Re: [Proftpd-user] File extension AllowFiler working for ftp but not sftp

"Block, Clemens via Proftp-user" <[email protected]> Fri, 12 Mar 2021 10:29:21 +0000
Newsgroups gmane.network.proftpd.user
Message-ID <AM9PR10MB40383F6207B3E50A2DC8A463E06F9@AM9PR10MB4038.EURPRD10.PROD.OUTLOOK.COM>
Yes,

FTP config is in main
SFTP config is a <VirtualHost>
And all Limit, Directory, ... stuff is in <Global>

Regards
   Clemens

-----Ursprüngliche Nachricht-----
Von: Matus UHLAR - fantomas <[email protected]> 
Gesendet: Freitag, 12. März 2021 11:00
An: [email protected]
Betreff: Re: [Proftpd-user] File extension AllowFiler working for ftp but not sftp

[EXTERNAL EMAIL] This mail was not sent from TecAlliance. Be careful when clicking on stuff.

On 12.03.21 09:33, Block, Clemens via Proftp-user wrote:
>Meanwhile I twaked config to have STOR in the second section, and it works.
>This means, that AllowFilter is disabled right now.
>So it looks like that AllowFilter not works as expected using SFTP (but it works using FTP).

do you have it in main config or in <Global> section?

some settings from vglobal settings are not inherited to virtual hosts (I guess you have sftp virtual host), they must be in <Global> section>

>#  <IfGroup supplier>
>#     <Limit STOR >
>#     Order deny, allow
>#     AllowFilter (\.zip$|\.ZIP$)
>#    </Limit>
>#  </IfGRoup>
>  <Limit APPE DELE STOR CDUP CWD PWD STOU REST SIZE DELE> #  <Limit 
>APPE DELE CDUP CWD PWD STOU REST SIZE DELE>
>    AllowGroup supplier
>  </Limit>
>  <Limit RETR RNFR RNTO MKD RMD >
>    DenyGroup supplier
>  </Limit>
>
>Regards
>   Clemens
>
>-----Ursprüngliche Nachricht-----
>Von: TJ Saunders <[email protected]>
>Gesendet: Freitag, 12. März 2021 02:54
>An: ProFTPD Users <[email protected]>
>Betreff: Re: [Proftpd-user] File extension AllowFiler working for ftp 
>but not sftp
>
>[EXTERNAL EMAIL] This mail was not sent from TecAlliance. Be careful when clicking on stuff.
>
>> Below config is working fine for FTP but breaks for SFTP.
>>
>> (logfile shows WRITE of ‘/abc.zip' blocked by <Limit> configuration)
>>
>> For SFTP filehandle is created, but than client get permission denied 
>> and can’t upload Any idea what’s wrong or can be improved?
>>
>>
>>   <Limit APPE DELE CDUP CWD PWD STOU REST SIZE DELE>
>>     AllowGroup supplier
>>   </Limit>
>>
>>   <Limit RETR RNFR RNTO MKD RMD >
>>     DenyGroup supplier
>>   </Limit>
>
>The SFTP protocol is different from FTP; this difference shows up here.  For an FTP upload, it's a single STOR command.  But for SFTP, it's a sequence of requests:
> * OPEN
> * WRITE
> * WRITE
> * WRITE
> * ...
> * CLOSE
>
>Thus you may need to add "WRITE" to your list of allowed commands for the "supplier" group, for SFTP uploads.

--
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Fighting for peace is like fucking for virginity...


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html