Re: [Proftpd-user] mod_sftp slowness - how can I track this down

>>>>> "Michel" == Michel van der List <[email protected]> writes:

Michel> I recently upgraded a machine to RedHat 8 and used the
Michel> provided proftpd rpm. This installs version 1.3.6e with some
Michel> patches. I use the mod_sftp module to provide access to a
Michel> small number of people. Prior to this version of the OS, on
Michel> RedHat 7, this worked just fine (version 1.3.5e). However, on
Michel> this version, browsing directories and accessing file using
Michel> the OpenSSH_8.4 sftp client is dreadfully slow.

Do you have selinux setup on your RHEL8 system?  

Michel> I tried bunch of things, such as FSCachePolicy, FSOptions,
Michel> turning off SFTPExtensions, different advertized SFTPDigests and
Michel> SFTPCiphers, changed channelWindowSize, channelPacketSize, but
Michel> nothing seems to help. I turned on the Tracelog but that did not
Michel> tell *me* anything, though there's information there that
Michel> I don't understand.

Can you share the log?  Or better yet, can you compare it with the
same log using the 1.3.5 version?

Michel> I then created an updated rpm for version 1.3.7a and I get the
Michel> same thing.

Smells like a RHEL8 issue, not a proftpd issue.  

Michel> Before I go off and downgrade to 1.3.5e (which I'd have to
Michel> recreate an RPM) I'm curious to know if there's anything I can
Michel> do to track this down. Of course I'm also curious if
Michel> downgrading would fix this anyway, or if there's something
Michel> else that's getting in the way.

Can you just compile and do a test install of 1.3.5e by hand and
install it to /opt/... so you can do tests on a different port?  

Michel> I'll attach my current WIP configuration below. Any insights on how to
Michel> track this down would be much appreciated.

The config looks fine to me, but I'm not an expert.  Can you give a
better estimate of how slow directory operations are?  And maybe you
can turn off selinux as a test and see if that makes a difference?

John

Michel> ServerName		"REDACTED"
Michel> ServerIdent		on "FTP Server ready."
Michel> ServerAdmin		help@REDACTED
Michel> DefaultServer		off
Michel> MaxInstances		20

Michel> # FSCachePolicy size 4096 maxAge 120
Michel> # FSOptions IgnoreExtendedAttributes
Michel> # TraceLog /var/log/sftp-trace.log
Michel> # Trace scp:20 sftp:20 ssh2:20

Michel> UseReverseDNS		off
Michel> IdentLookups		off
Michel> ScoreboardFile		/var/run/proftpd/scoreboard
Michel> PidFile			/run/proftpd/proftpd.pid

Michel> TimeoutLogin		60
Michel> TimeoutStalled		600
Michel> TimeoutSession		7200
Michel> TimeoutIdle		300
Michel> TimeoutNoTransfer	1860

Michel> LogFormat sshlog "%{%c}t %h %u sftp(%P) \"%r\" %s %b"

Michel> LoadModule		mod_sftp.c
Michel> SFTPEngine		on
Michel> DefaultAddress		130.91.210.143
Michel> Port			22
Michel> SFTPExtensions -checkFile -copyFile -fsync -vendorID -versionSelect -posixRename -spaceAvailable -statvfs -hardlink -xattr
Michel> SFTPDigests hmac-md5 hmac-sha1 hmac-sha2-256 hmac-sha2-512 \
Michel>      hmac-ripemd160 hmac-sha1-96 hmac-md5-96 [email protected] \
Michel>      [email protected]
Michel> SFTPCiphers aes128-cbc 3des-cbc blowfish-cbc cast128-cbc arcfour128 \
Michel>                arcfour256 aes192-cbc aes256-cbc aes128-ctr aes192-ctr aes256-ctr
Michel> SFTPCompression on

Michel> User			ftp
Michel> Group			ftp
Michel> DelayEngine		off
Michel> Umask			022

Michel> DefaultRoot		/www/html
Michel> ExtendedLog		/var/log/proftpd/extended.log AUTH sshlog
Michel> # ExtendedLog		/var/log/proftpd/extended.log AUTH,DIRS,READ,WRITE sshlog

Michel> SFTPOptions		IgnoreSFTPUploadPerms
Michel> SFTPAuthMethods		password
Michel> SFTPHostKey            	/etc/proftpd/proftpd_host_rsa_key
Michel> SFTPHostKey		/etc/proftpd/proftpd_host_dsa_key
Michel> AuthUserFile		/etc/proftpd/passwd
Michel> AuthGroupFile		/etc/group

Michel> RequireValidShell	off
Michel> ListOptions		"-a"
Michel> TimesGMT		off
Michel> CommandBufferSize	2047
Michel> AllowStoreRestart	on

Michel> # Do not allow .ftpaccess to be uploaded
Michel> PathDenyFilter		"\\.ftpaccess$"

Michel> # Normally, we want files to be overwriteable.
Michel> <Directory /*>
Michel>      AllowOverwrite	on
Michel>      HideUser		nobody
Michel> </Directory>

Michel> # fix for bug in WS_FTP client
Michel> SFTPClientMatch ".*" channelWindowSize 1GB
Michel> SFTPClientMatch ".*" channelPacketSize 256Kb
Michel> SFTPClientMatch ".*WinSCP.*" sftpProtocolVersion 3

Michel> # SFTP has its own commands, which we'll limit
Michel> <Limit LOCK SYMLINK>
Michel>      DenyAll
Michel> </Limit>



Michel> _______________________________________________
Michel> ProFTPD Users List   <[email protected]>
Michel> Unsubscribe problems?
Michel> http://www.proftpd.org/list-unsub.html


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html