Re: [Proftpd-user] SElinux question on 1.3.6

On 2017-11-13 20:52, Philip Prindeville wrote:
> Hi all (and TJ and Paul in particular),
> 
> I’m running 1.3.6 on a Fedora 26 host, with the SElinux targeted 
> policy.
> 
> mod_delay is trying to open /var/proftpd/delay.tab but failing.  Looks
> like missing policy:
> 
> type=AVC msg=audit(1510602554.692:3357): avc:  denied  { write } for
> pid=29681 comm="proftpd" name="proftpd" dev="sda6" ino=4456449
> scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:var_t:s0 tclass=dir permissive=0
> 
> what are the correct settings?  I’ll try to test them then submit a
> fix for Fedora/RHEL/Centos/EPEL.

Not missing policy, missing configuration. The default delay table 
location isn't going to play well with SELinux; try this:

   DelayTable                    /run/proftpd/proftpd.delay

Here's what I have for mod_delay:

# Login delays to slow down clients using multiple logins
<IfModule mod_delay.c>
   # This gets cleared on reboot
   DelayTable                    /run/proftpd/proftpd.delay

   # Allow root to use "ftpdctl delay ..."
   DelayControlsACLS             all allow user root

   # Configure successful logins to be delayed by 2 secs
   DelayOnEvent                  PASS 2000ms

   # Configure failed logins to be delayed by 5 secs
   DelayOnEvent                  FailedLogin 5s
</IfModule>

Cheers, Paul.

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html