Re: [Proftpd-user] UID/GID and permission denied
Sergei Gerasenko <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <[email protected]> |
To answer my own question, the answer is here: https://superuser.com/a/598397/368291 <https://superuser.com/a/598397/368291> ps -eo pid,comm,euser,supgrp | grep nginx I do see all the groups the user should need to read the directories in question. So something else must be in play. > On Aug 2, 2018, at 4:52 PM, TJ Saunders <[email protected]> wrote: > > >> Is it proftpd that makes the decision on whether to grant access to a >> file/dir based on the contents of the custom password/group files >> (mod_auth_file) or is that information somehow passed to lower level >> linux libraries? > > ProFTPD consults the AuthUserFile/AuthGroupFile during authentication, to determine what UID, primary GID, and supplemental group memberships to assign to the forked process. > > Filesystem permissions are enforced by the kernel, and they are based on the UID/GID/groups of the requesting process, not based on names. So usually, in cases like this, the issue is one of a mismatch between the UID/GID/groups needed by the filesystem (hence the question about NFS ACLs and whatnot), and the UID/GID/groups assigned to the process by the contents of AuthUserFile/AuthGroupFile. > > It's also possible that any POSIX ACLs might come into play (especially if the --enable-facl build option, and mod_facl module, are used), or, lastly, any <Directory> and/or <Limit> configuration sections. > > TJ ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html