Re: [Proftpd-user] [SPAM] Re: Proftpd with SQL and problem with groups

On Sat, Mar 11, 2023, at 11:58, [email protected] wrote:
> W dniu 2023-03-11 18:15, TJ Saunders napisał(a):
>> On Sat, Mar 11, 2023, at 07:14, [email protected] wrote:
>>>> 
>>>> Hi,
>>>> Groups table:
>>>> +-----------+------+---------------+
>>>> | groupname | gid  | members       |
>>>> +-----------+------+---------------+
>>>> | pierwsza  | 2021 | pawel,piotrek |
>>>> | default   | 2001 |               |
>>>> | druga     | 2022 | tomek,karol   |
>>>> | trzecia   | 2023 | piotrek,tomek |
>>>> | czwarta   | 2024 | piotrek,karol |
>>>> +-----------+------+---------------+
>>>> 
>>>> User UIDs are also are above 2000.
>>>> In Proftpd configuration I don't have any parameter about min, max
>>>> UIDs and Gids. So should I set anything yet in this case ?
>>> 
>>> In debug mode (proftpd -nd10), I don't see anything constructive. User
>>> is logging, then he is changing folder to other account succesfully 
>>> (but
>>> he shouldn't in fact) and thats it.
>> 
>> Could you provide the debug logging for one of these sessions, when it
>> logs in, so that we can see as well?  There may be relevant details
>> lurking in that logging.

> Dump from session I'm attaching. I've logged as user pawel and went to 
> karol's account (folder) but I should'ne have permission for that - they 
> aren't in any common group.

Thanks.  In the provided logs, we see:

  proftpd[23660] test3-ubuntu18: retrieved UID 2025 for user 'pawel'
  proftpd[23660] test3-ubuntu18: retrieved group 'default' for GID 2001
  proftpd[23660] test3-ubuntu18: retrieved group IDs: 2001, 2021

This means that the primary GID for the session is 2001.   And as we see on the folder permissions:

  root@test3-ubuntu18:/srv/ftp# ls -l
  total 3
  drwxrwxr-x 2 2026 2001 3 Mar 10 00:03 bartek
  drwxrwxr-x 2 2024 2001 3 Mar 10 00:43 karol
  drwxrwxr-x 2 2025 2001 3 Mar  9 00:45 pawel
  drwxrwxr-x 2 2022 2001 4 Mar  9 00:29 piotrek
  drwxrwxr-x 2 2023 2001 3 Mar  8 23:46 tomek

All of these folders (including /srv/ftp/karol) allow read/write/execute permissions to GID 2001.

How does user "pawel" come to have a primary GID of 2001?  In your mod_sql configuration, you are using:

  SQLUserInfo             users userid passwd uid gid homedir shell
  SQLGroupInfo            groups groupname gid members

In this case, we need to look at the users.gid value for user "pawel":

  |  5 | pawel   | 2025 | 2001 | ... | /srv/ftp/pawel   |   

The rows for these users, in the "users" table, all have a GID value of 2001.  This is why, I suspect, your users have unexpected access to these directories.

Hope this helps,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html