[Proftpd-user] Timeout Sessions and mod_sftp

I have a configuration that looks like the below. It appears that none of
the Timeout* options are working with the mod_sftp virtualhost. Is this
expected behavior?

Include /etc/proftpd/modules.conf
UseIPv6 off
IdentLookups off
ServerName "<%= node['labels']['environment'] %> ProFTPD Server"
ServerIdent on "FTP Server ready."
ServerAdmin admin@localhost
ServerType standalone
DeferWelcome off
MultilineRFC2228 on
DefaultServer on
ShowSymlinks on
TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200
DisplayLogin /etc/proftpd/welcome.msg
DisplayChdir .message true
ListOptions "-l"
DenyFilter \*.*/
DefaultRoot ~ !adm !nochroot
DefaultAddress 0.0.0.0
Port 21
MaxInstances 150
MaxLoginAttempts 1
User nobody
Group nogroup
Umask 002 002
AllowOverwrite on
#FSOptions IgnoreExtendedAttributes

<Limit ALL SITE_CHMOD>
AllowAll
</Limit>
UseSendFile off
LogFormat default "%h %l %u %t \"%r\" %s %b"
LogFormat auth "%v [%P] %h %t \"%r\" %s"



LoadModule mod_ban.c
LoadModule mod_ifsession.c

<Class allowlist>
From egress.domain.com
From 127.0.0.1
From localhost
</Class>

<IfClass allowlist>
# Turn the mod_ban module off for allowlist clients
BanEngine off
</IfClass>
<IfClass !allowlist>
# Turn the mod_ban module on for !allowlist clients
BanEngine on
</IfClass>

BanLog /var/log/proftpd/ban.log
BanTable /var/run/proftpd/ban.tab

# If the same client reaches the MaxLoginAttempts limit 2 times
# within 10 minutes, automatically add a ban for that client that
# will expire after one hour.
BanOnEvent MaxLoginAttempts 6/00:10:00 01:00:00

# Allow the FTP admin to manually add/remove bans
BanControlsACLs all allow user root

<IfModule mod_sftp.c>
<Global>
# The default values used by mod_sftp are :
# channelPacketSize 32 KB
# channelWindowSize 4 GB
# sftpProtocolVersion 1 - 6
# Axway(SSH - 2.0 - XFB.Gateway Unix)
SFTPClientMatch ".*Axway.*" channelWindowSize 1GB
SFTPClientMatch ".*XFB.*" channelWindowSize 1GB
# CoreFTP LE(free version 2.2)
SFTPClientMatch CoreFTP channelWindowSize 1GB
# CuteFTPPro8
SFTPClientMatch ".*ClientSftp" sftpProtocolVersion 3
# Network Automation(SSH - 2.0 - EldoS.SSHBlackbox.3)
# http : // www.networkautomation.com/
SFTPClientMatch ".*EldoS.SSHBlackbox.3.*" channelWindowSize 1GB
sftpProtocolVersion 3
# GlobalScape FTP application(SSH2 client 'GSSFTP1.0') - (needs v2)
# http : // www.globalscape.com/downloads/
# GoAnywhere(SSH - 2.0 - 1.0)
# http : // www.goanywheremft.com/products
SFTPClientMatch ".*GoAnywhere.*" channelWindowSize 1GB sftpProtocolVersion 2
# JaSFtp(SSH - 2.0 - J2SSH_Maverick_1.2.10 _Sterling Commerce)
# http : // www.hiteksoftware.com/jasf/
SFTPClientMatch ".*J2SSH_Maverick.*" channelWindowSize 1GB
# JSch - Java Secure Channel(SSH - 2.0 - JSCH - 0.1 .39)
# http : // www.jcraft.com/jsch/
SFTPClientMatch "JSCH.*" channelWindowSize 1GB
# Robo - FTP(SSH - 2.0 - WeOnlyDo)
# http : // www.robo-ftp.com/
SFTPClientMatch ".*WeOnlyDo.*" channelWindowSize 1GB sftpProtocolVersion 3
# SecureBlackbox(SSH - 2.0 - SecureBlackbox.7)
# http : // www.eldos.com/sbb/download-release.php
SFTPClientMatch ".*SecureBlackbox.*" sftpProtocolVersion 3
# SecureFX - SSH2 client 'SecureFX_2_2_5_225 SecureFX'
# http : // www.vandyke.com/products/securefx/
SFTPClientMatch "SecureFX.*" sftpProtocolVersion 3
# SSH - 2.0 - 1.30
SFTPClientMatch "1.30" channelPacketSize 16KB channelWindowSize 256MB
# SSH - 2.0 - Sun_SSH_1.0.1
SFTPClientMatch ".*Sun_SSH.*" channelWindowSize 1GB
# SSH - 2.0 - SharpSSH - 1.1 .1 .13 - JSCH - 0.1 .28
SFTPClientMatch ".*SharpSSH.*" channelWindowSize 256MB
# WinSCP
SFTPClientMatch ".*WinSCP.*" sftpProtocolVersion 4
# WS_FTP
SFTPClientMatch ".*WS_FTP.*" channelWindowSize 1GB
# / n Software BizTalk SFTP Receive(SSH - 2.0 - IP * Works !SSH Client v8.0)
# http : // www.nsoftware.com/products/biztalk/adapters/sftp.aspx
SFTPClientMatch ".*IP.Works.*" channelWindowSize 1GB
# Ruby
SFTPClientMatch ".*Ruby/Net::SSH.*" sftpProtocolVersion 3
</Global>

<VirtualHost 0.0.0.0>
Port <%= node['pproftpd']['config']['port'] %>
SFTPEngine on
SFTPRekey none
SFTPLog /var/log/proftpd/sftp.log
SFTPHostKey /etc/proftpd/ssh_host_rsa_key
SFTPHostKey /etc/proftpd/ssh_host_dsa_key
SFTPAuthorizedUserKeys file:~/.ssh/authorized_keys.sftp
SFTPAuthMethods publickey password keyboard-interactive
# Keyboard interactive requires SFTPPAMEngine and ServiceName. The default
service name is sshd.
# Since we dont need all the sshd 2fa and it was fine to fall back to the
proftpd's default.
SFTPPAMEngine on
SFTPPAMServiceName proftpd
# Disable the KEXINIT optimization at the cost of latency
SFTPOptions PessimisticKexinit
SFTPOptions OldProtocolCompat
SFTPOptions IgnoreSFTPUploadPerms
SFTPOptions IgnoreSCPUploadPerms
DefaultRoot ~ !adm !nochroot
RequireValidShell no
<Directory ~>
<Limit DIRS>
IgnoreHidden on
</Limit>
HideNoAccess on
</Directory>
# Logging changes
ExtendedLog /var/log/proftpd/access.log WRITE,READ default
ExtendedLog /var/log/proftpd/auth.log AUTH auth

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask 002 002
# Normally, we want files to be overwriteable.
AllowOverwrite on
<Limit ALL SITE_CHMOD>
AllowAll
</Limit>
</VirtualHost>
</IfModule>

<IfModule mod_delay.c>
DelayEngine on
</IfModule>

<IfModule mod_ctrls.c>
ControlsEngine on
ControlsACLs all allow group root
ControlsMaxClients 2
ControlsLog /var/log/proftpd/controls.log
ControlsInterval 5
ControlsSocket /var/run/proftpd/proftpd.sock
</IfModule>

<IfModule mod_ctrls_admin.c>
AdminControlsEngine on
AdminControlsACLs all allow user root
</IfModule>

ExtendedLog /var/log/proftpd/access.log WRITE,READ default
ExtendedLog /var/log/proftpd/auth.log AUTH auth

Include /etc/proftpd/conf.d/



-- 
- Daniel Pryor

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html