Re: [Proftpd-user] ProxyPassReverseServers option combined with IfClass directive

Hello,

Thank you for your suggestions. Unfortunately, it does not solve the issue as only the last occurrence of ProxyReverseServers within an IfClass section seems to be processed.

With this configuration:
<IfClass welcome_net1>
ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
    ProxyReverseServers ftp://ftpa.ddddd.ooo.it
</IfClass>

<IfClass !welcome_net1>
ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
    ProxyReverseServers ftp://ftps.xxxx.yyy.it
</IfClass>

Anonymous cannot connect as ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json is ignored.
+++++++

With this configuration:
<IfClass welcome_net1>
    ProxyReverseServers ftp://ftpa.ddddd.ooo.it
ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
</IfClass>

<IfClass !welcome_net1>
    ProxyReverseServers ftp://ftps.xxxx.yyy.it
ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
</IfClass>

Anonymous user can connect but no other user as ProxyReverseServers ftp://ftpa.ddddd.ooo.it and ProxyReverseServers ftp://ftps.xxxx.yyy.it are not used and Proftpd cannot find a file /usr/local/proftpd/var/ftp/proxy/backends/PIPPO.json (in case the user connecting would be PIPPO).
In that case, here are the mod_proxy logs:

mod_proxy/0.9.4[862401]: unable to check ProxyReverseServers '/usr/local/proftpd/var/ftp/proxy/backends/PIPPO.json': No such file or directory
2025-02-19 14:03:54,744 mod_proxy/0.9.4[862401]: error reading ProxyReverseServers file '/usr/local/proftpd/var/ftp/proxy/backends/PIPPO.json': No such file or directory
mod_proxy/0.9.4[862401]: no PerUser servers found for user 'PIPPO', and no global ProxyReverseServers configured
mod_proxy/0.9.4[862401]: error preparing database for ProxyReverseConnectPolicy PerUser for user 'PIPPO': No such file or directory
mod_proxy/0.9.4[862401]: error selecting backend server: Operation not permitted
+++++++

In case it matters, proftpd was compiled with if_session as last module as written in http://www.proftpd.org/docs/contrib/mod_ifsession.html:
./configure --prefix=/usr/local/proftpd --enable-openssl --enable-ctrls --disable-auth-pam --with-modules= mod_ban:mod_tls:mod_load:mod_proxy:mod_shaper:mod_ifsession 

Thank you for your help.
Best regards,
Paul

-----Original Message-----
From: TJ Saunders <[email protected]> 
Sent: Tuesday, February 18, 2025 7:56 PM
To: ProFTPD Users <[email protected]>
Cc: HASENOHR Paul (JRC-ISPRA) <[email protected]>
Subject: Re: [Proftpd-user] ProxyPassReverseServers option combined with IfClass directive


> I have set up a reverse proxy several years ago with the following
> configuration:
> 
> ProxyReverseServers 
> file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
> ProxyReverseServers 
> https://urldefense.com/v3/__ftp://ftps.xxxx.yyy.it__;!!DOxrgLBm!A4c3KE
> M7pmgPUmw0Y836iMg7S7svSreLyWD4pK8h8_t2cw7AcNABti6hgyMbqCJRbT-SsFbbcSG2
> vpyD9_c$
> 
> Where /usr/local/proftpd/var/ftp/proxy/backends contains only one file 
> anonymous.json
> 
> This configuration allows me to forward anonymous connections to a 
> specific backend server while all others are redirected to 
> https://urldefense.com/v3/__ftp://ftps.xxxx.yyy.it__;!!DOxrgLBm!A4c3KE
> M7pmgPUmw0Y836iMg7S7svSreLyWD4pK8h8_t2cw7AcNABti6hgyMbqCJRbT-SsFbbcSG2
> vpyD9_c$
> 
> This has been working perfectly for years.

Excellent!  I'm always gratified to hear about successful use cases for the mod_proxy module.

> Now, I would need to segregate the backend servers based on the 
> connecting IP address. Anonymous connections should still be 
> redirected to a specific backend while all others should be redirected 
> to two different backend servers depending on the connecting IP address.
> 
> I tried the following configuration and several variations but without 
> any success:
> 
> <Class netA>
> From 192.168.0.0/16
> </Class netA>
> ProxyReverseServers 
> file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
> <IfClass netA>
>     ProxyReverseServers 
> https://urldefense.com/v3/__ftp://ftpa.ddddd.ooo.it__;!!DOxrgLBm!A4c3K
> EM7pmgPUmw0Y836iMg7S7svSreLyWD4pK8h8_t2cw7AcNABti6hgyMbqCJRbT-SsFbbcSG
> 2V83F6UE$
> </IfClass>
> <IfClass !netA>
>     ProxyReverseServers 
> https://urldefense.com/v3/__ftp://ftps.xxxx.yyy.it__;!!DOxrgLBm!A4c3KE
> M7pmgPUmw0Y836iMg7S7svSreLyWD4pK8h8_t2cw7AcNABti6hgyMbqCJRbT-SsFbbcSG2
> vpyD9_c$
> </IfClass>
>  
> In this example the setting _*ProxyReverseServers 
> file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json*_ is 
> systematically ignored and the connection is forwarded to 
> https://urldefense.com/v3/__ftp://ftpa.ddddd.ooo.it__;!!DOxrgLBm!A4c3K
> EM7pmgPUmw0Y836iMg7S7svSreLyWD4pK8h8_t2cw7AcNABti6hgyMbqCJRbT-SsFbbcSG2V83F6UE$  or https://urldefense.com/v3/__ftp://ftps.xxxx.yyy.it__;!!DOxrgLBm!A4c3KEM7pmgPUmw0Y836iMg7S7svSreLyWD4pK8h8_t2cw7AcNABti6hgyMbqCJRbT-SsFbbcSG2vpyD9_c$  depending on the connecting IP address.

Hmm.  I wonder if this is somehow related to the order that these configuration records appear in the internal in-memory tree -- and thus the order in which they are retrieved and used.  The mod_ifsession code, which merges in these conditional configuration sections, may be creating a different order of those configuration records.

To verify this hypothesis, here is a possible different configurations you might try: you might add the %U.json using directive inside each of the <IfClass> sections:

  <Class netA>
    From 192.168.0.0/16
  </Class netA>

  <IfClass netA>
    ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
    ProxyReverseServers https://urldefense.com/v3/__ftp://ftpa.ddddd.ooo.it__;!!DOxrgLBm!A4c3KEM7pmgPUmw0Y836iMg7S7svSreLyWD4pK8h8_t2cw7AcNABti6hgyMbqCJRbT-SsFbbcSG2V83F6UE$
  </IfClass>
  <IfClass !netA>
    ProxyReverseServers file:/usr/local/proftpd/var/ftp/proxy/backends/%U.json
    ProxyReverseServers https://urldefense.com/v3/__ftp://ftps.xxxx.yyy.it__;!!DOxrgLBm!A4c3KEM7pmgPUmw0Y836iMg7S7svSreLyWD4pK8h8_t2cw7AcNABti6hgyMbqCJRbT-SsFbbcSG2vpyD9_c$
  </IfClass>

The idea here being to see if this approach restores the ordering that your original config used.  Yes, it is not as aesthetically pleasing due to the apparent duplication of records.

Hope this helps,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html