[Proftpd-user] Response error from backend control channel with mod_proxy and mod_sftp

Hello everyone,

My first post here after 10 years of proftpd happiness :) I'm trying to 
setup proftpd with mod_proxy for FTPS and SFTP. I succeeded with FTPS 
but I have problem with my SFTP backend with this error :

[...]
2023-07-19 12:33:24,528 mod_proxy/0.9.2[8]: selected backend server 
'sftp://yyy.yyy.yyy.yyy:8022'
2023-07-19 12:33:24,531 mod_proxy/0.9.2[8]: proxy session running as UID 
10000, GID 10000, restricted to '/ftp-proxytables/empty'
2023-07-19 12:33:24,531 mod_proxy/0.9.2[8]: error receiving response 
from backend control connection: Invalid argument
[...]

I have this error trying to configure mod_proxy in front of a MFT sftp 
server. It is not very understandable for me, I have no clue of what 
happen here, could someone give me some explanation ? Maybe a solution ?

For the context of my setup, I'm using proftpd compiled in a 
debian:bookworm-slim docker container with "network_mode: host". This 
reverse proxy container has a public ip and must serve at least 2 
proftpd FTPS/SFTP server and one Goanywhere MFT server on a backend ip, 
like this: client -> public ip -> mod_proxy -> backend ip -> FTPS/SFTP 
servers.

* configure line :

./configure --prefix=/opt/proftpd --enable-ctrls --enable-nls 
--with-modules=mod_proxy:mod_ctrls_admin:mod_sftp:mod_tls:mod_exec:mod_rewrite:mod_site_misc:mod_unique_id:mod_ifsession


* proftpd.conf (with anonymization, I delete from this conf file the 
FTPS proxy setup)

ServerName                  "Proxy FTP"
ServerType                  standalone
DefaultServer               off
DefaultAddress              xxx.xxx.xxx.xxx # proxy server frontend ip
SocketBindTight             on
Port                        0
UseIPv6                     off
Umask                       022
MaxInstances                200
User                        virtuelftp
Group                       virtuelftp
UseReverseDNS               off
MasqueradeAddress           my.external.dns.names

# classes for SFTP
<Class mft>
   From !1.2.3.4
</Class>

<IfModule mod_proxy.c>
   ProxyTables /ftp-proxytables
</IfModule>

# SFTP
<IfModule mod_sftp.c>
   ProxySFTPPassPhraseProvider /opt/proftpd/get-ssh-passphrase
   SFTPPassPhraseProvider /opt/proftpd/get-ssh-passphrase

   <VirtualHost my.external.dns.names>
     ServerAdmin            [email protected]
     ServerName             "axsftpproxy"
     Port                   22
     MaxLoginAttempts       3
     MaxClientsPerUser      50
     # fichier log format xferlog
     TransferLog            /logs/transferts-sftp.log
     # module sftp
     SFTPEngine             on
     SFTPLog                /logs/sftp.log
     SFTPHostKey            /opt/proftpd/conf/keys/test-key-rsa
     SFTPCompression        delayed
     #SFTPAuthMethods        publickey
     SFTPDHParamFile        /opt/proftpd/conf/keys/dhparams.pem
     SFTPKeyBlacklist       /opt/proftpd/conf/keys/blacklist.dat

     # module proxy
     <IfModule mod_proxy.c>
       ProxyEngine               on
       ProxyLog                  /logs/proxy-sftp.log
       ProxyRole                 reverse
       ProxyOptions              ShowFeatures
       ProxyReverseConnectPolicy PerHost
       ProxySFTPHostKey          /opt/proftpd/conf/keys/test-key-rsa
       ProxySFTPCompression      delayed
       ProxySFTPVerifyServer     off
       <IfClass mft>
         # backend sftp server
         ProxyReverseServers sftp://yyy.yyy.yyy.yyy:8022
       </IfClass>
       # proxy server backend ip
       ProxySourceAddress zzz.zzz.zzz.zzz
     </IfModule>

   </VirtualHost>
</IfModule>

Thank you for reading, regards

-- 
Serge


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html