主页 / user-1060038

Matt's questions

Martin Hope
Matt
Asked: 2023-11-09 23:05:47 +0800 CST
  • 6

我在使用 proftpd 1.3.8a 的 RHEL 8.6 上遇到此问题

我有一个 proftpd 服务器设置，用户名为 IFTPTEST。在其主目录中，该用户有 2 个目录，in/ 和 out/。我的目标是：我将文件放在 out/ 目录中，用户连接到服务器（使用用户名/密码）来获取文件。

当用户连接时，它可以进入out/目录，列出该目录的内容并将文件放入该目录中。但是，当它尝试获取文件时，出现权限被拒绝错误：

sftp> ls -al
drwxrwxr-x    3 IFTPTEST 1000         4096 Nov  9 10:02 .
drwxrwxr-x    3 IFTPTEST 1000         4096 Nov  9 10:02 ..
drwxrwxr-x    2 IFTPTEST 1000         4096 Nov  9 10:08 in
drwxrwxrwx    2 IFTPTEST 1000         4096 Nov  9 10:05 out
sftp> cd out
sftp> ls -al
drwxrwxrwx    2 IFTPTEST 1000         4096 Nov  9 10:05 .
drwxrwxr-x    3 IFTPTEST 1000         4096 Nov  9 10:02 ..
-rwxrwxrwx    1 IFTPTEST 1000           13 Nov  9 10:05 test
sftp> get test test.txt
Fetching /out/test to test.txt
remote open("/out/test"): Permission denied

即使使用 out/ 目录和具有 777 权限的测试文件，我也会收到Permission returned。

在 sftp.log 中，我可以看到：

OPEN command for '/out/test' blocked by 'RETR' handler

在 /var/log/messages 中：

RETR /appli_var/XFRF/xfrf_files/ftpusers/IFTPTEST/out/test denied by <Limit> configuration

我不明白，因为我在 proftpd.conf 中有 out/ 目录的 RETR 设置（见下文）。

这是一个已知问题吗？我的配置有问题吗？

proftpd.conf 的内容（我没有放置整个文件）：

# Proftpd server configuration

[...]

LoadModule mod_vroot.c
<Global>
   VRootEngine              on
   VRootLog                 /appli_var/XFRF/proftpd/vroot.log
   VRootOptions             allowSymlinks
   DefaultRoot ~
</Global>

[...]

# Directory limits
<Global>
   <Directory />
      <Limit ALL>
         DenyAll
      </Limit>
      <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD STAT XCUP XPWD OPENDIR READDIR REALPATH LSTAT FSTAT SETSTAT STOR SITE_CHMOD>
         AllowAll
      </Limit>
   </Directory>
   <Directory /in>
      <Limit ALL>
         DenyAll
      </Limit>
      <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD STAT XCUP XPWD RETR SIZE APPE DELE RNFR RNTO STOR STOU SITE_CHMOD SETSTAT FSETSTAT LSTAT FSTAT READ>
         AllowAll
      </Limit>
   </Directory>
   <Directory /out>
      <Limit ALL>
         DenyAll
      </Limit>
      <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD STAT XCUP XPWD RETR SIZE DELE SITE_CHMOD SETSTAT FSETSTAT LSTAT FSTAT READ>
         AllowAll
      </Limit>
   </Directory>
</Global>

[...]

LoadModule mod_sftp.c
# SFTP virtual server (user/password authentication)
# ----------------------------------------------------
<VirtualHost 10.19.xx.xxx>
    <Limit LOGIN>
      AllowAll
    </Limit>
    ServerName                  "SFTP Server"
    Port                        20022
    AccessGrantMsg              "Welcome to SFTP %u"
    SFTPEngine                  on
    SFTPHostKey                 /appli/XFRF/proftpd/etc/ssh/proftpd_dsa_key
    SFTPHostKey                 /appli/XFRF/proftpd/etc/ssh/proftpd_rsa_key
    SFTPHostKey                 /appli/XFRF/proftpd/etc/ssh/proftpd_ecdsa_key
    SFTPAuthMethods             password
    SFTPCompression             delayed
    SFTPLog                     /appli_var/XFRF/proftpd/sftp.log
    ExtendedLog                 /appli_var/XFRF/proftpd/sftp_extended.log
    TransferLog                 /appli_var/XFRF/proftpd/sftp_transfer.log
    ServerLog                   /appli_var/XFRF/proftpd/sftp_server.log
</VirtualHost>

[...]

如果有必要，我可以在 /var/log/messages 中看到更多内容：

dispatching PRE_CMD command 'LSTAT /out/test' to mod_tls
dispatching PRE_CMD command 'LSTAT /out/test' to mod_exec
dispatching PRE_CMD command 'LSTAT /out/test' to mod_core
dispatching PRE_CMD command 'LSTAT /out/test' to mod_core
in dir_check(): setting umask to 0022 (was 0022)
dispatching POST_CMD command 'LSTAT /out/test' to mod_exec
dispatching LOG_CMD command 'LSTAT /out/test' to mod_log
dispatching PRE_CMD command 'STAT /out/test' to mod_tls
dispatching PRE_CMD command 'STAT /out/test' to mod_exec
dispatching PRE_CMD command 'STAT /out/test' to mod_core
dispatching PRE_CMD command 'STAT /out/test' to mod_core
in dir_check(): setting umask to 0022 (was 0022)
dispatching POST_CMD command 'STAT /out/test' to mod_exec
dispatching LOG_CMD command 'STAT /out/test' to mod_log
dispatching PRE_CMD command 'RETR /out/test' to mod_tls
dispatching PRE_CMD command 'RETR /out/test' to mod_exec
dispatching PRE_CMD command 'RETR /out/test' to mod_core
dispatching PRE_CMD command 'RETR /out/test' to mod_core
dispatching PRE_CMD command 'RETR /out/test' to mod_vroot
dispatching PRE_CMD command 'RETR /out/test' to mod_vroot
dispatching PRE_CMD command 'RETR /out/test' to mod_auth
dispatching PRE_CMD command 'RETR /out/test' to mod_xfer
in dir_check_full(): path = '/appli_var/XFRF/xfrf_files/ftpusers/IFTPTEST/out/test', fullpath = '/appli_var/XFRF/xfrf_files/ftpusers/IFTPTEST/out/test'
RETR /appli_var/XFRF/xfrf_files/ftpusers/IFTPTEST/out/test denied by <Limit> configuration
dispatching POST_CMD_ERR command 'RETR /out/test' to mod_exec
dispatching POST_CMD_ERR command 'RETR /out/test' to mod_vroot
dispatching POST_CMD_ERR command 'RETR /out/test' to mod_auth
dispatching LOG_CMD_ERR command 'RETR /out/test' to mod_log
dispatching LOG_CMD_ERR command 'RETR /out/test' to mod_xfer
dispatching POST_CMD_ERR command 'OPEN /out/test' to mod_exec
dispatching LOG_CMD_ERR command 'OPEN /out/test' to mod_log
redhat