Re: [Proftpd-user] ftpdctl ban user is not permanent

On 2019-10-30 13:34, David Mathog wrote:
> On 2019-10-30 10:45, Matus UHLAR - fantomas wrote:
>> On 29.10.19 14:07, David Mathog wrote:
>>> This CentOS 7 system can ban ftp users by name with:
>>> 
>>>  ftpdctl ban user USERNAME
>>> 
>>> but it does not survive a stop/start cycle of proftpd.
>> 
>> http://www.proftpd.org/docs/contrib/mod_ban.html#FAQ
>> 
>> I believe this answers your question
> 
> It did, and then again it didn't.

Here is my solution for banning three user logins.
As root (which runs ftpdctl on this  CentOS 7 system)

cat >/usr/local/bin/proftpd_bans.sh <<'EOD'
#!/bin/bash
ftpdctl ban user USER1_NAME
ftpdctl ban user USER2_NAME
ftpdctl ban user USER3_NAME
EOD
chmod 700 /usr/local/bin/proftpd_bans.sh

cat >/etc/systemd/system/proftpd_ban.service <<'EOD'
[Unit]
Description=Ban certain users from connecting to proftpd
After=proftpd.target
StartLimitIntervalSec=0[Service]

[Service]
Type=simple
Restart=always
RestartSec=1
User=root
ExecStart=/usr/local/bin/proftpd_bans.sh

[Install]
WantedBy=multi-user.target
EOD


systemctl enable proftpd_ban.service
systemctl start proftpd_ban.service


It starts, but takes a while to load all the ban values.  Also there is 
an SElinux problem
(isn't there always?) for each ftpdctl command:

    SELinux is preventing /usr/sbin/proftpd from unlink access on the 
sock_file ftp.cl04925

and those were accumulating in /tmp.  The fix for that was:

ausearch -c 'proftpd' --raw | audit2allow -M my-proftpd
semodule -i my-proftpd.pp


So doing this:

systemctl stop proftpd_ban.service
systemctl stop proftpd.service
systemctl start proftpd.service
systemctl start proftpd_ban.service

proftpd restarts and the bans are reentered.  They do add very slowly 
though, like one every 5 seconds.  That is OK in this case because there 
are so few of them.

Regards,

David Mathog
[email protected]
Manager, Sequence Analysis Facility, Biology Division, Caltech


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html