Re: [Proftpd-user] Mod_ban.c : does it work with IfClass and with serveral VirtualHosts ?

Thanks for your answer.

So, the problem is solved when I include "BanEngine    on" in the server 
config section and when I include in the </Global> section :

         <IfModule mod_ban.c>
                 <IfClass whitelist>
                       # Turn the mod_ban module off for whitelisted 
clients
                       BanEngine off
                 </IfClass>

                 <IfClass !whitelist>
                       # Make sure the mod_ban module is on for clients 
that are not whitelisted
                       BanEngine on
                 </IfClass>
         </IfModule>

When I leave out the directive setting "BanEngine    on" in the server 
config section, the settings in the </Global> section do not have an effect.

Still I have a question about the second question: 2) Am I wrong 
asumming that the same BAN-module should function for the SFTP *and* FTP 
Virtual Hosts

It turned out that when a client-host is banned from within the 
SFTP-VirtualHost, it isn't automatically banned in the FTP-VirtualHost.

Example:
First I let ban the client-host 10.65.140.15 for SFTP-connections via 
the SFTP-VirtualHost by connecting too frequently from the dropserver 
itself (IP=10.65.140.15).

ftpdctl -s <Base-dir>/proftpd/var/ctrls.sock ban info -ev
ftpdctl: Banned Hosts:
ftpdctl:   10.65.140.15
ftpdctl:     Reason: ClientConnectRate autoban at Mon Apr 27 17:16:00 2020
ftpdctl:     Expires: Mon Apr 27 19:16:00 2020 (in 7193 seconds)
ftpdctl:     <VirtualHost>: ProFTPD RHEL Test Dropserver-SFTP 
(10.65.140.15#22)
ftpdctl:
ftpdctl: Ban Events:
ftpdctl:   Event: ClientConnectRate
ftpdctl:   Source: 10.65.140.15
ftpdctl:     Occurrences: 10/10
ftpdctl:     Entry Expires: 43 seconds
ftpdctl:     <VirtualHost>: ProFTPD RHEL Test Dropserver-SFTP 
(10.65.140.15#22)

||

And then I tried FTP-connections to the FTP-VirtualHost from the 
dropserver itself and that succeeds (I made here 4 FTP-connections already):

# ftpdctl -s <Base-dir>/proftpd/var/ctrls.sock ban info -ev
ftpdctl: Banned Hosts:
ftpdctl:   10.65.140.15
ftpdctl:     Reason: ClientConnectRate autoban at Mon Apr 27 17:16:00 2020
ftpdctl:     Expires: Mon Apr 27 19:16:00 2020 (in 6970 seconds)
ftpdctl:     <VirtualHost>: ProFTPD RHEL Test Dropserver-SFTP 
(10.65.140.15#22)
ftpdctl:
ftpdctl: Ban Events:
ftpdctl:   Event: ClientConnectRate
ftpdctl:   Source: 10.65.140.15
ftpdctl:     Occurrences: 4/10
ftpdctl:     Entry Expires: 49 seconds
ftpdctl:     <VirtualHost>: ProFTPD Vo Test Dropserver-FTP (10.65.140.15#21)

Until I also reach the limit of 10 connections per minute:

# ftpdctl -s <Base-dir>/proftpd/var/ctrls.sock ban info -ev
ftpdctl: Banned Hosts:
ftpdctl:   10.65.140.15
ftpdctl:     Reason: ClientConnectRate autoban at Mon Apr 27 17:16:00 2020
ftpdctl:     Expires: Mon Apr 27 19:16:00 2020 (in 6928 seconds)
ftpdctl:     <VirtualHost>: ProFTPD RHEL Test Dropserver-SFTP 
(10.65.140.15#22)
ftpdctl:   10.65.140.15
ftpdctl:     Reason: ClientConnectRate autoban at Mon Apr 27 17:20:23 2020
ftpdctl:     Expires: Mon Apr 27 19:20:23 2020 (in 7191 seconds)
ftpdctl:     <VirtualHost>: ProFTPD Vo Test Dropserver-FTP (10.65.140.15#21)
ftpdctl:
ftpdctl: Ban Events:
ftpdctl:   Event: ClientConnectRate
ftpdctl:   Source: 10.65.140.15
ftpdctl:     Occurrences: 10/10
ftpdctl:     Entry Expires: 7 seconds
ftpdctl:     <VirtualHost>: ProFTPD Vo Test Dropserver-FTP (10.65.140.15#21)

I hoped that when the SFTP-VirtualHost denied connection from source-IP 
10.65.140.15, that also FTP-connections from the same source IP 
10.65.140.15 would have been denied.

Or did I configure something wrong ?

With regards,

Pieter de Gaaij

||
On 27 Apr 2020 02:07, TJ Saunders wrote:
>   
>> 1) SFTP/SCP file transfers from 192.168.101.165 are still banned when
>> executed more than 10 times a minute. So it seems that the BanEngine is
>> always on.
>>
>>   2) Even SFTP/SCP sessions initiated on the dropserver itself
>> (10.65.140.15: so not whitelisted) are banned when the frequency is
>> higher than 10 times/min.`
>>
>> 3) And it seems that the FTP-sessions are not banned at all: when the
>> SFTP-connection from ```10.65.140.15 is banned, I am still able to
>> connect to the FTP-virtual host.``
>>
>> Questions:
>>
>> 1) did I have mis-configured the BAN-module and the IfSession modules
>> with the IfClass directives ?
> No.
>
> However, you have made a common assumption/misconfiguration -- most configuration directives that are *not* within a <VirtualHost> or <Global> section are not *global*.  This means that they do not automatically apply to <VirtualHost> sections.
>
> Since your mod_ban configuration is not in a <Global> section, it will not apply to your separate <VirtualHost> sections.  To remedy this, try:
>
>    <IfModule mod_ban.c>
>      # Make sure these ban configurations apply to all <VirtualHost> sections
>      <Global>
>        # Add your <IfClass> and other ban directives here
>      </Global>
>    </IfModule>
>
>> 2) Am I wrong asumming that the same BAN-module should function for
>> the SFTP *and* FTP Virtual Hosts ?
> It should function, yes, as long as you use <Global> sections.
>
> Hope this helps,
> TJ
>
>
> _______________________________________________
> ProFTPD Users List   <[email protected]>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html