-
Notifications
You must be signed in to change notification settings - Fork 7
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SFTP is changing the absolute path with mod_vroot #23
Comments
Does #6 fix this problem for you? |
I'm experiencing the same issue with ProFTPd 1.3.7 and mod_vroot 0.9.5. |
No with mod_clamav @jbenden. But for modules mod_vroot + mod_exec + directive DefaultRoot ok @Castaglia in the following commits after the pull of @rminsk the change was not included. To test I used the latest commit 46a4aab from version 0.9.4. Even so in the log it returns the relative path in both variables:
@Castaglia could you include the change in the current version? ProFTPD in last release 1.3.7a |
…th mod_sftp's SFTP/SCP idiosyncrasies.
@willyamcts I believe that with #25, |
found an interesting discrepancy: `mod_xfer`'s `PRE_CMD` handler for `RETR` commands uses `dir_realpath()`, while its `PRE_CMD` handler for `STOR` commands uses `dir_best_path()`. Most of the time, the difference does not matter. But when `mod_vroot` is involved, things are murkier, and the difference between these two functions -- especially for SFTP downloads -- becomes visible. Thus I added the use of `dir_best_path()`, for downloads, as a fallback in the cases where `dir_realpath()` returns NULL (typically due to `ENOENT`).
@willyamcts any luck/feedback on the above fix? |
Hi @Castaglia, excusme o time for reply... Thanls for effort Your correction #25 solve this problem. But I can't say if the fix is 100% because the paths are stored in rel_path and abs_path are not accurate, I don't know what consequences might exist. Although the abs_path and rel_path variables are strange, malicious FTP and SFTP uploads are detected by clamav even using shortcuts. Check below "Test output". SceneryCompilation ProFTPdTestI practically ran the same settings and tests reported in issue#12 of clamav. The settings are the same, I just changed mod_clamav.c a little to generate the variable outputs:
Test outputDirectories and paths:
FTP: send file to subdirectory
FTP: send file to symbolic link
SFTP: send file to subdirectory
SFTP: send file to symbolic link
|
…th mod_sftp's SFTP/SCP idiosyncrasies.
Issue #23: Update mod_vroot to tweak various commands when dealing wi…
Thanks for the thorough testing! I'm considering this issue as fixed. |
Hello,
in version 1.3.7a of proftpd the same problem reported in issue #20 occurs. I'am using mod_clamav, mod_vroot and mod_sftp. I opened a question in mod_clamav thinking that it was related to mod_clamav, but researching and doing the simple file upload test, it seems that it is mod_sftp changes the environment variable and passes mod_clamav the relative file path. If you want to see the case on mod_clamav: jbenden/mod_clamav#issue12.
occurs when is used VRootEngine only, which replaces the DefatulRoot directive.
in the log when uploading a file using sftp:
in the log when uploading a file using FTP simple:
mod_vroot in version 0.9.5
The text was updated successfully, but these errors were encountered: