Re: [Proftpd-user] Problem binding to second IP with mod_sftp on 1.3.7a on Ubuntu 21.04

>>>>> "John" == John Stoffel <[email protected]> writes:


John> I'm trying to setup an ftp/sftp server for our DMZ to replace a realy
John> ancient one here at work.

John> I decided to try and use Ubuntu 21.04 as the base image, but I'm
John> starting to suspect I should drop back to 20.04 LTS instead...
John> anyway, when I configure two IPs onto the same interface, I can't seem
John> to make the mod_sftp module bind to only one of them.

John> Yes, I have openssh only listening on IP addr x.y.z.201, which proftpd
John> should only be trying to bind to x.y.z.202, but I keep getting errors
John> like this:

John>    # proftpd -c /etc/proftpd/proftpd.conf -n
John>    2021-07-07 07:07:07,338 ftp-mgmt proftpd[83048]: mod_sql_sqlite/0.4: compiled using SQLite version '3.34.0' headers, but linked to SQLite version '3.34.1' library
John>    2021-07-07 07:07:07,347 ftp-mgmt proftpd[83048] ftp-mgmt: Failed binding to 0.0.0.0, port 22: Address already in use
John>    2021-07-07 07:07:07,347 ftp-mgmt proftpd[83048] ftp-mgmt: Check the ServerType directive to ensure you are configured correctly
John>    2021-07-07 07:07:07,347 ftp-mgmt proftpd[83048] ftp-mgmt: Check to see if inetd/xinetd, or another proftpd instance, is already using 0.0.0.0, port 22
John>    2021-07-07 07:07:07,347 ftp-mgmt proftpd[83048] ftp-mgmt: Unable to start proftpd; check logs for more details


So this error is comming from src/init.c, the function init_conn(), so
now I'm trying to look in there to see what's going on.  Right now I'm
just trying to setup an sftp only server, and I'm stripping down the
config file to the minimum.  More info as I get it.

So re-compiling with the --with-debug option, and doing a break point
at init_conn, I see:

Breakpoint 1, init_conn (p=0x55555571a100, fd=-1, bind_addr=0x0, port=22, retry_bind=0,
    reporting=1) at inet.c:184
184         int port, int retry_bind, int reporting) {
    

Which sorta makes sense in that it is trying to bind to the address
'0' which translates to 0.0.0.0, so now to dig further up the stack...

A backtrace looks like this:

(gdb) bt
#0  init_conn (p=0x55555571a100, fd=-1, bind_addr=0x0, port=22,
retry_bind=0, reporting=1)
    at inet.c:184
#1  0x000055555558e629 in pr_inet_create_conn
    (p=p@entry=0x55555571a100, fd=fd@entry=-1,
        bind_addr=bind_addr@entry=0x0, port=port@entry=22,
	retry_bind=retry_bind@entry=0) at inet.c:535
#2  0x0000555555594ad5 in pr_ipbind_get_listening_conn
	(server=server@entry=0x5555556d26d8,
	    addr=0x0, port=22) at bindings.c:137
#3  0x0000555555596c62 in init_standalone_bindings () at
	    bindings.c:1358
#4  init_bindings () at bindings.c:1442
#5  0x0000555555575c04 in standalone_main () at
	    main.c:1894
#6  main (argc=4, argv=<optimized out>, envp=<optimized
	    out>) at main.c:2618
	    
Time to simplify the damn config down to the absolute minimum.  And
dammit... it now it starts, but isn't listening on port 22 for address
x.y.z.202.  Sigh...

And compiling 1.3.6e and trying to make it work is a pain in the ass
as well, since it complains about "Wrong passphrase for this key.
Please try again."

Anyone else got some ideass?



John> My IP setup looks like this:

John> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
John>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
John>     inet 127.0.0.1/8 scope host lo
John>       valid_lft forever preferred_lft forever
John> 2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
John>      link/ether 00:50:56:88:37:80 brd ff:ff:ff:ff:ff:ff
John>      altname enp11s0
John>      inet x.y.z.201/24 brd x.y.z.255 scope global ens192
John>         valid_lft forever preferred_lft forever
John>      inet x.y.z.202/24 brd x.y.z.255 scope global secondary ens192
John>         valid_lft forever preferred_lft forever


John> Note how recent Ubuntu doesn't want you to do 'ens192:1' as the name for the second IP address, since netplan doesn't really support or offer that from what I can see.

John> So I'm thinking that my problem is the mod_sftp.c wants distinct names for each IP address, otherwise it gets confused.

John> My configuration is stupid simple, it's just:

John>   <IfModule mod_sftp.c>
John>     <VirtualHost X.Y.Z.202>
John>       Port             22

John>       SFTPEngine ON

John>       SFTPHostKey      /var/tmp/ssh/ssh_host_rsa_key
John>       SFTPLog          /var/log/proftpd/sftp.log
John>       SFTPCompression delayed

John>       SFTPOptions IgnoreSCPUploadPerms IgnoreSCPUploadTimes IgnoreSFTPSetOwners IgnoreSFTPSetPerms IgnoreSFTPSetTimes IgnoreSFTPUploadPerms

John>       # Where all the customer definitions are
John> 	  Include /ftp/etc/ftpd.users
John>     </VirtualHost>
John>   </IfModule>

John> You can see if the error I posted above, it's trying to bind to
John> 0.0.0.0 for some reason.  All kinds of tweaks and hacks hasn't fixed
John> this.  I've also tried downgrading to v1.3.6e as well, but it still
John> doesn't work, giving the same error.

John> Any hints on how I can debug this and get it working?

John> John


John> _______________________________________________
John> ProFTPD Users List   <[email protected]>
John> Unsubscribe problems?
John> http://www.proftpd.org/list-unsub.html


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html