Re: [Proftpd-user] ProFTPD server sending PORT for passive on different IP address than contacted

TJ

Okay, can you help me figure out what needs to be moved from our
Global/Server config into each of the VirtualHost definitions and what can
stay in the Global/Server definition portions? I've stripped out all of the
comments and anonymized the addresses & sundry, here's our current config
in its entirety:

---------------------------------------------------------------------------------------------
ServerName             "PPX"
ServerType             standalone
DefaultServer          on
DefaultAddress         198.x.y.100 198.x.y.103 2001:4d0:x:y::64
2001:4d0:x:y::67
ServerIdent            on "Server ready"
PidFile
/NFS/local/ha_scripts/ourweb/proftpd/var/run/ourweb_proftpd.pid
ScoreboardFile
/NFS/local/ha_scripts/ourweb/proftpd/var/run/ourweb_proftpd.scoreboard
DelayTable
/NFS/local/ha_scripts/ourweb/proftpd/var/run/ourweb_proftpd.delay
DeferWelcome            off
Port                    21
TimeoutLogin            120
TimeoutIdle             300
TimeoutNoTransfer       600
TimeoutStalled          1800
PassivePorts            64000 65000
AllowForeignAddress     off
UseIPv6                 on
UseReverseDNS           off
IdentLookups            off
MaxInstances            300
User                    nobody
Group                   nobody
DefaultRoot ~ vrtftp
DefaultRoot ~ exxdis
AllowOverwrite          on
TransferLog  /var/log/proftpd/ftpdist_xferlog
LogFormat    default "%h %l %u %t \"%r\" %s %b"
LogFormat    auth    "%v [%P] %h %t \"%r\" %s"
LogFormat    write   "%h %l %u %t \"%r\" %s %b"
LogFormat    full    "%{%Y%m%d:%T:%Z}t|%h|%v|%P|\"%r\"|%F|%s|%b|"
LogFormat    fulluser    "%{%Y%m%d:%T:%Z}t|%h|%U|%P|\"%r\"|%F|%s|%b|"
LogFormat    debug
"%{%Y%m%d:%T:%Z}t|%h||%P|\"%r\"|%F|%s|%b|***|%m|%J|%p|%S|%T|"
<Limit SITE_CHMOD>
  DenyAll
</Limit>
<Limit WRITE>
   Order allow, deny
   Deny from All
</Limit>
<IfModule mod_tls.c>
    TLSEngine on
    TLSLog /var/log/proftpd/ourftp_tls.log
    TLSProtocol TLSv1.2
    TLSRequired auth
    TLSRSACertificateFile /NFS/local/etc/certs/Tcombined.crt
    TLSRSACertificateKeyFile /NFS/local/etc/certs/Tcombined.key
    TLSCACertificateFile /NFS/local/etc/certs/TcombinedIntermediateCA.crt
    TLSVerifyClient off
    TLSRenegotiate none
    TLSOptions NoSessionReuseRequired AllowClientRenegotiations
    TLSOptions EnableDiags
    TLSCipherSuite
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA
</IfModule>
<Limit LOGIN>
  AllowGroup vrtftp
  AllowGroup ppxuser
  AllowUser  thaeronline
  AllowUser  dsc
  DenyAll
</Limit>
<Global>
        ServerIdent             on "FTPS Server ready"
        DisplayConnect          /etc/ftpissue
        DisplayLogin            welcome.msg
        DisplayChdir            readme true
        ExtendedLog             /var/log/proftpd/ftpdist_access.log
WRITE,READ write
        ExtendedLog             /var/log/proftpd/ftpdist_auth.log AUTH auth
        ExtendedLog             /var/log/proftpd/ftpdist_all.log ALL full
        ExtendedLog             /var/log/proftpd/ourftp_alluser.log ALL
fulluser
        ExtendedLog             /var/log/proftpd/ourftp_debug.log ALL debug
        MaxClients              1000
        MaxClientsPerHost       100 "This IP address has too many open
connections"
        MaxClientsPerUser       10 "This account has too many open
connections"
        AllowForeignAddress     off
        AuthUserFile
/NFS/local/ha_scripts/ourweb/proftpd/etc/proftpd.virtualuser.passwd
    <IfGroup virtftp>
        <Limit WRITE>
            DenyAll
        </Limit>
    </IfGroup>
    <IfGroup ppxuser>
        <Limit WRITE>
            DenyAll
        </Limit>
    </IfGroup>
    <IfUser thaeronline>
        <Limit LOGIN>
            Order Allow,Deny
            Allow from 198.x.z.,198.x.y.,192.168.0.,127.0.0.1
            DenyAll
        </Limit>
    </IfUser>
</Global>
---------------------------------------------------------------------------------------------


Do I just move the addresses to separate blocks and put the MasqueradeAddress
definition in? Or do I also need to replicate the various Limit, IfGroup,
IfUser, IfModule, MaxClients*, and AuthUserFile declarations in each block?
I appreciate the help, since it's an in-use system I don't have the luxury
of playing with the configuration and seeing what breaks and what works.

Thanks!




On Thu, Feb 4, 2021 at 11:07 AM TJ Saunders <[email protected]> wrote:

>
> > How can I force Proftpd to only respond and provide ports for the IP
> > address on which it was contacted and not just the first one in its
> > DefaultAddress setting?
>
> The way to configure this is to use explicit <VirtualHost> sections, one
> for each of the addresses.  In each <VirtualHost> section, you would
> configure a MasqueradeAddress directive, which tells ProFTPD which address
> to send to clients -- who connect to that <VirtualHost> -- in the PASV/EPSV
> responses.
>
> Cheers,
> TJ
>
>
> _______________________________________________
> ProFTPD Users List   <[email protected]>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html
>


-- 
Tony Stocker
-------------------------------------------------------------------
  "There are no wrong turnings.
   Only paths you had not known
   you were meant to walk."
-------------------------------------------------------------------

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html