Re: [Proftpd-user] Wrong ordering of mod_auth_file and mod_sql breaks AuthFile user authentication

Hi TJ,

TJ Saunders schreef op 2023-07-09 17:30:
>>      2023-07-09 11:31:40,139 mod_sql/4.5[857014]: error opening SQLite
>> database '/var/lib/proftpd.db': unable to open database file (No such
>> file or directory)
>>      2023-07-09 11:31:40,139 mod_sql/4.5[857014]: exiting    sqlite
>> cmd_open
>>      2023-07-09 11:31:40,139 mod_sql/4.5[857014]: exiting    sqlite
>> cmd_select
>>      2023-07-09 11:31:40,139 mod_sql/4.5[857014]: unrecoverable 
>> backend
>> error
>>      2023-07-09 11:31:40,139 mod_sql/4.5[857014]: error:
>> 'mod_sql_sqlite/0.4'
>>      2023-07-09 11:31:40,139 mod_sql/4.5[857014]: message: 'unable to
>> open database file (No such file or directory)'
>> 
>> This happens because chroot() is called before the file is opened, as
>> the config contains `DefaultRoot ~`. Therefore, the issue does not 
>> occur
>> when that setting is absent.
>> 
>> A couple of things interest me:
>> 
>> - Why is the user looked up using mod_sql used when authenticating 
>> with
>> a valid AuthUser? I would expect ProFTPD to exit on the first match,
>> according to the AuthOrder. And with the 'broken' AuthOrder, AuthFile
>> comes first.
>> - Why is chroot() called during authentication?
> 
> Can you provide the full ProFTPD configuration you are using, so that 
> we can see everything that might be relevant to this question?

This is the full config. Version 1.3.7a is used on Debian 11.

```
$ cat *.conf conf.d/*.conf | grep -v ^$ | grep -v ^#
<IfModule mod_geoip.c>
GeoIPEngine on
GeoIPLog /var/log/proftpd/geoip.log
GeoIPTable /usr/share/GeoIP/GeoIP.dat MemoryCache UTF8
</IfModule>
<IfModule mod_ldap.c>
</IfModule>
ModulePath /usr/lib/proftpd
ModuleControlsACLs insmod,rmmod allow user root
ModuleControlsACLs lsmod allow user *
LoadModule mod_ctrls_admin.c
LoadModule mod_sql.c
LoadModule mod_sql_sqlite.c
LoadModule mod_sql_passwd.c
LoadModule mod_radius.c
LoadModule mod_quotatab.c
LoadModule mod_quotatab_file.c
LoadModule mod_quotatab_radius.c
LoadModule mod_rewrite.c
LoadModule mod_load.c
LoadModule mod_ban.c
LoadModule mod_wrap2.c
LoadModule mod_wrap2_file.c
LoadModule mod_dynmasq.c
LoadModule mod_exec.c
LoadModule mod_shaper.c
LoadModule mod_ratio.c
LoadModule mod_site_misc.c
LoadModule mod_facl.c
LoadModule mod_unique_id.c
LoadModule mod_copy.c
LoadModule mod_deflate.c
LoadModule mod_ifversion.c
LoadModule mod_memcache.c
LoadModule mod_readme.c
LoadModule mod_ifsession.c
Include /etc/proftpd/modules.conf
UseIPv6 on
<IfModule mod_ident.c>
   IdentLookups off
</IfModule>
ServerName "Debian"
ServerType standalone
DeferWelcome off
DefaultServer on
ShowSymlinks on
TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200
DisplayLogin welcome.msg
DisplayChdir .message true
ListOptions "-l"
DenyFilter \*.*/
Port 21
PassivePorts 49152 65534
<IfModule mod_dynmasq.c>
</IfModule>
MaxInstances 30
User proftpd
Group nogroup
Umask 022 022
AllowOverwrite on
TransferLog /var/log/proftpd/xferlog
SystemLog /var/log/proftpd/proftpd.log
<IfModule mod_quotatab.c>
QuotaEngine off
</IfModule>
<IfModule mod_ratio.c>
Ratios off
</IfModule>
<IfModule mod_delay.c>
DelayEngine on
</IfModule>
<IfModule mod_ctrls.c>
ControlsEngine off
ControlsMaxClients 2
ControlsLog /var/log/proftpd/controls.log
ControlsInterval 5
ControlsSocket /var/run/proftpd/proftpd.sock
</IfModule>
<IfModule mod_ctrls_admin.c>
AdminControlsEngine off
</IfModule>
Include /etc/proftpd/sql.conf
Include /etc/proftpd/conf.d/
<IfModule mod_sftp.c>
</IfModule>
<IfModule mod_snmp.c>
SNMPEngine on
SNMPAgent master 127.0.0.1 161
SNMPCommunity proftp
SNMPLog /var/log/proftpd/snmp.log
SNMPTables /var/lib/proftpd/snmp
</IfModule>
<IfModule mod_sql.c>
     SQLPasswordEngine on
     SQLPasswordEncoding hex
     SQLAuthenticate users
     SQLBackend sqlite3
     SQLConnectInfo /var/lib/proftpd.db
     SQLAuthTypes Bcrypt
     SQLEngine auth
     SQLUserInfo users userid passwd uid gid homedir shell
     SQLUserPrimaryKey id
     SQLLogFile /var/log/proftpd/sql.log
</IfModule>
<IfModule mod_tls.c>
</IfModule>
<IfModule mod_vroot.c>
</IfModule>
AuthUserFile /etc/proftpd/passwd
AuthOrder mod_sql.c mod_auth_file.c
RequireValidShell no
DefaultRoot ~
```

> 
> Cheers,
> TJ

Met vriendelijke groeten,

William Edwards



_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html