Re: [Proftpd-user] File extension AllowFiler working for ftp but not sftp

On 12.03.21 09:33, Block, Clemens via Proftp-user wrote:
>Meanwhile I twaked config to have STOR in the second section, and it works.
>This means, that AllowFilter is disabled right now.
>So it looks like that AllowFilter not works as expected using SFTP (but it works using FTP).

do you have it in main config or in <Global> section?

some settings from vglobal settings are not inherited to virtual hosts
(I guess you have sftp virtual host), they must be in <Global> section>

>#  <IfGroup supplier>
>#     <Limit STOR >
>#     Order deny, allow
>#     AllowFilter (\.zip$|\.ZIP$)
>#    </Limit>
>#  </IfGRoup>
>  <Limit APPE DELE STOR CDUP CWD PWD STOU REST SIZE DELE>
>#  <Limit APPE DELE CDUP CWD PWD STOU REST SIZE DELE>
>    AllowGroup supplier
>  </Limit>
>  <Limit RETR RNFR RNTO MKD RMD >
>    DenyGroup supplier
>  </Limit>
>
>Regards
>   Clemens
>
>-----Ursprüngliche Nachricht-----
>Von: TJ Saunders <[email protected]>
>Gesendet: Freitag, 12. März 2021 02:54
>An: ProFTPD Users <[email protected]>
>Betreff: Re: [Proftpd-user] File extension AllowFiler working for ftp but not sftp
>
>[EXTERNAL EMAIL] This mail was not sent from TecAlliance. Be careful when clicking on stuff.
>
>> Below config is working fine for FTP but breaks for SFTP.
>>
>> (logfile shows WRITE of ‘/abc.zip' blocked by <Limit> configuration)
>>
>> For SFTP filehandle is created, but than client get permission denied
>> and can’t upload Any idea what’s wrong or can be improved?
>>
>>
>>   <Limit APPE DELE CDUP CWD PWD STOU REST SIZE DELE>
>>     AllowGroup supplier
>>   </Limit>
>>
>>   <Limit RETR RNFR RNTO MKD RMD >
>>     DenyGroup supplier
>>   </Limit>
>
>The SFTP protocol is different from FTP; this difference shows up here.  For an FTP upload, it's a single STOR command.  But for SFTP, it's a sequence of requests:
> * OPEN
> * WRITE
> * WRITE
> * WRITE
> * ...
> * CLOSE
>
>Thus you may need to add "WRITE" to your list of allowed commands for the "supplier" group, for SFTP uploads.

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Fighting for peace is like fucking for virginity...


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html