LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)
-   -   Proftpd Getting 550 Permission denied (https://www.linuxquestions.org/questions/linux-server-73/proftpd-getting-550-permission-denied-814508/)

Spetnik 06-16-2010 09:51 AM

Proftpd Getting 550 Permission denied
 
I installed proftpd on a new CentOS 5 server, yet when FTPing in (I can log in fine), the files and directories do not list and I get a "550 filename: Permission denied" error each time I try to "put" or "get" a file (I can tell that the file is there, though, because if I try to access a non-existent file, I get a "No such file or directory error" instead of the permission denied error).

Any ideas?

chienpo 06-16-2010 10:32 AM

Can you share the contents of your /etc/proftpd.conf file (editing out any sensitive information, if any)? Also, who owns the the directory on your server where these files you're trying to access are located? If you could provide the output of running ls -l /path/to/your/data/directory then that would help as well. I'm guessing that if this is a default install then the /path/to/your/data/directory/ is your user account's home directory: /home/username.

Spetnik 06-16-2010 10:37 AM

Code:

# This is the ProFTPD configuration file
#
# See: http://www.proftpd.org/docs/directives/linked/by-name.html

# Server Config - config used for anything outside a <VirtualHost> or <Global> context
# See: http://www.proftpd.org/docs/howto/Vhost.html

ServerName                      "ProFTPD server"
ServerIdent                    on "FTP Server ready."
ServerAdmin                    root@localhost
DefaultServer                  on

# Cause every FTP user except adm to be chrooted into their home directory
# Aliasing /etc/security/pam_env.conf into the chroot allows pam_env to
# work at session-end time (http://bugzilla.redhat.com/477120)
VRootEngine                    on
DefaultRoot                    ~ !adm
VRootAlias                      etc/security/pam_env.conf /etc/security/pam_env.conf

# Use pam to authenticate (default) and be authoritative
AuthPAMConfig                  proftpd
AuthOrder                      mod_auth_pam.c* mod_auth_unix.c
# If you use NIS/YP/LDAP you may need to disable PersistentPasswd
#PersistentPasswd              off

# Don't do reverse DNS lookups (hangs on DNS problems)
UseReverseDNS                  off

# Set the user and group that the server runs as
User                            nobody
Group                          nobody

# To prevent DoS attacks, set the maximum number of child processes
# to 20.  If you need to allow more than 20 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode; in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances                    20

# Disable sendfile by default since it breaks displaying the download speeds in
# ftptop and ftpwho
UseSendfile                    off

# Define the log formats
LogFormat                      default "%h %l %u %t \"%r\" %s %b"
LogFormat                      auth    "%v [%P] %h %t \"%r\" %s"

# Dynamic Shared Object (DSO) loading
# See README.DSO and howto/DSO.html for more details
#
# General database support (http://www.proftpd.org/docs/contrib/mod_sql.html)
#  LoadModule mod_sql.c
#
# Mysql support (requires proftpd-mysql package)
# (http://www.proftpd.org/docs/contrib/mod_sql.html)
#  LoadModule mod_sql_mysql.c
#
# Postgresql support (requires proftpd-postgresql package)
# (http://www.proftpd.org/docs/contrib/mod_sql.html)
#  LoadModule mod_sql_postgres.c
#
# Quota support (http://www.proftpd.org/docs/contrib/mod_quotatab.html)
#  LoadModule mod_quotatab.c
#
# File-specific "driver" for storing quota table information in files
# (http://www.proftpd.org/docs/contrib/mod_quotatab_file.html)
#  LoadModule mod_quotatab_file.c
#
# SQL database "driver" for storing quota table information in SQL tables
# (http://www.proftpd.org/docs/contrib/mod_quotatab_sql.html)
#  LoadModule mod_quotatab_sql.c
#
# LDAP support (requires proftpd-ldap package)
# (http://www.proftpd.org/docs/directives/linked/config_ref_mod_ldap.html)
#  LoadModule mod_ldap.c
#
# LDAP quota support (requires proftpd-ldap package)
# (http://www.proftpd.org/docs/contrib/mod_quotatab_ldap.html)
#  LoadModule mod_quotatab_ldap.c
#
# Support for authenticating users using the RADIUS protocol
# (http://www.proftpd.org/docs/contrib/mod_radius.html)
#  LoadModule mod_radius.c
#
# Retrieve quota limit table information from a RADIUS server
# (http://www.proftpd.org/docs/contrib/mod_quotatab_radius.html)
#  LoadModule mod_quotatab_radius.c
#
# Administrative control actions for the ftpdctl program
# (http://www.proftpd.org/docs/contrib/mod_ctrls_admin.html)
#  LoadModule mod_ctrls_admin.c
#
# Execute external programs or scripts at various points in the process
# of handling FTP commands
# (http://www.castaglia.org/proftpd/modules/mod_exec.html)
#  LoadModule mod_exec.c
#
# Support for POSIX ACLs
# (http://www.proftpd.org/docs/modules/mod_facl.html)
#  LoadModule mod_facl.c
#
# Configure server availability based on system load
# (http://www.proftpd.org/docs/contrib/mod_load.html)
#  LoadModule mod_load.c
#
# Limit downloads to a multiple of upload volume (see README.ratio)
#  LoadModule mod_ratio.c
#
# Rewrite FTP commands sent by clients on-the-fly,
# using regular expression matching and substitution
# (http://www.proftpd.org/docs/contrib/mod_rewrite.html)
#  LoadModule mod_rewrite.c
#
# Support for miscellaneous SITE commands such as SITE MKDIR, SITE SYMLINK,
# and SITE UTIME (http://www.proftpd.org/docs/contrib/mod_site_misc.html)
#  LoadModule mod_site_misc.c
#
# Use the /etc/hosts.allow and /etc/hosts.deny files, or other allow/deny
# files, for IP-based access control
# (http://www.proftpd.org/docs/contrib/mod_wrap.html)
#  LoadModule mod_wrap.c
#
# Use the /etc/hosts.allow and /etc/hosts.deny files, or other allow/deny
# files, as well as SQL-based access rules, for IP-based access control
# (http://www.proftpd.org/docs/contrib/mod_wrap2.html)
#  LoadModule mod_wrap2.c
#
# Support module for mod_wrap2 that handles access rules stored in specially
# formatted files on disk
# (http://www.proftpd.org/docs/contrib/mod_wrap2_file.html)
#  LoadModule mod_wrap2_file.c
#
# Support module for mod_wrap2 that handles access rules stored in SQL
# database tables (http://www.proftpd.org/docs/contrib/mod_wrap2_sql.html)
#  LoadModule mod_wrap2_sql.c
#
# Provide a flexible way of specifying that certain configuration directives
# only apply to certain sessions, based on credentials such as connection
# class, user, or group membership
# (http://www.proftpd.org/docs/contrib/mod_ifsession.html)
#  LoadModule mod_ifsession.c

# TLS (http://www.castaglia.org/proftpd/modules/mod_tls.html)
<IfDefine TLS>
  TLSEngine                    on
  TLSRequired                  on
  TLSRSACertificateFile        /etc/pki/tls/certs/proftpd.pem
  TLSRSACertificateKeyFile      /etc/pki/tls/certs/proftpd.pem
  TLSCipherSuite                ALL:!ADH:!DES
  TLSOptions                    NoCertRequest
  TLSVerifyClient              off
  #TLSRenegotiate              ctrl 3600 data 512000 required off timeout 300
  TLSLog                        /var/log/proftpd/tls.log
</IfDefine>

# Dynamic ban lists (http://www.proftpd.org/docs/contrib/mod_ban.html)
# Enable this with PROFTPD_OPTIONS=-DDYNAMIC_BAN_LISTS in /etc/sysconfig/proftpd
<IfDefine DYNAMIC_BAN_LISTS>
  LoadModule                    mod_ban.c
  BanEngine                    on
  BanLog                        /var/log/proftpd/ban.log
  BanTable                      /var/run/proftpd/ban.tab

  # If the same client reaches the MaxLoginAttempts limit 2 times
  # within 10 minutes, automatically add a ban for that client that
  # will expire after one hour.
  BanOnEvent                    MaxLoginAttempts 2/00:10:00 01:00:00

  # Allow the FTP admin to manually add/remove bans
  BanControlsACLs              all allow user ftpadm
</IfDefine>

# Global Config - config common to Server Config and all virtual hosts
# See: http://www.proftpd.org/docs/howto/Vhost.html
<Global>

  # Umask 022 is a good standard umask to prevent new dirs and files
  # from being group and world writable
  Umask                        022

  # Don't do ident queries (hangs when the port is filtered)
  IdentLookups                  off

  # Allow users to overwrite files and change permissions
  AllowOverwrite                yes
  <Limit ALL SITE_CHMOD>
    AllowAll
  </Limit>

</Global>

# A basic anonymous configuration, with an upload directory
# Enable this with PROFTPD_OPTIONS=-DANONYMOUS_FTP in /etc/sysconfig/proftpd
<IfDefine ANONYMOUS_FTP>
  <Anonymous ~ftp>
    User                        ftp
    Group                      ftp
    AccessGrantMsg              "Anonymous login ok, restrictions apply."

    # We want clients to be able to login with "anonymous" as well as "ftp"
    UserAlias                  anonymous ftp

    # Limit the maximum number of anonymous logins
    MaxClients                  10 "Sorry, max %m users -- try again later"

    # Put the user into /pub right after login
    #DefaultChdir              /pub

    # We want 'welcome.msg' displayed at login, '.message' displayed in
    # each newly chdired directory and tell users to read README* files.
    DisplayLogin                /welcome.msg
    DisplayChdir                .message
    DisplayReadme              README*

    # Cosmetic option to make all files appear to be owned by user "ftp"
    DirFakeUser                on ftp
    DirFakeGroup                on ftp

    # Limit WRITE everywhere in the anonymous chroot
    <Limit WRITE SITE_CHMOD>
      DenyAll
    </Limit>

    # An upload directory that allows storing files but not retrieving
    # or creating directories.
    <Directory uploads/*>
      AllowOverwrite            no
      <Limit READ>
        DenyAll
      </Limit>

      <Limit STOR>
        AllowAll
      </Limit>
    </Directory>

    # Don't write anonymous accesses to the system wtmp file (good idea!)
    WtmpLog                    off

    # Logging for the anonymous transfers
    ExtendedLog                /var/log/proftpd/access.log WRITE,READ default
    ExtendedLog                /var/log/proftpd/auth.log AUTH auth

  </Anonymous>
</IfDefine>

Directory is owned by the user and the user has all permissions.

Code:


[root@prop2 ftpuser]# ls -la
total 32
drwxr-xr-x 3 ftpuser ftpuser 4096 Jun 16 08:25 .
drwxr-xr-x 5 root    root    4096 Jun 16 07:30 ..
-rw-r--r-- 1 ftpuser ftpuser    3 Jun 16 08:25 hi
drwxr-xr-x 2 ftpuser ftpuser 4096 Jun 15 08:47 tmp




chienpo 06-16-2010 11:36 AM

Hmm, everything looks good.

The next thing I'd try is to see what my logs say (configuring it to do copious logging if necessary).

Spetnik 06-16-2010 11:38 AM

Yeah, I have an identical server with the same setup and no problem. How to I configure proftpd logging? Right now the /var/log/proftpd directory is empty.

Spetnik 06-16-2010 11:44 AM

I figured out how to turn on logging. I tried it again, and the log contains this line:

Code:

::ffff:192.168.200.6 UNKNOWN ftpuser [16/Jun/2010:16:42:47 +0000] "RETR hi" 550 -

chienpo 06-16-2010 11:48 AM

By default, it logs to /var/log/wtmp (how much info I don't know).

If you want to create a custom log file, you can use a combination of the LogFormat and ExtendedLog directives:

http://proftpd.org/docs/directives/l...LogFormat.html
http://proftpd.org/docs/directives/l...tendedLog.html

Spetnik 06-16-2010 01:10 PM

Ok, I stopped proftpd and started vsftpd - same problem. So it's not a proftpd issue. The user can log in just fine via SSH and can access files in the same directory with no issue.

Any ideas?

Spetnik 06-16-2010 01:37 PM

I just tried disabling selinux and it worked. I do not want to leave it like that, though. Does this help at all?

Spetnik 06-16-2010 01:57 PM

Ok, I finally found something that helped. I ran this code in the user's root directory:

Code:

chcon -R -t public_content_t .
Now it works!

Spetnik 06-16-2010 03:34 PM

Edit: Deleted


All times are GMT -5. The time now is 09:09 PM.