Re: [Proftpd-user] UID/GID and permission denied
Sergei Gerasenko <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <[email protected]> |
I think I got to the bottom of it. Whew. It has to do with NFS and the number of supplemental groups this user has, which is > 400. It appears that NFS has some sort of a limit on the number of these groups passed in the NFS request. It’s either 16 or 32, or some other low number like that. Once I reduced the group file to 2 lines, I was able to access the directory I couldn’t access before. I’m not sure what the solution is for me though. I’ll have to work it out by tweaking the NFS server settings. I learned something though! Thank you so much, TJ. > On Aug 2, 2018, at 8:12 PM, TJ Saunders <[email protected]> wrote: > > >> During all this debugging I was always looking at numeric uids/gids >> This is a fresh install of proftpd and I have full control over it >> No ACLs on the NFS server side, nor POSIX ACLs are defined to my >> knowledge >> I’m able to simulate the user/group situation in the system using the >> standard passwd/group file and access is granted/denied as expected >> I’m able to access a few directories through supgrp membership through >> proftpd, but I can’t see how they are different. This is the most >> puzzling circumstance. >> >> I will continue debugging tomorrow. > > What happens if you disable the mod_cap module, for testing, using the following in your proftpd.conf: > > <IfModule mod_cap.c> > CapabilitiesEngine off > </IfModule> > > Linux capabilities can affect permissions in less obvious/harder to see ways. Worth an experiment, perhaps? > > Cheers, > TJ ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html