
#
#  ---- Configure SFTP module here
#
<IfModule mod_sftp.c>
    <VirtualHost X.X.X.X>
      SFTPEngine on
      SFTPLog /var/log/proftpd/sftp.log

      # Configure the server to listen on the normal SSH2 port, port 22
      Port 22

      # Configure both the RSA and DSA host keys, using the same host key
      # files that OpenSSH uses.
      SFTPHostKey /etc/ssh/ssh_host_rsa_key
      SFTPHostKey /etc/ssh/ssh_host_dsa_key

      # Configure the file used for comparing authorized public keys of users.
      SFTPAuthorizedUserKeys file:~/.ssh/authorized_keys

      # Enable compression
      SFTPCompression delayed
      RequireValidShell off

      # Allow the same number of authentication attempts as OpenSSH.
      #
      # It is recommended that you explicitly configure MaxLoginAttempts
      # for your SSH2/SFTP instance to be higher than the normal
      # MaxLoginAttempts value for FTP, as there are more ways to authenticate
      # using SSH2.
      MaxLoginAttempts 6
      # Default Values
      # channelPacketSize 32KB channelWindowSize 4GB sftpProtocolVersion 1-6
      #
      # General fixes from the mod_sftp forum
      SFTPClientMatch ".*WS_FTP.*" channelWindowSize 1GB    #WS_FTP initial window size
      SFTPClientMatch ".*ClientSftp" sftpProtocolVersion 3  #CuteFTPPro8
      SFTPClientMatch ".*WinSCP.*" sftpProtocolVersion 3    #upload/download fix for WinSCP
      #
      # SecureBlackbox (SSH-2.0-SecureBlackbox.7)
      # http://www.eldos.com/sbb/download-release.php
      SFTPClientMatch ".*SecureBlackbox.*" sftpProtocolVersion 3
      #
      # GoAnywhere (SSH-2.0-1.0)
      # http://www.goanywheremft.com/products
      SFTPClientMatch "1.0" sftpProtocolVersion 3 channelWindowSize 1GB
      #
      # JaSFtp (SSH-2.0-J2SSH_Maverick_1.2.10_Sterling Commerce)
      # http://www.hiteksoftware.com/jasf/
      SFTPClientMatch ".*J2SSH_Maverick.*" channelWindowSize 1GB
      #
      # Robo-FTP (SSH-2.0-WeOnlyDo)
      # http://www.robo-ftp.com/
      SFTPClientMatch ".*WeOnlyDo.*" sftpProtocolVersion 3 channelWindowSize 1GB
      #
      # Network Automation (SSH-2.0-EldoS.SSHBlackbox.3)
      # http://www.networkautomation.com/
      SFTPClientMatch ".*EldoS.SSHBlackbox.3.*" sftpProtocolVersion 3 channelWindowSize 1GB
      #
      # /n Software BizTalk SFTP Receive (SSH-2.0-IP*Works! SSH Client v8.0)
      # http://www.nsoftware.com/products/biztalk/adapters/sftp.aspx
      SFTPClientMatch ".*IP.Works.*" channelWindowSize 1GB
      #
      # JSch - Java Secure Channel (SSH-2.0-JSCH-0.1.39)
      # http://www.jcraft.com/jsch/
      SFTPClientMatch "JSCH.*" channelWindowSize 1GB
    </VirtualHost>
</IfModule>

    

Answer 1

Ao contrário do Apache, dentro dos arquivos de configuração do ProFTPD, as diretivas que não estão dentro de qualquer seção <Global> ou <VirtualHost> não são automaticamente aplicadas globalmente; isso é coberto pelo howto de hospedagem virtual .

Isso significa que sua configuração mod_wrap :

<IfModule mod_wrap.c>
TCPAccessFiles ~/.hosts.allow ~/.hosts.deny
</IfModule>

é aplicado às sessões de FTP (através da seção "configuração do servidor"). No entanto, suas sessões de SFTP são manipuladas pelo seu explícito <VirtualHost> na parte inferior da configuração, que é uma seção de configuração diferente.

Para configurar / usar mod_wrap para suas sessões de SFTP, você pode copiar a seção <IfModule mod_wrap.c> dentro da seção SFTP <VirtualHost> , ou você pode coloque esse <IfModule mod_wrap.c> dentro de uma seção <Global> , para que seja aplicado a todos hosts virtuais:

<Global>
<IfModule mod_wrap.c>
TCPAccessFiles ~/.hosts.allow ~/.hosts.deny
</IfModule>
</Global>

Espero que isso ajude!