Re: [Proftpd-user] File extension AllowFiler working for ftp but not sftp

Well,

Meanwhile I twaked config to have STOR in the second section, and it works.
This means, that AllowFilter is disabled right now.
So it looks like that AllowFilter not works as expected using SFTP (but it works using FTP).

#  <IfGroup supplier>
#     <Limit STOR >
#     Order deny, allow
#     AllowFilter (\.zip$|\.ZIP$)
#    </Limit>
#  </IfGRoup>
  <Limit APPE DELE STOR CDUP CWD PWD STOU REST SIZE DELE>
#  <Limit APPE DELE CDUP CWD PWD STOU REST SIZE DELE>
    AllowGroup supplier
  </Limit>
  <Limit RETR RNFR RNTO MKD RMD >
    DenyGroup supplier
  </Limit>

Regards
   Clemens

-----Ursprüngliche Nachricht-----
Von: TJ Saunders <[email protected]> 
Gesendet: Freitag, 12. März 2021 02:54
An: ProFTPD Users <[email protected]>
Betreff: Re: [Proftpd-user] File extension AllowFiler working for ftp but not sftp

[EXTERNAL EMAIL] This mail was not sent from TecAlliance. Be careful when clicking on stuff.

> Below config is working fine for FTP but breaks for SFTP.
>
> (logfile shows WRITE of ‘/abc.zip' blocked by <Limit> configuration)
>
> For SFTP filehandle is created, but than client get permission denied 
> and can’t upload Any idea what’s wrong or can be improved?
>
>
>   <Limit APPE DELE CDUP CWD PWD STOU REST SIZE DELE>
>     AllowGroup supplier
>   </Limit>
>
>   <Limit RETR RNFR RNTO MKD RMD >
>     DenyGroup supplier
>   </Limit>

The SFTP protocol is different from FTP; this difference shows up here.  For an FTP upload, it's a single STOR command.  But for SFTP, it's a sequence of requests:
 * OPEN
 * WRITE
 * WRITE
 * WRITE
 * ...
 * CLOSE

Thus you may need to add "WRITE" to your list of allowed commands for the "supplier" group, for SFTP uploads.

Hope this helps,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html