Re: [Proftpd-user] Use mod_exec (or something to its effect) with sftp

Well!

You’ve denied write for anonymous.
Do you have any command restrictions for “normal” users?
Or are they allowed to do anything?
Try to make a trace while uploading a file with sftp.
I can’t remember exactly, but I think it’s not STOR what is used by SFTP for uploads.
(sorry, can’t check my conf at the moment).

Regards
  Clemens

Von: Jakob Fahr via Proftp-user <[email protected]>
Gesendet: Freitag, 29. April 2022 09:04
An: [email protected]
Cc: Jakob Fahr <[email protected]>
Betreff: Re: [Proftpd-user] Use mod_exec (or something to its effect) with sftp


[EXTERNAL EMAIL] This mail originated from outside of TecAlliance. Think twice before opening links or attachments. If in doubt, forward to [email protected]<mailto:[email protected]>.

I've attached the relevant sections below (I'm not using <VirtualHost>s):



#Default configuration...

ServerName                      "ProFTPD Default Installation"

ServerType                      standalone

DefaultServer                   on



# Port 21 is the standard FTP port.

Port                            21



# Don't use IPv6 support by default.

UseIPv6                         off



# Umask 022 is a good standard umask to prevent new dirs and files

# from being group and world writable.

Umask                           022



# To prevent DoS attacks, set the maximum number of child processes

# to 30.  If you need to allow more than 30 concurrent connections

# at once, simply increase this value.  Note that this ONLY works

# in standalone mode, in inetd mode you should use an inetd server

# that allows you to limit maximum number of processes per service

# (such as xinetd).

MaxInstances                    30



# Set the user and group under which the server will run.

User                            nobody

Group                           nogroup



# To cause every FTP user to be "jailed" (chrooted) into their home

# directory, uncomment this line.

#DefaultRoot ~



# Normally, we want files to be overwriteable.

AllowOverwrite          on



# Bar use of SITE CHMOD by default

<Limit SITE_CHMOD>

  DenyAll

</Limit>

# A basic anonymous configuration, no upload directories.  If you do not

# want anonymous users, simply delete this entire <Anonymous> section.

<Anonymous ~ftp>

  User                          ftp

  Group                         ftp



  # We want clients to be able to login with "anonymous" as well as "ftp"

  UserAlias                     anonymous ftp



  # Limit the maximum number of anonymous logins

  MaxClients                    10



  # We want 'welcome.msg' displayed at login, and '.message' displayed

  # in each newly chdired directory.

  DisplayLogin                  welcome.msg

  DisplayChdir                  .message



  # Limit WRITE everywhere in the anonymous chroot

  <Limit WRITE>

    DenyAll

  </Limit>

</Anonymous>



# End default configuration...



<IfModule mod_exec.c>

  ExecEngine on

  ExecLog /var/log/ftpd/exec.log



  # Run this command when a new file is uploaded:

  ExecOnCommand STOR /usr/bin/curl -H "Content-Type: application/xml" --data "@%f" -X POST https://jfhr.de/i8e/index.php?f=%f&u=%u<https://jfhr.de/i8e/index.php?f=%25f&u=%25u>

</IfModule>



<IfModule mod_dso.c>

  # If mod_tls was built as a shared/DSO module, load it

  LoadModule mod_tls.c

</IfModule>



<IfModule mod_tls.c>

  TLSEngine on

  TLSLog /var/log/ftpd/tls.log

  TLSProtocol TLSv1 TLSv1.1 TLSv1.2



  TLSRequired off



  # Server's RSA certificate

  TLSRSACertificateFile /etc/letsencrypt/live/ftp.mydomain.com/fullchain.pem

  TLSRSACertificateKeyFile /etc/letsencrypt/live/ftp.mydomain.com/privkey.pem

  TLSVerifyClient off

  TLSRenegotiate none

</IfModule>



<IfModule mod_sftp.c>

  SFTPEngine on

  SFTPLog /var/log/ftpd/sftp.log

  SFTPHostKey /etc/letsencrypt/live/ftp.mydomain.com/privkey.pem

</IfModule>




On Fri, Apr 29, 2022, at 2:18 AM, TJ Saunders wrote:

> I’ve setup mod_exec with a curl command to send new files via HTTP to
> another server. It works fine with FTP and FTPS, but not SFTP. In my
> understanding, mod_exec only responds to FTP commands, and SFTP isn’t
> based on FTP. Is there any way to configure mod_exec to work with SFTP
> events, or any alternative solution to the same effect?

Can you provide the configuration you're using, including <VirtualHost> and <Global> sections, so that we can see what might be involved?

Cheers,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]<mailto:[email protected]>>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html