{"action":"created","issue":{"url":"https://api.github.com/repos/proftpd/proftpd/issues/659","repository_url":"https://api.github.com/repos/proftpd/proftpd","labels_url":"https://api.github.com/repos/proftpd/proftpd/issues/659/labels{/name}","comments_url":"https://api.github.com/repos/proftpd/proftpd/issues/659/comments","events_url":"https://api.github.com/repos/proftpd/proftpd/issues/659/events","html_url":"https://github.com/proftpd/proftpd/issues/659","id":278464909,"number":659,"title":"sftp and SELinux","user":{"login":"marcindulak","id":3178318,"avatar_url":"https://avatars1.githubusercontent.com/u/3178318?v=4","gravatar_id":"","url":"https://api.github.com/users/marcindulak","html_url":"https://github.com/marcindulak","followers_url":"https://api.github.com/users/marcindulak/followers","following_url":"https://api.github.com/users/marcindulak/following{/other_user}","gists_url":"https://api.github.com/users/marcindulak/gists{/gist_id}","starred_url":"https://api.github.com/users/marcindulak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcindulak/subscriptions","organizations_url":"https://api.github.com/users/marcindulak/orgs","repos_url":"https://api.github.com/users/marcindulak/repos","events_url":"https://api.github.com/users/marcindulak/events{/privacy}","received_events_url":"https://api.github.com/users/marcindulak/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":16,"created_at":"2017-12-01T13:23:46Z","updated_at":"2018-03-22T18:20:02Z","closed_at":null,"author_association":"NONE","body":"I'm having troubles figuring out why SELinux is blocking sftp.\r\nMy sftp configuration may be incorrect - please comment on that too.\r\nThis is just a minimal test case, with root user accessing sftp.\r\n\r\n### What I Did\r\n\r\n```\r\nBOX='fedora/27-cloud-base' vagrant up\r\nvagrant ssh -c 'sudo bash /vagrant/install.sh'\r\n```\r\n\r\nwith the following scripts:\r\n```\r\n# -*- mode: ruby -*-\r\n# vi: set ft=ruby :\r\n\r\n# 1. BOX='fedora/27-cloud-base' vagrant up\r\n# 2. vagrant ssh -c 'sudo bash /vagrant/install.sh'\r\n\r\nBOX = ENV.fetch('BOX', 'centos/7')\r\n\r\n# disable IPv6 on Linux\r\n$linux_disable_ipv6 = <<SCRIPT\r\nsysctl -w net.ipv6.conf.default.disable_ipv6=1\r\nsysctl -w net.ipv6.conf.all.disable_ipv6=1\r\nsysctl -w net.ipv6.conf.lo.disable_ipv6=1\r\nSCRIPT\r\n\r\nVagrant.configure(2) do |config|\r\n  config.vm.define 'proftpd' do |machine|\r\n    machine.vm.box = BOX\r\n    machine.vm.box_url = machine.vm.box\r\n    machine.vm.provider 'virtualbox' do |v|\r\n      v.memory = 512\r\n      v.cpus = 1\r\n    end\r\n  end\r\n  config.vm.define 'proftpd' do |machine|\r\n    machine.vm.provision :shell, :inline => 'hostnamectl set-hostname proftpd'\r\n    machine.vm.provision :shell, :inline => 'setenforce 1', run: \"always\"\r\n    machine.vm.provision :shell, :inline => $linux_disable_ipv6, run: 'always'\r\n  end\r\nend\r\n```\r\n\r\n```\r\n#!/bin/bash\r\ncat /etc/redhat-release | grep CentOS && yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm\r\nyum -y install proftpd\r\nrpm -q proftpd\r\n# proftpd-1.3.5e-3.el7.x86_64  # CentOS 7\r\n# proftpd-1.3.6-8.fc27.x86_64  # Fedora 27\r\n\r\necho 'SystemLog /var/log/proftpd/system.log' >> /etc/proftpd.conf\r\n\r\n# enable root ftp login\r\necho 'RootLogin on' >> /etc/proftpd.conf\r\necho -e \"vagrant\\nvagrant\" | passwd root\r\nsed -i '/root/d' /etc/ftpusers\r\n\r\n# enable sftp\r\nmkdir /etc/proftpd\r\nssh-keygen -b 2048 -t rsa -f /etc/proftpd/id_rsa -q -N \"\"\r\nsed -i 's/^#.*LoadModule mod_sftp.c/LoadModule mod_sftp.c/' /etc/proftpd.conf\r\ncat <<'EOT' >> /etc/proftpd.conf\r\n<VirtualHost 0.0.0.0>\r\n  <IfModule mod_sftp.c>\r\n  SFTPLog /var/log/proftpd/sftp.log\r\n  SFTPEngine on\r\n  Port 222\r\n  #SFTPHostKey /etc/proftpd/id_rsa\r\n  SFTPHostKey /etc/ssh/ssh_host_rsa_key\r\n  RootLogin on\r\n  </IfModule>\r\n</VirtualHost>\r\nEOT\r\n\r\n# make sure selinux is enforcing\r\nyum -y install setroubleshoot setools\r\nsetenforce 1\r\ntest `getenforce` == Enforcing || exit 1\r\nsemanage port -a -t ftp_port_t -p tcp 222  # is this correct?\r\n\r\n# fatal: SFTPHostKey: unable to use '/etc/ssh/ssh_host_rsa_key' as host key, as it is group- or world-accessible on line 439 of '/etc/proftpd.conf'\r\nchmod g-r /etc/ssh/ssh_host_rsa_key\r\nsetsebool -P ftpd_full_access 1\r\n\r\nservice proftpd restart\r\n\r\nyum -y install net-tools sshpass ncftp\r\n\r\nnetstat -ntlp | grep proftpd\r\n#tcp6       0      0 :::21                   :::*                    LISTEN      3393/proftpd: (acce \r\n#tcp6       0      0 :::222                  :::*                    LISTEN      3393/proftpd: (acce \r\n\r\n> /var/log/audit/audit.log\r\n\r\n! sshpass -p 'vagrant' sftp -P 222 -oBatchMode=no -oStrictHostKeyChecking=no root@localhost <<< pwd\r\n#Warning: Permanently added '[localhost]:222' (RSA) to the list of known hosts.\r\n#Permission denied, please try again.\r\n\r\nsealert -a /var/log/audit/audit.log\r\n#100% done\r\n#found 0 alerts in /var/log/audit/audit.log\r\n\r\nsetenforce 0\r\n\r\nsshpass -p 'vagrant' sftp -P 222 -oBatchMode=no -oStrictHostKeyChecking=no root@localhost <<< pwd\r\n#Connected to localhost.\r\n#sftp> pwd\r\n#Remote working directory: /root\r\n\r\nsealert -a /var/log/audit/audit.log\r\n#100% done\r\n#found 0 alerts in /var/log/audit/audit.log\r\n\r\nsetenforce 1\r\n! sshpass -p 'vagrant' sftp -P 222 -oBatchMode=no -oStrictHostKeyChecking=no root@localhost <<< pwd\r\n#Permission denied, please try again.\r\n\r\nncftp -u root -p 'vagrant' -P 21 localhost <<< pwd  # I'm fine\r\n```\r\n\r\n### What I Expected/Wanted\r\n\r\nThere seem to be no indications as what SELinux feature is blocking sftp.\r\n\r\n### ProFTPD Version and Configuration\r\n\r\nThe default proftpd on CentOS 7 and Fedora 27:\r\n\r\nproftpd-1.3.5e-3.el7.x86_64  # CentOS 7\r\nproftpd-1.3.6-8.fc27.x86_64  # Fedora 27\r\n\r\n```\r\n[root@proftpd ~]# proftpd -V\r\nCompile-time Settings:\r\n  Version: 1.3.6 (stable)\r\n  Platform: LINUX [Linux 4.13.9-300.fc27.x86_64 x86_64]\r\n  Built: Mon Oct 30 2017 14:37:25 UTC\r\n  Built With:\r\n    configure  '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--localstatedir=/var' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--libexecdir=/usr/libexec/proftpd' '--localstatedir=/run/proftpd' '--disable-strip' '--enable-ctrls' '--enable-dso' '--enable-facl' '--enable-ipv6' '--enable-memcache' '--enable-nls' '--enable-openssl' '--disable-pcre' '--disable-redis' '--enable-shadow' '--enable-tests=nonetwork' '--with-libraries=/usr/lib64/mysql' '--with-includes=/usr/include/mysql' '--with-modules=mod_readme:mod_auth_pam:mod_tls' '--with-shared=mod_sql:mod_sql_passwd:mod_sql_mysql:mod_sql_postgres:mod_sql_sqlite:mod_quotatab:mod_quotatab_file:mod_quotatab_ldap:mod_quotatab_radius:mod_quotatab_sql:mod_ldap:mod_ban:mod_wrap:mod_ctrls_admin:mod_facl:mod_load:mod_vroot:mod_radius:mod_ratio:mod_rewrite:mod_site_misc:mod_exec:mod_shaper:mod_geoip:mod_wrap2:mod_wrap2_file:mod_wrap2_sql:mod_copy:mod_deflate:mod_ifversion:mod_qos:mod_sftp:mod_sftp_pam:mod_sftp_sql:mod_tls_shmcache:mod_tls_memcache:mod_ifsession' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' 'LDFLAGS=-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld' 'CXXFLAGS=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic'\r\n\r\n  CFLAGS: -g2 -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic -Wall -fno-omit-frame-pointer -Werror=implicit-function-declaration\r\n  LDFLAGS: -L$(top_srcdir)/lib -Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -rdynamic -L/usr/lib64/mysql -L/usr/lib64/mysql -L/usr/lib64\r\n  LIBS: -lacl  -lssl -lcrypto -lcap  -lmemcached -lmemcachedutil  -lssl -lcrypto  -lpam -lsupp -lattr -lnsl -lresolv -lresolv -lcrypt -ldl \r\n\r\n  Files:\r\n    Configuration File:\r\n      /etc/proftpd.conf\r\n    Pid File:\r\n      /run/proftpd/proftpd.pid\r\n    Scoreboard File:\r\n      /run/proftpd/proftpd.scoreboard\r\n    Header Directory:\r\n      /usr/include/proftpd\r\n    Shared Module Directory:\r\n      /usr/libexec/proftpd\r\n\r\n  Info:\r\n    + Max supported UID: 4294967295\r\n    + Max supported GID: 4294967295\r\n\r\n  Features:\r\n    - Autoshadow support\r\n    + Controls support\r\n    + curses support\r\n    - Developer support\r\n    + DSO support\r\n    + IPv6 support\r\n    + Largefile support\r\n    - Lastlog support\r\n    + Memcache support\r\n    + ncursesw support\r\n    + NLS support\r\n    - Redis support\r\n    - Sodium support\r\n    + OpenSSL support (FIPS enabled)\r\n    - PCRE support\r\n    + POSIX ACL support\r\n    + Shadow file support\r\n    + Sendfile support\r\n    + Trace support\r\n    + xattr support\r\n\r\n  Tunable Options:\r\n    PR_TUNABLE_BUFFER_SIZE = 1024\r\n    PR_TUNABLE_DEFAULT_RCVBUFSZ = 8192\r\n    PR_TUNABLE_DEFAULT_SNDBUFSZ = 8192\r\n    PR_TUNABLE_ENV_MAX = 2048\r\n    PR_TUNABLE_GLOBBING_MAX_MATCHES = 100000\r\n    PR_TUNABLE_GLOBBING_MAX_RECURSION = 8\r\n    PR_TUNABLE_HASH_TABLE_SIZE = 40\r\n    PR_TUNABLE_LOGIN_MAX = 256\r\n    PR_TUNABLE_NEW_POOL_SIZE = 512\r\n    PR_TUNABLE_PATH_MAX = 4096\r\n    PR_TUNABLE_SCOREBOARD_BUFFER_SIZE = 80\r\n    PR_TUNABLE_SCOREBOARD_SCRUB_TIMER = 30\r\n    PR_TUNABLE_SELECT_TIMEOUT = 30\r\n    PR_TUNABLE_TIMEOUTIDENT = 10\r\n    PR_TUNABLE_TIMEOUTIDLE = 600\r\n    PR_TUNABLE_TIMEOUTLINGER = 10\r\n    PR_TUNABLE_TIMEOUTLOGIN = 300\r\n    PR_TUNABLE_TIMEOUTNOXFER = 300\r\n    PR_TUNABLE_TIMEOUTSTALLED = 3600\r\n    PR_TUNABLE_XFER_SCOREBOARD_UPDATES = 10\r\n```\r\n\r\n`/etc/proftpd.conf`\r\n\r\n```\r\nServerName\t\t\t\"ProFTPD server\"\r\nServerIdent\t\t\ton \"FTP Server ready.\"\r\nServerAdmin\t\t\troot@localhost\r\nDefaultServer\t\t\ton\r\n\r\nDefaultRoot\t\t\t~ !adm\r\n\r\nAuthPAMConfig\t\t\tproftpd\r\nAuthOrder\t\t\tmod_auth_pam.c* mod_auth_unix.c\r\n\r\nUseReverseDNS\t\t\toff\r\n\r\nUser\t\t\t\tnobody\r\nGroup\t\t\t\tnobody\r\n\r\nMaxInstances\t\t\t20\r\n\r\nUseSendfile\t\t\toff\r\n\r\nLogFormat\t\t\tdefault\t\"%h %l %u %t \\\"%r\\\" %s %b\"\r\nLogFormat\t\t\tauth\t\"%v [%P] %h %t \\\"%r\\\" %s\"\r\n\r\nLoadModule mod_ctrls_admin.c\r\nLoadModule mod_sftp.c\r\nLoadModule mod_vroot.c\r\n\r\nModuleControlsACLs\t\tinsmod,rmmod allow user root\r\nModuleControlsACLs\t\tlsmod allow user *\r\n\r\nControlsEngine\t\t\ton\r\nControlsACLs\t\t\tall allow user root\r\nControlsSocketACL\t\tallow user *\r\nControlsLog\t\t\t/var/log/proftpd/controls.log\r\n\r\n<IfModule mod_ctrls_admin.c>\r\n  AdminControlsEngine\t\ton\r\n  AdminControlsACLs\t\tall allow user root\r\n</IfModule>\r\n\r\n<IfModule mod_vroot.c>\r\n  VRootEngine\t\t\ton\r\n</IfModule>\r\n\r\n<IfDefine TLS>\r\n  TLSEngine\t\t\ton\r\n  TLSRequired\t\t\toff\r\n  TLSCertificateChainFile\t/etc/pki/tls/certs/proftpd-chain.pem\r\n  TLSRSACertificateFile\t\t/etc/pki/tls/certs/proftpd-cert.pem\r\n  TLSRSACertificateKeyFile\t/etc/pki/tls/private/proftpd-key.pem\r\n  TLSCipherSuite\t\tPROFILE=SYSTEM\r\n  TLSOptions\t\t\tNoSessionReuseRequired\r\n  TLSLog\t\t\t/var/log/proftpd/tls.log\r\n  <IfModule mod_tls_shmcache.c>\r\n    TLSSessionCache\t\tshm:/file=/var/run/proftpd/sesscache\r\n  </IfModule>\r\n</IfDefine>\r\n\r\n<IfDefine DYNAMIC_BAN_LISTS>\r\n  LoadModule\t\t\tmod_ban.c\r\n  BanEngine\t\t\ton\r\n  BanLog\t\t\t/var/log/proftpd/ban.log\r\n  BanTable\t\t\t/var/run/proftpd/ban.tab\r\n\r\n  BanOnEvent\t\t\tMaxLoginAttempts 2/00:10:00 01:00:00\r\n\r\n  BanMessage\t\t\t\"Host %a has been banned\"\r\n\r\n  BanControlsACLs\t\tall allow user ftpadm\r\n</IfDefine>\r\n\r\n<IfDefine QOS>\r\n  LoadModule\t\t\tmod_qos.c\r\n  QoSOptions\t\t\tdataqos throughput ctrlqos lowdelay\r\n</IfDefine>\r\n\r\n<Global>\r\n\r\n  Umask\t\t\t\t022\r\n\r\n  AllowOverwrite\t\tyes\r\n  <Limit ALL SITE_CHMOD>\r\n    AllowAll\r\n  </Limit>\r\n\r\n</Global>\r\n\r\n<IfDefine ANONYMOUS_FTP>\r\n  <Anonymous ~ftp>\r\n    User\t\t\tftp\r\n    Group\t\t\tftp\r\n    AccessGrantMsg\t\t\"Anonymous login ok, restrictions apply.\"\r\n\r\n    UserAlias\t\t\tanonymous ftp\r\n\r\n    MaxClients\t\t\t10 \"Sorry, max %m users -- try again later\"\r\n\r\n\r\n    DisplayLogin\t\t/welcome.msg\r\n    DisplayChdir\t\t.message\r\n    DisplayReadme\t\tREADME*\r\n\r\n    DirFakeUser\t\t\ton ftp\r\n    DirFakeGroup\t\ton ftp\r\n\r\n    <Limit WRITE SITE_CHMOD>\r\n      DenyAll\r\n    </Limit>\r\n\r\n    <IfModule mod_vroot.c>\r\n      <Directory /uploads/*>\r\n        AllowOverwrite\t\tno\r\n        <Limit READ>\r\n          DenyAll\r\n        </Limit>\r\n  \r\n        <Limit STOR>\r\n          AllowAll\r\n        </Limit>\r\n      </Directory>\r\n    </IfModule>\r\n    <IfModule !mod_vroot.c>\r\n      <Directory uploads/*>\r\n        AllowOverwrite\t\tno\r\n        <Limit READ>\r\n          DenyAll\r\n        </Limit>\r\n  \r\n        <Limit STOR>\r\n          AllowAll\r\n        </Limit>\r\n      </Directory>\r\n    </IfModule>\r\n\r\n    WtmpLog\t\t\toff\r\n\r\n    ExtendedLog\t\t\t/var/log/proftpd/access.log WRITE,READ default\r\n    ExtendedLog\t\t\t/var/log/proftpd/auth.log AUTH auth\r\n\r\n  </Anonymous>\r\n</IfDefine>\r\n\r\nSystemLog /var/log/proftpd/system.log\r\nRootLogin on\r\n<VirtualHost 0.0.0.0>\r\n  <IfModule mod_sftp.c>\r\n  SFTPLog /var/log/proftpd/sftp.log\r\n  SFTPEngine on\r\n  Port 222\r\n  SFTPHostKey /etc/ssh/ssh_host_rsa_key\r\n  RootLogin on\r\n  </IfModule>\r\n</VirtualHost>\r\n```\r\n\r\n`/var/log/proftpd/sftp.log`\r\n\r\n```\r\n2017-12-01 13:19:23,793 mod_sftp/0.9.9[3404]: sent server version 'SSH-2.0-mod_sftp/0.9.9'\r\n2017-12-01 13:19:23,793 mod_sftp/0.9.9[3404]: received client version 'SSH-2.0-OpenSSH_7.4'\r\n2017-12-01 13:19:23,793 mod_sftp/0.9.9[3404]: handling connection from SSH2 client 'OpenSSH_7.4'\r\n2017-12-01 13:19:23,794 mod_sftp/0.9.9[3404]:  + Session key exchange: ecdh-sha2-nistp256\r\n2017-12-01 13:19:23,794 mod_sftp/0.9.9[3404]:  + Session server hostkey: ssh-rsa\r\n2017-12-01 13:19:23,794 mod_sftp/0.9.9[3404]:  + Session client-to-server encryption: aes128-ctr\r\n2017-12-01 13:19:23,794 mod_sftp/0.9.9[3404]:  + Session server-to-client encryption: aes128-ctr\r\n2017-12-01 13:19:23,794 mod_sftp/0.9.9[3404]:  + Session client-to-server MAC: umac-64@openssh.com\r\n2017-12-01 13:19:23,794 mod_sftp/0.9.9[3404]:  + Session server-to-client MAC: umac-64@openssh.com\r\n2017-12-01 13:19:23,794 mod_sftp/0.9.9[3404]:  + Session client-to-server compression: none\r\n2017-12-01 13:19:23,794 mod_sftp/0.9.9[3404]:  + Session server-to-client compression: none\r\n2017-12-01 13:19:23,834 mod_sftp/0.9.9[3404]: sending acceptable userauth methods: password\r\n2017-12-01 13:19:23,837 mod_sftp/0.9.9[3404]: password authentication for user 'root' failed: No such user\r\n2017-12-01 13:19:23,837 mod_sftp/0.9.9[3404]: sending userauth failure; remaining userauth methods: password\r\n2017-12-01 13:19:23,839 mod_sftp/0.9.9[3404]: disconnecting client (received EOF)\r\n```"},"comment":{"url":"https://api.github.com/repos/proftpd/proftpd/issues/comments/375408953","html_url":"https://github.com/proftpd/proftpd/issues/659#issuecomment-375408953","issue_url":"https://api.github.com/repos/proftpd/proftpd/issues/659","id":375408953,"user":{"login":"pghmcfc","id":947224,"avatar_url":"https://avatars2.githubusercontent.com/u/947224?v=4","gravatar_id":"","url":"https://api.github.com/users/pghmcfc","html_url":"https://github.com/pghmcfc","followers_url":"https://api.github.com/users/pghmcfc/followers","following_url":"https://api.github.com/users/pghmcfc/following{/other_user}","gists_url":"https://api.github.com/users/pghmcfc/gists{/gist_id}","starred_url":"https://api.github.com/users/pghmcfc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pghmcfc/subscriptions","organizations_url":"https://api.github.com/users/pghmcfc/orgs","repos_url":"https://api.github.com/users/pghmcfc/repos","events_url":"https://api.github.com/users/pghmcfc/events{/privacy}","received_events_url":"https://api.github.com/users/pghmcfc/received_events","type":"User","site_admin":false},"created_at":"2018-03-22T18:20:02Z","updated_at":"2018-03-22T18:20:02Z","author_association":"NONE","body":"@marcindulak, I'm not familiar with vagrant - does it provide an selinuxfs mount (/sys/fs/selinux) within the environment that proftpd runs in? If not, pam may think that SELinux is disabled and hence not use the proper unix_chkpwd helper to access the password database."}}
{"actor":{"display_login":"pghmcfc"}}