Re: [Proftpd-user] UID/GID and permission denied
Sergei Gerasenko <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <[email protected]> |
To summarize: During all this debugging I was always looking at numeric uids/gids This is a fresh install of proftpd and I have full control over it No ACLs on the NFS server side, nor POSIX ACLs are defined to my knowledge I’m able to simulate the user/group situation in the system using the standard passwd/group file and access is granted/denied as expected I’m able to access a few directories through supgrp membership through proftpd, but I can’t see how they are different. This is the most puzzling circumstance. I will continue debugging tomorrow. > On Aug 2, 2018, at 4:52 PM, TJ Saunders <[email protected]> wrote: > > >> Is it proftpd that makes the decision on whether to grant access to a >> file/dir based on the contents of the custom password/group files >> (mod_auth_file) or is that information somehow passed to lower level >> linux libraries? > > ProFTPD consults the AuthUserFile/AuthGroupFile during authentication, to determine what UID, primary GID, and supplemental group memberships to assign to the forked process. > > Filesystem permissions are enforced by the kernel, and they are based on the UID/GID/groups of the requesting process, not based on names. So usually, in cases like this, the issue is one of a mismatch between the UID/GID/groups needed by the filesystem (hence the question about NFS ACLs and whatnot), and the UID/GID/groups assigned to the process by the contents of AuthUserFile/AuthGroupFile. > > It's also possible that any POSIX ACLs might come into play (especially if the --enable-facl build option, and mod_facl module, are used), or, lastly, any <Directory> and/or <Limit> configuration sections. > > TJ ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html