[Proftpd-user] SQLAuthType Backend returns "password mismatch" for MySQL on proftpd v1.3.6

Hi,

[reply<http://bugs.proftpd.org/show_bug.cgi?id=4371#add_comment>] [-]<http://bugs.proftpd.org/show_bug.cgi?id=4371#>Description<http://bugs.proftpd.org/show_bug.cgi?id=4371#c0>James<mailto:[email protected]> 2019-06-27 17:12:00 UTC

Hi,

I have been running a ftp server on Debian Jessie for many years now and just
recently setup a new server with Debian Buster and installed proftpd on it.

On the old system (Jessie):

dpkg -l | grep proftpd
ii  proftpd-basic                  1.3.5e+r1.3.5-2+deb8u2           amd64
ii  proftpd-mod-mysql              1.3.5e+r1.3.5-2+deb8u2           amd64

On the new debian buster:

dpkg -l | grep proftpd
ii  proftpd-basic                        1.3.6-4                     amd64
ii  proftpd-doc                          1.3.6-4                     all
ii  proftpd-mod-mysql                    1.3.6-4                     amd64

(Installation through apt)

So I have separate single Mysql database which stores the FTP users.

mysql --version
mysql  Ver 14.14 Distrib 5.7.25, for Linux (x86_64) using  EditLine wrapper

As per http://www.proftpd.org/docs/howto/SQL.html

I saw that from Mysql v5.7 the PASSWORD('') encryption in mysql is no longer
supported the reasons for which have been explained.

But the peculiar point was that the authentication with the same database works
in proftpd version 1.3.5 but does not work in proftpd version 1.3.6

here are the logs for the old jessie server running the 1.3.5 proftpd

2019-06-27 12:46:45,600 mod_sql/4.3[2173]: checking password using SQLAuthType
'Backend'
2019-06-27 12:46:45,600 mod_sql/4.3[2173]: entering     mysql cmd_checkauth
2019-06-27 12:46:45,600 mod_sql/4.3[2173]: exiting      mysql cmd_checkauth
2019-06-27 12:46:45,600 mod_sql/4.3[2173]: 'Backend' SQLAuthType handler
reports success
2019-06-27 12:46:45,600 mod_sql/4.3[2173]: cache hit for user 'test'


and for the new system:

2019-06-27 16:27:10,824 mod_sql/4.3[17216]: checking password using SQLAuthType
'Backend'
2019-06-27 16:27:10,824 mod_sql/4.3[17216]: entering    mysql cmd_checkauth
2019-06-27 16:27:10,824 mod_sql/4.3[17216]: password mismatch
2019-06-27 16:27:10,824 mod_sql/4.3[17216]: exiting     mysql cmd_checkauth


So the only variable here is the proftpd version. The database is the same.
This is the exact same issue as reported in BUG#3932<http://bugs.proftpd.org/show_bug.cgi?id=3932> but was fixed in 1.3.5.

here is the config for the new server running proftpd v1.3.6:

proftpd -V
Compile-time Settings:
  Version: 1.3.6 (stable)
  Platform: LINUX [Linux 4.15.0-52-generic x86_64]
  Built: Mon Jan 14 2019 11:07:16 UTC
  Built With:
    configure  '--build=x86_64-linux-gnu' '--includedir=${prefix}/include'
'--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info'
'--sysconfdir=/etc' '--localstatedir=/var' '--disable-silent-rules'
'--libdir=${prefix}/lib/x86_64-linux-gnu'
'--libexecdir=${prefix}/lib/x86_64-linux-gnu' '--disable-maintainer-mode'
'--disable-dependency-tracking' '--prefix=/usr'
'--with-includes=/usr/include/postgresql:/usr/include/mariadb:/usr/include/mariadb/mysql'
'--mandir=/usr/share/man' '--sysconfdir=/etc/proftpd' '--localstatedir=/run'
'--libexecdir=/usr/lib/proftpd' '--enable-sendfile' '--enable-facl'
'--enable-dso' '--enable-autoshadow' '--enable-ctrls' '--enable-ipv6'
'--enable-nls' '--enable-memcache' '--with-lastlog=/var/log/lastlog'
'--enable-pcre' '--disable-strip' '--enable-redis' '--build' 'x86_64-linux-gnu'
'--with-shared=mod_unique_id:mod_site_misc:mod_load:mod_ban:mod_quotatab:mod_sql:mod_sql_mysql:mod_sql_postgres:mod_sql_sqlite:mod_sql_odbc:mod_dynmasq:mod_quotatab_sql:mod_ldap:mod_quotatab_ldap:mod_ratio:mod_tls:mod_rewrite:mod_radius:mod_wrap:mod_wrap2:mod_wrap2_file:mod_wrap2_sql:mod_quotatab_file:mod_quotatab_radius:mod_facl:mod_ctrls_admin:mod_copy:mod_deflate:mod_ifversion:mod_geoip:mod_exec:mod_sftp:mod_sftp_pam:mod_sftp_sql:mod_shaper:mod_sql_passwd:mod_ifsession:mod_auth_otp:mod_tls_redis:mod_wrap2_redis:mod_redis:mod_memcache:mod_tls_memcache:mod_readme:mod_snmp'
'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2
-fdebug-prefix-map=/build/proftpd-dfsg-1.3.6=. -fstack-protector-strong
-Wformat -Werror=format-security' 'LDFLAGS=-Wl,-z,relro' 'CPPFLAGS=-Wdate-time
-D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2
-fdebug-prefix-map=/build/proftpd-dfsg-1.3.6=. -fstack-protector-strong
-Wformat -Werror=format-security'

  CFLAGS: -g2 -g -O2 -fdebug-prefix-map=/build/proftpd-dfsg-1.3.6=.
-fstack-protector-strong -Wformat -Werror=format-security -Wall
-fno-omit-frame-pointer -Werror=implicit-function-declaration
  LDFLAGS: -L$(top_srcdir)/lib -Wl,-z,relro -rdynamic
-L/usr/lib/x86_64-linux-gnu/ -L/usr/lib/x86_64-linux-gnu
  LIBS: -lacl  -lpcreposix -lpcre -lssl -lcrypto -lcap  -lpam -lsupp -lattr
-lnsl -lresolv -lresolv -lcrypt -ldl -lhiredis -lmemcachedutil -lmemcached

  Files:
    Configuration File:
      /etc/proftpd/proftpd.conf
    Pid File:
      /run/proftpd.pid
    Scoreboard File:
      /run/proftpd.scoreboard
    Header Directory:
      /usr/include/proftpd
    Shared Module Directory:
      /usr/lib/proftpd

  Info:
    + Max supported UID: 4294967295
    + Max supported GID: 4294967295

  Features:
    + Autoshadow support
    + Controls support
    + curses support
    - Developer support
    + DSO support
    + IPv6 support
    + Largefile support
    + Lastlog support
    + Memcache support
    + ncursesw support
    + NLS support
    + Redis support
    - Sodium support
    + OpenSSL support
    + PCRE support
    + POSIX ACL support
    + Shadow file support
    + Sendfile support
    + Trace support
    + xattr support

  Tunable Options:
    PR_TUNABLE_BUFFER_SIZE = 1024
    PR_TUNABLE_DEFAULT_RCVBUFSZ = 8192
    PR_TUNABLE_DEFAULT_SNDBUFSZ = 8192
    PR_TUNABLE_ENV_MAX = 2048
    PR_TUNABLE_GLOBBING_MAX_MATCHES = 100000
    PR_TUNABLE_GLOBBING_MAX_RECURSION = 8
    PR_TUNABLE_HASH_TABLE_SIZE = 40
    PR_TUNABLE_LOGIN_MAX = 256
    PR_TUNABLE_NEW_POOL_SIZE = 512
    PR_TUNABLE_PATH_MAX = 4096
    PR_TUNABLE_SCOREBOARD_BUFFER_SIZE = 80
    PR_TUNABLE_SCOREBOARD_SCRUB_TIMER = 30
    PR_TUNABLE_SELECT_TIMEOUT = 30
    PR_TUNABLE_TIMEOUTIDENT = 10
    PR_TUNABLE_TIMEOUTIDLE = 600
    PR_TUNABLE_TIMEOUTLINGER = 10
    PR_TUNABLE_TIMEOUTLOGIN = 300
    PR_TUNABLE_TIMEOUTNOXFER = 300
    PR_TUNABLE_TIMEOUTSTALLED = 3600
    PR_TUNABLE_XFER_SCOREBOARD_UPDATES = 10


I created a new user with MD5 and enabled mod_sql_passwords and that works
fine, it seems the backend auth type is not working in the new version of
proftpd.

2019-06-27 17:05:39,733 mod_sql/4.3[17298]: checking password using SQLAuthType
'md5'
2019-06-27 17:05:39,733 mod_sql/4.3[17298]: 'md5' SQLAuthType handler reports
success
2019-06-27 17:05:39,733 mod_sql/4.3[17298]: cache hit for user 'test1'


Any info on this would be appreciated. Thanks!

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html