Re: [Proftpd-user] [SPAM] Re: Proftpd with SQL and problem with groups

W dniu 2023-03-11 23:34, [email protected] napisał(a):
> W dniu 2023-03-11 22:42, TJ Saunders napisał(a):
>> On Sat, Mar 11, 2023, at 13:37, [email protected] wrote:
>>>> 
>>>> Thanks.  In the provided logs, we see:
>>>> 
>>>>   proftpd[23660] test3-ubuntu18: retrieved UID 2025 for user 'pawel'
>>>>   proftpd[23660] test3-ubuntu18: retrieved group 'default' for GID 
>>>> 2001
>>>>   proftpd[23660] test3-ubuntu18: retrieved group IDs: 2001, 2021
>>>> 
>>>> This means that the primary GID for the session is 2001.   And as we
>>>> see on the folder permissions:
>>>> 
>>>>   root@test3-ubuntu18:/srv/ftp# ls -l
>>>>   total 3
>>>>   drwxrwxr-x 2 2026 2001 3 Mar 10 00:03 bartek
>>>>   drwxrwxr-x 2 2024 2001 3 Mar 10 00:43 karol
>>>>   drwxrwxr-x 2 2025 2001 3 Mar  9 00:45 pawel
>>>>   drwxrwxr-x 2 2022 2001 4 Mar  9 00:29 piotrek
>>>>   drwxrwxr-x 2 2023 2001 3 Mar  8 23:46 tomek
>>>> 
>>>> All of these folders (including /srv/ftp/karol) allow
>>>> read/write/execute permissions to GID 2001.
>>>> 
>>>> How does user "pawel" come to have a primary GID of 2001?  In your
>>>> mod_sql configuration, you are using:
>>>> 
>>>>   SQLUserInfo             users userid passwd uid gid homedir shell
>>>>   SQLGroupInfo            groups groupname gid members
>>>> 
>>>> In this case, we need to look at the users.gid value for user 
>>>> "pawel":
>>>> 
>>>>   |  5 | pawel   | 2025 | 2001 | ... | /srv/ftp/pawel   |
>>>> 
>>>> The rows for these users, in the "users" table, all have a GID value
>>>> of 2001.  This is why, I suspect, your users have unexpected access 
>>>> to
>>>> these directories.
>>>> 
>>>> Hope this helps,
>>>> TJ
>>> 
>>> I've changed permission to folders for 770.
>>> I've also changed pawel's and karol's group to theirs individual.
>>> And ? ok - I can't enter as pawel to karol's folder BUT I also can't
>>> enter to piotrek's folder - but I should. Pawel and Piotrek are in 
>>> the
>>> same group 2021.
>>> 
>>> Summary: it looks like permissions are working only from Linux 
>>> folders
>>> permissions perspective. Additional groups set in MYsql don't work.
>>> 
>>> Or tell me please what folders permission should be ?
>> 
>> What happens if you change the group ownership of the directories for
>> users "pawel" and "piotrek"?  That is:
>> 
>>   $ chgrp 2021 /srv/ftp/pawel /srv/ftp/piotrek
>> 
>> And then login as user "pawel", and see if the /srv/ftp/piotrek
>> directory is accessible?
>> 
>> Cheers,
>> TJ
> 
> Yes, thats working.
> 
> Perm. of folders are as following right now:
> root@test3-ubuntu18:/srv/ftp# ls -l
> total 3
> drwxrwx--- 2 2026 2001 3 Mar 10 00:03 bartek
> drwxrwx--- 2 2024 2030 3 Mar 10 00:43 karol
> drwxrwx--- 2 2025 2021 3 Mar  9 00:45 pawel
> drwxrwx--- 2 2022 2021 4 Mar  9 00:29 piotrek
> drwxrwx--- 2 2023 2001 3 Mar  8 23:46 tomek
> root@test3-ubuntu18:/srv/ftp#
> 
> 

What I wanted to say in previous mail is: ok, that case is working but 
its not the end of whole case.
If you suggesting to set group in folders to first additional groups of 
users what will be with others additional groups ? I will tell you - it 
won't work (I checked that). So going to this direction in not good 
idea.

Summary of groups members:
bartek
pawel		pierwsza
piotrek	        pierwsza, trzecia, czwarta
tomek		druga, trzecia
karol		druga, czwarta

So when I set tomek's directory group for druga :
drwxrwx--- 2 2023 2022 3 Mar  8 23:46 tomek

and tried to go to folder piotrek - it didn't work but it should because 
tomek and piotrek are in additional "trzecia" group.


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html