Re: [Proftpd-user] ProxyPassReverseServers option combined with IfClass directive

Hello,

Sorry for coming back to you only now as I have been away for a few days and thank you for enquiring about "my" use case.

The use case is the following one:
 - we have various FTP backend servers for various user typologies and only one FTP reverse proxy open to internet
 - due to confidentiality requirements, some users are allowed to access a specific backend FTP service only from specific IP ranges.

Let's say there are three backend FTP services A, B and C:
 - Service A is accessible by anonymous user from any IP range.
 - Service B is accessible by any user whose name starts with SPECIAL_ and who connects from a specific IP range
 - Service C is accessible by any user who is not anonymous and whose name does not start with SPECIAL_ from any IP range

The authentication is always done by the backend server. The reverse proxy does not have access to the IAM service.
Relying on the connecting IP and the information provided as USER during the ftp login to dispatch the request to the correct backend server would be enough in that use case.

From http://proftpd.org/docs/RELEASE_NOTES-1.3.9rc1 I understood that the purpose of "IfSessionOptions PerUnauthenticatedUser" was to have the "IfUser" directive relying on the string provided as "USER" during login (%U in mod_rewirte variable substitution documentation) instead of relying on the authenticated user (%u in mod_rewrite doc). Did I misunderstand the purpose of that option?

Thank you for your support.

Cheers,
Paul

-----Original Message-----
From: TJ Saunders <[email protected]> 
Sent: Friday, February 21, 2025 10:57 PM
To: HASENOHR Paul (JRC-ISPRA) <[email protected]>; ProFTPD Users <[email protected]>
Subject: Re: [Proftpd-user] ProxyPassReverseServers option combined with IfClass directive


> I just tested this patch on 1.3.8c and it worked perfectly. Thanks a 
> lot, it is really great!

Excellent.  I've merged that PR now for mod_proxy.

> I would have an additional question: While doing some tests, I also 
> tried to use IfUser combined with "IfSessionOptions 
> PerUnauthenticatedUser" on 1.3.9rc3 but it seems that IfSessionOptions 
> does not have any effect. Is it working only with SFTP?

I think it might be tricky, because of what authentication means when going through a reverse proxy.  Normally, the actual authenticating of frontend client's credentials are done by the selected backend server, not by the proxy itself.  This, in turn, means that the proxy doesn't really have a notion of the user, authenticated or not.

mod_proxy does have a UseReverseProxyAuth ProxyOption, but I'm not sure that that is what you want, either -- as it means that any/all user credentials would need to be the same on the proxy host as on all of the backend hosts.

> Ideally, if possible, I would have liked to take advantage of the 
> "IfSessionOptions PerUnauthenticatedUser" functionality to do 
> something like that:

Can you explain more of the desired use case/functionality leading to such a configuration?

Cheers,
TJ


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html