Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SFTP is changing the absolute path with mod_vroot #23

Closed
willyamcts opened this issue Sep 16, 2020 · 7 comments
Closed

SFTP is changing the absolute path with mod_vroot #23

willyamcts opened this issue Sep 16, 2020 · 7 comments
Assignees
Labels

Comments

@willyamcts
Copy link

willyamcts commented Sep 16, 2020

Hello,

in version 1.3.7a of proftpd the same problem reported in issue #20 occurs. I'am using mod_clamav, mod_vroot and mod_sftp. I opened a question in mod_clamav thinking that it was related to mod_clamav, but researching and doing the simple file upload test, it seems that it is mod_sftp changes the environment variable and passes mod_clamav the relative file path. If you want to see the case on mod_clamav: jbenden/mod_clamav#issue12.

occurs when is used VRootEngine only, which replaces the DefatulRoot directive.

in the log when uploading a file using sftp:

Wed Sep 16 07:42:13 2020 0 deb1   9   /eicar_com.zip   b _ i r user sftp 0 * c

in the log when uploading a file using FTP simple:

Wed Sep 16 07:49:38 2020 0 deb1   12   /home/ftp/eicar_com.zip   b _ i r user ftp 0 * c

mod_vroot in version 0.9.5

@jbenden
Copy link

jbenden commented Sep 16, 2020

Does #6 fix this problem for you?

@rzajac
Copy link

rzajac commented Sep 18, 2020

I'm experiencing the same issue with ProFTPd 1.3.7 and mod_vroot 0.9.5.

@willyamcts
Copy link
Author

willyamcts commented Sep 19, 2020

Does #6 fix this problem for you?

No with mod_clamav @jbenden.

But for modules mod_vroot + mod_exec + directive DefaultRoot ok


@Castaglia in the following commits after the pull of @rminsk the change was not included. To test I used the latest commit 46a4aab from version 0.9.4.

Even so in the log it returns the relative path in both variables:

2020-09-19 19: 20: 25,867 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/.', Fullpath = '/.'
2020-09-19 19: 20: 25,867 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/', fullpath = '/'
2020-09-19 19: 20: 25,868 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/ei.txt', fullpath = '/ei.txt'
2020-09-19 19: 20: 25,868 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/ei.txt', fullpath = '/test.com '
2020-09-19 19: 20: 25,868 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/ei.txt', fullpath = '/ei.txt'
2020-09-19 19: 20: 25,868 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/ei.txt', fullpath = '/ei.txt'

@Castaglia could you include the change in the current version?

ProFTPD in last release 1.3.7a

@Castaglia Castaglia self-assigned this Jun 26, 2021
@Castaglia Castaglia added the bug label Jun 26, 2021
Castaglia added a commit that referenced this issue Jul 4, 2021
@Castaglia
Copy link
Owner

@willyamcts I believe that with #25, mod_vroot + mod_sftp uploads should work better. Can you try it out, let me know how it works in your scenario?

Castaglia added a commit to proftpd/proftpd that referenced this issue Jul 4, 2021
found an interesting discrepancy: `mod_xfer`'s `PRE_CMD` handler for `RETR`
commands uses `dir_realpath()`, while its `PRE_CMD` handler for `STOR` commands
uses `dir_best_path()`.  Most of the time, the difference does not matter.

But when `mod_vroot` is involved, things are murkier, and the difference
between these two functions -- especially for SFTP downloads -- becomes visible.

Thus I added the use of `dir_best_path()`, for downloads, as a fallback in the
cases where `dir_realpath()` returns NULL (typically due to `ENOENT`).
@Castaglia
Copy link
Owner

@willyamcts any luck/feedback on the above fix?

@willyamcts
Copy link
Author

Hi @Castaglia, excusme o time for reply... Thanls for effort

Your correction #25 solve this problem. But I can't say if the fix is 100% because the paths are stored in rel_path and abs_path are not accurate, I don't know what consequences might exist.

Although the abs_path and rel_path variables are strange, malicious FTP and SFTP uploads are detected by clamav even using shortcuts. Check below "Test output".

Scenery

Compilation ProFTPd

Test

I practically ran the same settings and tests reported in issue#12 of clamav. The settings are the same, I just changed mod_clamav.c a little to generate the variable outputs:

60a61
> char *abs_path;
217c218,222
<     pr_log_debug(DEBUG4, MOD_CLAMAV_VERSION ": Successfully reconnected to Clamd.");
---
> //    pr_log_debug(DEBUG4, MOD_CLAMAV_VERSION ": Successfully reconnected to Clamd.");
>
> pr_log_debug(DEBUG4, MOD_CLAMAV_VERSION ": Successfully reconnected to Clamd.\n\n vars = \
>  \n\t- pr_fs_getcwd(): %s \n\t- session.chroot_path: %s\n\t- abs_path: %s \n\n", pr_fs_getcwd(), session.chroot_path, abs_path);
>
441c446,448
<   char *abs_path = NULL, *rel_path = NULL;
---
> //  char *abs_path = NULL, *rel_path = NULL;
> abs_path = NULL;
> char *rel_path = NULL;
522a530
>
527a536,537
> pr_log_debug(DEBUG4, MOD_CLAMAV_VERSION ": VIA STREAM: \n\t* abs_path = %s \n\t* rel_path = %s \n\t* fh->fh_path=%s \n\t* buf=%s \n\t* pr_fs_getvwd()=%s\n\n", abs_path, rel_path, fh->fh_path, buf, pr_fs_getvwd());
>
584a595,597
>
> pr_log_debug(DEBUG4, MOD_CLAMAV_VERSION ": SEND VIA STREAM: clamavd_scan_stream(%s) - rel_path=%s.", abs_path, rel_path);

Test output

Directories and paths:

  • The user's default directory is: /home/ftp/user
  • The symbolic link is: /test.internal -> full path: /home/hostings/test.internal

FTP: send file to subdirectory

2021-08-01 12:38:39,654 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): passive data connection opened - local  : 192.168.52.200:50061
2021-08-01 12:38:39,654 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): passive data connection opened - remote : 192.168.52.100:54154
2021-08-01 12:38:39,657 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: VIA STREAM:
        * abs_path = /home/ftp/user/home/ftp/user/imgs/eicar_com.zip
        * rel_path = /home/ftp/user/imgs/eicar_com.zip
        * fh->fh_path=/home/ftp/user/imgs/eicar_com.zip
        * buf=/home/ftp/user
        * pr_fs_getvwd()=/imgs


2021-08-01 12:38:39,657 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): ROOT PRIVS at mod_clamav.c:377
2021-08-01 12:38:39,657 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): ROOT PRIVS: ID switching disabled
2021-08-01 12:38:39,658 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS at mod_clamav.c:435
2021-08-01 12:38:39,658 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS: ID switching disabled
2021-08-01 12:38:39,659 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Successfully reconnected to Clamd.

 vars =
        - pr_fs_getcwd(): /imgs
        - session.chroot_path: /
        - abs_path: /home/ftp/user/home/ftp/user/imgs/eicar_com.zip


2021-08-01 12:38:39,659 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Streaming 184 bytes (-1207959552, 4) to Clamd.
2021-08-01 12:38:39,667 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Virus 'Win.Test.EICAR_HDB-1' found in '/home/ftp/user/home/ftp/user/imgs/eicar_com.zip'
2021-08-01 12:38:39,667 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: SEND VIA STREAM: clamavd_scan_stream(/home/ftp/user/home/ftp/user/imgs/eicar_com.zip) - rel_path=/home/ftp/user/imgs/eicar_com.zip.
2021-08-01 12:38:39,667 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: No virus detected in filename = '/home/ftp/user/home/ftp/user/imgs/eicar_com.zip'.
2021-08-01 12:38:39,668 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'STOR eicar_com.zip' to mod_exec

FTP: send file to symbolic link

2021-08-01 12:40:38,963 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): passive data connection opened - local  : 192.168.52.200:50089
2021-08-01 12:40:38,963 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): passive data connection opened - remote : 192.168.52.100:49253
2021-08-01 12:40:38,965 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: VIA STREAM:
        * abs_path = /home/hostings/home/ftp/user/test.internal/eicar_com.zip
        * rel_path = /home/ftp/user/test.internal/eicar_com.zip
        * fh->fh_path=/home/ftp/user/test.internal/eicar_com.zip
        * buf=/home/hostings
        * pr_fs_getvwd()=/test.internal


2021-08-01 12:40:38,965 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Clamd did not accept PING (32): Broken pipe
2021-08-01 12:40:38,965 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): ROOT PRIVS at mod_clamav.c:377
2021-08-01 12:40:38,968 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS at mod_clamav.c:435
2021-08-01 12:40:38,968 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS: ID switching disabled
2021-08-01 12:40:38,968 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Successfully reconnected to Clamd.

 vars =
        - pr_fs_getcwd(): /test.internal
        - session.chroot_path: /
        - abs_path: /home/hostings/home/ftp/user/test.internal/eicar_com.zip


2021-08-01 12:40:38,968 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Streaming 184 bytes (-1207959552, 4) to Clamd.
2021-08-01 12:40:38,969 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Virus 'Win.Test.EICAR_HDB-1' found in '/home/hostings/home/ftp/user/test.internal/eicar_com.zip'
2021-08-01 12:40:38,969 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: SEND VIA STREAM: clamavd_scan_stream(/home/hostings/home/ftp/user/test.internal/eicar_com.zip) - rel_path=/home/ftp/user/test.internal/eicar_com.zip.
2021-08-01 12:40:38,969 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: No virus detected in filename = '/home/hostings/home/ftp/user/test.internal/eicar_com.zip'.
2021-08-01 12:40:38,970 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'STOR eicar_com.zip' to mod_exec

SFTP: send file to subdirectory

2021-08-01 12:43:46,977 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): path = '/home/ftp/user/imgs/eicar_com.zip', fullpath = '/home/ftp/user/imgs/eicar_com.zip'
2021-08-01 12:43:46,977 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): setting umask to 0003 (was 0003)
2021-08-01 12:43:46,977 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'OPEN /imgs/eicar_com.zip' to mod_exec
2021-08-01 12:43:46,977 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching LOG_CMD command 'OPEN /imgs/eicar_com.zip' to mod_log
2021-08-01 12:43:46,978 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): path = '/home/ftp/user/imgs/eicar_com.zip', fullpath = '/home/ftp/user/imgs/eicar_com.zip'
2021-08-01 12:43:46,978 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): setting umask to 0003 (was 0003)
2021-08-01 12:43:46,978 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'WRITE 97110dc2e24c6754 0 184' to mod_exec
2021-08-01 12:43:46,979 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching LOG_CMD command 'WRITE 97110dc2e24c6754 0 184' to mod_log
2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: VIA STREAM:
        * abs_path = /home/ftp/user/home/ftp/user/imgs/eicar_com.zip
        * rel_path = /home/ftp/user/imgs/eicar_com.zip
        * fh->fh_path=/home/ftp/user/imgs/eicar_com.zip
        * buf=/home/ftp/user
        * pr_fs_getvwd()=/


2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Clamd did not respond to fgets (2): No such file or directory
2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): ROOT PRIVS at mod_clamav.c:377
2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS at mod_clamav.c:435
2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS: ID switching disabled
2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Successfully reconnected to Clamd.

 vars =
        - pr_fs_getcwd(): /
        - session.chroot_path: /
        - abs_path: /home/ftp/user/home/ftp/user/imgs/eicar_com.zip


2021-08-01 12:43:46,981 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Streaming 184 bytes (-1207959552, 4) to Clamd.
2021-08-01 12:43:46,982 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Virus 'Win.Test.EICAR_HDB-1' found in '/home/ftp/user/home/ftp/user/imgs/eicar_com.zip'
2021-08-01 12:43:46,982 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: SEND VIA STREAM: clamavd_scan_stream(/home/ftp/user/home/ftp/user/imgs/eicar_com.zip) - rel_path=/home/ftp/user/imgs/eicar_com.zip.
2021-08-01 12:43:46,982 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: No virus detected in filename = '/home/ftp/user/home/ftp/user/imgs/eicar_com.zip'.
2021-08-01 12:43:46,982 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'STOR /home/ftp/user/imgs/eicar_com.zip' to mod_exec
2021-08-01 12:43:46,983 deb1 proftpd[32294] 0.0.0.0 (192.168.52.100[192.168.52.100]): REVOKE PRIVS at mod_exec.c:489

SFTP: send file to symbolic link

2021-08-01 12:45:08,223 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching PRE_CMD command 'STOR /test.internal/eicar_com.zip' to mod_vroot
2021-08-01 12:45:08,223 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching PRE_CMD command 'STOR /test.internal/eicar_com.zip' to mod_xfer
2021-08-01 12:45:08,223 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): path = '/home/ftp/user/test.internal/eicar_com.zip', fullpath = '/home/ftp/user/test.internal/eicar_com.zip'
2021-08-01 12:45:08,224 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): setting umask to 0003 (was 0003)
2021-08-01 12:45:08,224 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'OPEN /test.internal/eicar_com.zip' to mod_exec
2021-08-01 12:45:08,224 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching LOG_CMD command 'OPEN /test.internal/eicar_com.zip' to mod_log
2021-08-01 12:45:08,225 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): path = '/home/ftp/user/test.internal/eicar_com.zip', fullpath = '/home/ftp/user/test.internal/eicar_com.zip'
2021-08-01 12:45:08,226 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): setting umask to 0003 (was 0003)
2021-08-01 12:45:08,226 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'WRITE 184084f59bbb5e1f 0 184' to mod_exec
2021-08-01 12:45:08,226 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching LOG_CMD command 'WRITE 184084f59bbb5e1f 0 184' to mod_log
2021-08-01 12:45:08,227 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: VIA STREAM:
        * abs_path = /home/ftp/user/home/ftp/user/test.internal/eicar_com.zip
        * rel_path = /home/ftp/user/test.internal/eicar_com.zip
        * fh->fh_path=/home/ftp/user/test.internal/eicar_com.zip
        * buf=/home/ftp/user
        * pr_fs_getvwd()=/


2021-08-01 12:45:08,227 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Clamd did not accept PING (32): Broken pipe
2021-08-01 12:45:08,227 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): ROOT PRIVS at mod_clamav.c:377
2021-08-01 12:45:08,227 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS at mod_clamav.c:435
2021-08-01 12:45:08,228 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS: ID switching disabled
2021-08-01 12:45:08,228 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Successfully reconnected to Clamd.

 vars =
        - pr_fs_getcwd(): /
        - session.chroot_path: /
        - abs_path: /home/ftp/user/home/ftp/user/test.internal/eicar_com.zip


2021-08-01 12:45:08,228 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Streaming 184 bytes (-1207959552, 4) to Clamd.
2021-08-01 12:45:08,229 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Virus 'Win.Test.EICAR_HDB-1' found in '/home/ftp/user/home/ftp/user/test.internal/eicar_com.zip'
2021-08-01 12:45:08,229 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: SEND VIA STREAM: clamavd_scan_stream(/home/ftp/user/home/ftp/user/test.internal/eicar_com.zip) - rel_path=/home/ftp/user/test.internal/eicar_com.zip.
2021-08-01 12:45:08,229 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: No virus detected in filename = '/home/ftp/user/home/ftp/user/test.internal/eicar_com.zip'.
2021-08-01 12:45:08,229 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'STOR /home/ftp/user/test.internal/eicar_com.zip' to mod_exec
2021-08-01 12:45:08,230 deb1 proftpd[713] 0.0.0.0 (192.168.52.100[192.168.52.100]): REVOKE PRIVS at mod_exec.c:489

Castaglia added a commit that referenced this issue Aug 22, 2021
Castaglia added a commit that referenced this issue Aug 22, 2021
Issue #23: Update mod_vroot to tweak various commands when dealing wi…
@Castaglia
Copy link
Owner

Thanks for the thorough testing! I'm considering this issue as fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants