proftpd ignora HideGroup

Question

Eu tenho um problema interessante ao hospedar um proftpd em um SL6 x86_64. Quando eu compilo da fonte, o executável do proftpd ignora o recurso HideGroup. No entanto, quando eu instalo uma versão mais antiga do epel via rpm, esse recurso do HideGroup funciona muito bem. Por que esse recurso do mod_core é ignorado quando instalado a partir do código-fonte / tar, mas honrado ao instalar a partir do epel / rpm?

Eu tenho um diretório chamado "pictures" em '/ var / ftp /' que não o quero visível para usuários anônimos. Então eu tenho o HideGroup no conf, mas é ignorado! Alguma idéia por quê? Aqui estão algumas informações de depuração.

[robertk@bunsy ~]$ ll /var/ftp/
total 40
drwxrwxr-x. 3 bobby bobby 20480 Jul 27 11:10 pictures
drwxr-xr-x. 7 root    root    4096 Dec 20  2013 pub
d-wx-wx--x  2 ftp     ftp     4096 Dec 20  2013 uploads
-rw-r--r--  1 root    root     224 Dec 20  2013 welcome.msg
-rw-r--r--  1 root    root     224 Dec 20  2013 welcome.msg.rpmnew
-rw-r--r--. 1 root    root    1283 Jul 23 17:18 welcome.msg.rpmsave
[robertk@bunsy ~]$ 

Aqui está o meu "configure" da fonte.

    [root@bunsy proftpd-1.3.5a]# ./configure --prefix=/opt/proftpd-1.3.5a/ --enable-cap --enable-dso --enable-nls --enable-shadow

E quando eu executo o proftpd no modo não-daemon, ele cospe isto:

    [root@bunsy proftpd-1.3.5a]# /opt/proftpd-1.3.5a/sbin/proftpd -d 10 -n -DANONYMOUS_FTP -c /usr/local/etc/proftpd.conf
    ...
    : in dir_check_full(): path = '/', fullpath = '/var/ftp/'.
    : retrieved GID 45755 for group 'bobby'
    : HideGroup 'root' is not a known/valid group, ignoring
    : dispatching POST_CMD command 'PASS (hidden)' to mod_cap
    : mod_cap/1.1: uid = 14, euid = 14, gid = 50, egid = 50
    : mod_cap/1.1: capabilities '= cap_chown,cap_setgid,cap_setuid,cap_net_bind_service+ep cap_mac_override+ei'
    : dispatching POST_CMD command 'PASS (hidden)' to mod_delay
    : dispatching POST_CMD command 'PASS (hidden)' to mod_log
    : dispatching POST_CMD command 'PASS (hidden)' to mod_ls
    : dispatching POST_CMD command 'PASS (hidden)' to mod_auth
    : RELINQUISH PRIVS at mod_auth.c:1963
    : dispatching POST_CMD command 'PASS (hidden)' to mod_rlimit
    : dispatching POST_CMD command 'PASS (hidden)' to mod_xfer
    : dispatching POST_CMD command 'PASS (hidden)' to mod_core
    : dispatching LOG_CMD command 'PASS (hidden)' to mod_log
    : dispatching LOG_CMD command 'PASS (hidden)' to mod_auth
    : ANON ftp: Login successful.
    : dispatching PRE_CMD command 'SYST' to mod_core
    : dispatching PRE_CMD command 'SYST' to mod_core
    : dispatching CMD command 'SYST' to mod_core
    : dispatching LOG_CMD command 'SYST' to mod_log
    : dispatching PRE_CMD command 'FEAT' to mod_core
    : dispatching PRE_CMD command 'FEAT' to mod_core
    : dispatching CMD command 'FEAT' to mod_core
    : in dir_check_full(): path = '/', fullpath = '/var/ftp/'.
    : HideGroup 'bobby' is not a known/valid group, ignoring
    : dispatching LOG_CMD command 'FEAT' to mod_log
    : dispatching PRE_CMD command 'PWD' to mod_core
    : dispatching PRE_CMD command 'PWD' to mod_core
    : dispatching CMD command 'PWD' to mod_core
    : in dir_check_full(): path = '/', fullpath = '/var/ftp/'.
    : HideGroup 'bobby' is not a known/valid group, ignoring
    : dispatching LOG_CMD command 'PWD' to mod_log
    : dispatching PRE_CMD command 'EPSV' to mod_core
    : dispatching PRE_CMD command 'EPSV' to mod_core
    : dispatching CMD command 'EPSV' to mod_core
    : in dir_check_full(): path = '/', fullpath = '/var/ftp/'.
    : HideGroup 'bobby' is not a known/valid group, ignoring
    : Entering Extended Passive Mode (|||25228|)
    : dispatching LOG_CMD command 'EPSV' to mod_log
    : dispatching PRE_CMD command 'LIST' to mod_core
    : dispatching PRE_CMD command 'LIST' to mod_core
    : dispatching CMD command 'LIST' to mod_ls
    : passive data connection opened - local  : 137.78.60.158:25228
    : passive data connection opened - remote : 128.149.252.79:50071
    : in dir_check_full(): path = '/', fullpath = '/var/ftp/'.
    : HideGroup 'bobby' is not a known/valid group, ignoring
    : in dir_check_full(): path = '/igspush', fullpath = '/var/ftp/igspush'.
    : HideGroup 'bobby' is not a known/valid group, ignoring
    : in dir_check_full(): path = '/pub', fullpath = '/var/ftp/pub'.
    : HideGroup 'bobby' is not a known/valid group, ignoring
    : in dir_check_full(): path = '/uploads', fullpath = '/var/ftp/uploads'.
    : HideGroup 'bobby' is not a known/valid group, ignoring
    : in dir_check_full(): path = '/welcome.msg', fullpath = '/var/ftp/welcome.msg'.
    : HideGroup 'bobby' is not a known/valid group, ignoring
    : in dir_check_full(): path = '/welcome.msg.rpmnew', fullpath = '/var/ftp/welcome.msg.rpmnew'.
    : HideGroup 'bobby' is not a known/valid group, ignoring
    : in dir_check_full(): path = '/welcome.msg.rpmsave', fullpath = '/var/ftp/welcome.msg.rpmsave'.

(note que eu removi o nome completo do servidor, IP, hora, etc. do modo de saída detalhado para economizar espaço para esta exibição)

E aqui está minha configuração para o bloco ANONYMOUS_FTP no meu proftpd.conf

<Anonymous ~ftp>
    User        ftp
    Group       ftp

    # We want clients to be able to login with "anonymous" as well as "ftp"
    UserAlias   anonymous ftp

    # Do not allow blank "passwords"
    #   AnonRejectPasswords     ^$ | ([ \t\n\r\f])

    # Maximum clients with message
    MaxClients      100  "Sorry, max of users reached (%m) -- try again later"
    MaxClientsPerUser   20  "Sorry, max clients for this user reached (%m) -- try again later"

    # Put the user into /pub right after login
    #DefaultChdir       /pub

    # We want 'welcome.msg' displayed at login, '.message' displayed in
    # each newly chdired directory and tell users to read README* files. 
    #DisplayLogin       /welcome.msg
    DisplayChdir        .message
    #DisplayReadme      README*

    # Cosmetic option to make all files appear to be owned by user "ftp"
    DirFakeUser     on ftp
    DirFakeGroup        on ftp

    # Limit WRITE everywhere in the anonymous chroot
    <Limit WRITE STOR SITE_CHMOD>
        DenyAll
    </Limit>

    # Allow logins (for anonymous) since they are disabled above.
    <Limit LOGIN>
        Order deny,allow
        Deny from .com
        Deny from <some ip>
        Deny from <some ip>
        Allow from all
    </Limit>

    HideNoAccess on
    HideGroup bobby
    HideGroup root
    #HideGroup 45755

    <Limit ALL>
        IgnoreHidden on
    </Limit>

    #ShowSymlinks            off

    # Don't write anonymous accesses to the system wtmp file (good idea!)
    WtmpLog     off

    # Logging for the anonymous transfers
    ExtendedLog /var/log/proftpd/access.log WRITE,READ default
    ExtendedLog /var/log/proftpd/auth.log AUTH auth



</Anonymous>

Quando eu executo o proftpd (instalado a partir de epel via rpm (yum)) apontando para o mesmo /usr/local/etc/proftpd.conf, as coisas funcionam muito bem!

Alguma ideia de que estou a negligenciar este problema?

    

Answer 1

O que faz:

$ proftpd -V

mostra o proftpd instalado da epel via rpm (yum)? Uma das coisas emitidas pelo comando acima é a lista de opções de tempo de compilação usada para esse proftpd binário. Ao comparar suas opções de comando configure com as usadas para a versão epel, você pode encontrar o culpado.