Re: [Proftpd-user] MOD_SFTP failing first upload attempt

> Thanks for answering back. Seems like this user lists cuts of the 
> message if it's too long, I had all the outputs attached.

Ah, good to know.  I hadn't been aware of that restriction.

> But after 3 days of googling around, I was kind of convinced as well 
> that is was an SFTP issue, and I found the fix on the documentation 
> page of mod_sftp: 
> http://proftpd.org/docs/contrib/mod_sftp.html#SFTPOptions
>
> This is what had to be added to make it work:
> ubuntu@FTP-PROD1:~$ cat /opt/proftpd-sftp/etc/proftpd.conf | grep SFTPOption
> *SFTPOptions IgnoreSFTPUploadPerms*
>
> Seems like sftp client on linux is using some kind of Upload 
> permissions and that gives that Permission denied results.

I'm glad you were able to find a solution!

> One last question, would be, are there any security concerns I should 
> be aware of when SFTPUploadPerms are Ignored? Not sure exactly what 
> that option does, meaning what kind of permissions are ignored, not 
> documented under the mod_sftp page.

No, there shouldn't be any security concerns.

When an FTP client uploads a file, the server creates the file with the server-decided ownership (usually that of the authenticated user) and permissions (influenced by things like Umask).  FTP does not allow the client to tell the server what the permissions on the uploaded  file should be.

SFTP is different; it _does_ allow the client to tell the server what the desired permissions for the uploaded file should be.  But, depending on the filesystem/directory permissions on the server side of things, those requested permissions may not be possible.  It sounds like, in your case, the SFTP client was requesting permissions that the server would not allow.  To see what those requested permissions are, I think we'd need to see the TraceLog, for the "sftp" trace channel, at trace level 7 or higher; see here:
* https://github.com/proftpd/proftpd/blob/master/contrib/mod_sftp/fxp.c#L9131

The IgnoreSFTPUploadPerms SFTPOption tells mod_sftp to ignore these client-sent requested permissions, and makes the SFTP upload act more like an FTP upload, i.e. the server decides ownership and permissions of the uploaded file by itself.

Hope this helps,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html