Dustin Ward | 2 Jan 2008 16:18
Favicon

[Proftpd-user] PORT Mode problem running off of multiple ports

I am running proftpd on two ports, 2121, 2122.  Port 2121 houses my 
anonymous ftp, and port 2122 houses regular ftp.

Port mode seems to be broken when running off of the same ip address 
with different ports. Port mode will hang when connecting to the 2122, 
but will work perfectly when connecting to port 2121.

If I change the port 2122 to port 2120, port mode will then function on 
that port, but not 2121. It appears that it will only work on the lowest 
numbered port.

If this doesn't make any sense, I have posted my configuration below.

Thanks for any help!

ServerName              "Test Proftpd Server"
ServerType              standalone
SocketBindTight         on
ServerAdmin             root <at> test.com

SyslogFacility          DAEMON
SyslogLevel             info

MaxInstances            200

Port                    0
TimeoutLogin            30
TimeoutIdle             600
TimeoutNoTransfer       600
TimeoutStalled          600
(Continue reading)

Thomas L. Shinnick | 2 Jan 2008 17:22
Picon

Re: [Proftpd-user] PORT Mode problem running off of multiple ports

At 09:18 AM 1/2/2008, Dustin Ward wrote:
I am running proftpd on two ports, 2121, 2122.  Port 2121 houses my
anonymous ftp, and port 2122 houses regular ftp.

Port mode seems to be broken when running off of the same ip address
with different ports. Port mode will hang when connecting to the 2122,
but will work perfectly when connecting to port 2121.

If I change the port 2122 to port 2120, port mode will then function on
that port, but not 2121. It appears that it will only work on the lowest
numbered port.

If this doesn't make any sense, I have posted my configuration below.

Thanks for any help!

Running out the door so didn't really look at the configuration (or read the text above enough) but I think that FTP servers will always want the specified port and the one below that (N-1).  So for normal FTP it'd want 21 and 20.   How about trying to use ports 2121 and 2123, thus leaving 2120 and 2122 for the magic stuff?

ServerName              "Test Proftpd Server"
ServerType              standalone
SocketBindTight         on
ServerAdmin             root <at> test.com

SyslogFacility          DAEMON
SyslogLevel             info

MaxInstances            200

Port                    0
TimeoutLogin            30
TimeoutIdle             600
TimeoutNoTransfer       600
TimeoutStalled          600

LogFormat               default "%h %l %L %t \"%r %U [%v]\" %A %b %D %f
%F %m"

UseReverseDNS           off

ScoreboardFile /var/proftpd/proftpd.scoreboard
PidFile /var/proftpd/proftpd.pid

User                    ftp
Group                   wheel

<Global>
 ExtendedLog            /var/log/proftpd/xferlog read,write default
 TimesGMT                off
 AccessDenyMsg          "Access denied for %u."
 AccessGrantMsg         "Access granted for %u."
 AllowOverwrite         on
 RootLogin              off
 DeleteAbortedStores    on
 AuthPAM                off
 DefaultRoot            ~
 DeferWelcome           on
 DisplayLogin           ftp_welcomes/.welcome
 MaxLoginAttempts       2
 MaxClientsPerHost      10 "You cannot connect more than 5 times from
the same host."
 MaxClients             30 "Sorry, the maximum number of allowed users
are already connected."
 MaxHostsPerUser        15 "You cannot connect more than 10 times using
the same account."
 PassivePorts           40000 40050
 DenyFilter             \*.*/
 ServerIdent            on "FTP Server"
 Umask                  002
 WtmpLog                off

 IdentLookups           off

 ListOptions            -n

 PathAllowFilter        "^[A-Za-z0-9 ._/%-]+$"
 PathDenyFilter         "^( |-)"
 PathDenyFilter         "(\\.ftpaccess)|(\\.htaccess)$"
 PathDenyFilter         "(\\.\\.)$"

 <Directory /*>
   <LIMIT SITE_CHMOD>
     DenyAll
   </LIMIT>
 </Directory>

</Global>

<VirtualHost 10.81.1.7>

 Port                   2121
 AuthPam                on
 Include                /etc/proftpd/anonymous.config
 HiddenStor on

</VirtualHost>


<VirtualHost 10.81.1.7>

 Port                   2122
 AuthPam                on

</VirtualHost>


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
ProFTPD Users List   <proftpd-users <at> proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
ProFTPD Users List   <proftpd-users <at> proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
TJ Saunders | 2 Jan 2008 21:17

Re: [Proftpd-user] PORT Mode problem running off of multiple ports


> Port mode seems to be broken when running off of the same ip address
> with different ports. Port mode will hang when connecting to the 2122,
> but will work perfectly when connecting to port 2121.
>
> If I change the port 2122 to port 2120, port mode will then function on
> that port, but not 2121. It appears that it will only work on the lowest
> numbered port.
>
> If this doesn't make any sense, I have posted my configuration below.

This is explained in the "Multiple Daemons on Same Host" section of:

  http://www.proftpd.org/docs/howto/ConfigurationTricks.html

and is known as the "L-1" issue.

TJ

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   Much of your pain is self-chosen.

     -Kahlil Gibran

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
ProFTPD Users List   <proftpd-users <at> proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Dustin Ward | 2 Jan 2008 21:28
Favicon

Re: [Proftpd-user] PORT Mode problem running off of multiple ports

That worked, thanks!

TJ Saunders wrote:
Port mode seems to be broken when running off of the same ip address with different ports. Port mode will hang when connecting to the 2122, but will work perfectly when connecting to port 2121. If I change the port 2122 to port 2120, port mode will then function on that port, but not 2121. It appears that it will only work on the lowest numbered port. If this doesn't make any sense, I have posted my configuration below.
This is explained in the "Multiple Daemons on Same Host" section of: http://www.proftpd.org/docs/howto/ConfigurationTricks.html and is known as the "L-1" issue. TJ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Much of your pain is self-chosen. -Kahlil Gibran ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ ProFTPD Users List <proftpd-users <at> proftpd.org> Unsubscribe problems? http://www.proftpd.org/list-unsub.html
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
ProFTPD Users List   <proftpd-users <at> proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
Matus UHLAR - fantomas | 2 Jan 2008 22:56
Picon
Favicon

Re: [Proftpd-user] PORT Mode problem running off of multiple ports

On 02.01.08 09:18, Dustin Ward wrote:
> I am running proftpd on two ports, 2121, 2122.  Port 2121 houses my 
> anonymous ftp, and port 2122 houses regular ftp.

why? Do you need the same users log to different FTP sites?
--

-- 
Matus UHLAR - fantomas, uhlar <at> fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"Where do you want to go to die?" [Microsoft]

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
ProFTPD Users List   <proftpd-users <at> proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Douglas Walker | 3 Jan 2008 10:05

[Proftpd-user] Proftpd errors with "error mapping DelayTable"

Hi,

I'm having difficulty getting my proftpd to work -

I keep getting this error:

$ sudo /etc/init.d/proftpd restart
 * Stopping ftp server proftpd
   ...done.
 * Starting ftp server proftpd
ftp - mod_delay/0.5: error mapping DelayTable 
'/var/run/proftpd/proftpd.delay' into memory: Operation not permitted
   ...done.

When I check the logs it appears a user can log in but then proftpd 
craps out -

$ tail /var/log/proftpd/proftpd.log
Jan 03 17:44:57 ftp proftpd[9474] ftp: ProFTPD 1.3.0 (stable) (built Thu 
Mar 8 03:01:15 UTC 2007) standalone mode STARTUP
Jan 03 17:45:06 ftp proftpd[9499] ftp (xxx.xxx.xxx[192.168.x.xx]): FTP 
session opened.
Jan 03 17:45:10 ftp proftpd[9499] ftp (xxx.xxx.xxx[192.168.x.xx]): 
mod_delay/0.5warning: unable to load DelayTable '/var/run/
proftpd/proftpd.delay' into memory: Operation not permitted
Jan 03 17:45:13 ftp proftpd[9499] ftp (xxx.xxx.xxx[192.168.x.xx]): USER 
XXX: Login successful.
Jan 03 08:45:13 ftp proftpd[9499] ftp (xxx.xxx.xxx[192.168.x.xx]): 
Preparing to chroot to directory '/ftp/XXX'
Jan 03 08:45:13 ftp proftpd[9499] ftp (xxx.xxx.xxx[192.168.x.xx]): 
ProFTPD terminating (signal 11)
Jan 03 08:45:13 ftp proftpd[9499] ftp (xxx.xxx.xxx[192.168.x.xx]): FTP 
session closed.

 From the client side  - it asks for a password and then:
421 Service not available, remote server has closed connection
Login failed.
No control connection for command: Permission denied

The config test switch doesn't give any further detail:

$ sudo proftpd -t
Checking syntax of configuration file
ftp - mod_delay/0.5: error mapping DelayTable 
'/var/run/proftpd/proftpd.delay' into memory: Operation not permitted
Syntax check complete.
ftp - mod_delay/0.5warning: unable to load DelayTable 
'/var/run/proftpd/proftpd.delay' into memory: Operation not permitted

I've googled for "error mapping DelayTable" and looked thru the list 
archives and came up with zilch.

I'm using :
$ proftpd -vv
 - ProFTPD Version: 1.3.0 (stable)
 -   Scoreboard Version: 01040002
 -   Built: Thu Mar 8 03:01:15 UTC 2007
 -     Module: mod_core.c
 -     Module: mod_xfer.c
 -     Module: mod_auth_unix.c
 -     Module: mod_auth_file.c
 -     Module: mod_auth.c
 -     Module: mod_ls.c
 -     Module: mod_log.c
 -     Module: mod_site.c
 -     Module: mod_delay/0.5
 -     Module: mod_dso/0.4
 -     Module: mod_auth_pam.c
 -     Module: mod_readme.c
 -     Module: mod_cap/1.0
 -     Module: mod_ctrls/0.9.4

and the relevant bits of my proftpd.conf look like this:

Include /etc/proftpd/modules.conf
UseIPv6                         off
ServerName                      "XXX"
ServerType                      standalone
DeferWelcome                    off
MultilineRFC2228                on
DefaultServer                   on
ShowSymlinks                    on
TimeoutNoTransfer               600
TimeoutStalled                  600
TimeoutIdle                     1200
DisplayLogin                    welcome.msg
DisplayFirstChdir               .message
ListOptions                     "-l"
DenyFilter                      \*.*/
DefaultRoot                     ~
Port                            21
MaxInstances                    30
User                            proftpd
Group                           nogroup
Umask                           022  022
AllowOverwrite                  on
TransferLog /var/log/proftpd/xferlog
SystemLog   /var/log/proftpd/proftpd.log
<IfModule mod_tls.c>
TLSEngine off
</IfModule>
<IfModule mod_quota.c>
QuotaEngine on
</IfModule>
<IfModule mod_ratio.c>
Ratios on
</IfModule>
<IfModule mod_delay.c>
DelayEngine on
</IfModule>
<IfModule mod_ctrls.c>
ControlsEngine        on
ControlsMaxClients    2
ControlsLog           /var/log/proftpd/controls.log
ControlsInterval      5
ControlsSocket        /var/run/proftpd/proftpd.sock
</IfModule>
<IfModule mod_ctrls_admin.c>
AdminControlsEngine on
</IfModule>

Can anyone help?

D

--

-- 

Douglas Walker
Systems Administrator
Jones Coulter Young Architects
321 Murray St, Perth
WA, 6000

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
ProFTPD Users List   <proftpd-users <at> proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

TJ Saunders | 3 Jan 2008 22:37

Re: [Proftpd-user] Proftpd errors with "error mapping DelayTable"


> I'm having difficulty getting my proftpd to work -

What OS/platform are you running?

> $ proftpd -vv

Could you also provide the output of `proftpd -V'?

TJ

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   To spend too much time in studies is sloth.

   	-Francis Bacon

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
ProFTPD Users List   <proftpd-users <at> proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Douglas Walker | 4 Jan 2008 01:21

Re: [Proftpd-user] Proftpd errors with "error mapping DelayTable"


Woops,

I'm using Linux - Ubuntu 7.04

and

$ proftpd -V
Compile-time Settings:
  Version: 1.3.0
  Platform: LINUX
  Built With:
    configure linux gnu

  Files:
    Configuration File:
      /etc/proftpd/proftpd.conf
    Pid File:
      /var/run/proftpd.pid
    Scoreboard File:
      /var/run/proftpd/proftpd.scoreboard
    Shared Module Directory:
      /usr/lib/proftpd

  Features:
    + Autoshadow support
    + Controls support
    + curses support
    + Developer support
    + DSO support
    + IPv6 support
    + Largefile support
    + ncurses support
    + POSIX ACL support
    + Shadow file support
    + Sendfile support

  Tunable Options:
    PR_TUNABLE_BUFFER_SIZE = 1024
    PR_TUNABLE_GLOBBING_MAX = 8
    PR_TUNABLE_HASH_TABLE_SIZE = 40
    PR_TUNABLE_NEW_POOL_SIZE = 512
    PR_TUNABLE_RCVBUFSZ = 8192
    PR_TUNABLE_SCOREBOARD_BUFFER_SIZE = 80
    PR_TUNABLE_SCOREBOARD_SCRUB_TIMER = 30
    PR_TUNABLE_SELECT_TIMEOUT = 30
    PR_TUNABLE_SNDBUFSZ = 8192
    PR_TUNABLE_TIMEOUTIDENT = 10
    PR_TUNABLE_TIMEOUTIDLE = 600
    PR_TUNABLE_TIMEOUTLINGER = 180
    PR_TUNABLE_TIMEOUTLOGIN = 300
    PR_TUNABLE_TIMEOUTNOXFER = 300
    PR_TUNABLE_TIMEOUTSTALLED = 3600
    PR_TUNABLE_XFER_BUFFER_SIZE = 1024
    PR_TUNABLE_XFER_SCOREBOARD_UPDATES = 10


Cheers


D




TJ Saunders wrote:
I'm having difficulty getting my proftpd to work -
What OS/platform are you running?
$ proftpd -vv
Could you also provide the output of `proftpd -V'? TJ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To spend too much time in studies is sloth. -Francis Bacon ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ ProFTPD Users List <proftpd-users <at> proftpd.org> Unsubscribe problems? http://www.proftpd.org/list-unsub.html


-- Douglas Walker Systems Administrator Jones Coulter Young Architects 321 Murray St, Perth WA, 6000
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
ProFTPD Users List   <proftpd-users <at> proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
TJ Saunders | 4 Jan 2008 05:39

Re: [Proftpd-user] Proftpd errors with "error mapping DelayTable"


> I'm using Linux - Ubuntu 7.04

According to the mmap(2) man page on Ubuntu 7.04, the "Operation not
permitted" error (EPERM) occurs for mmap() functions when:

       EPERM  The prot argument asks for PROT_EXEC but the mapped area belongs
              to a file on a filesystem that was mounted no-exec.

However, the mod_delay module does not use the PROT_EXEC flag when calling
mmap(2).  The man page also mentions:

  NOTES
       It is architecture dependent whether PROT_READ includes PROT_EXEC or
       not.  Portable programs should always set PROT_EXEC if they intend to
       execute code in the new mapping.

This means that your system *might* set the PROT_EXEC flag automatically,
if the PROT_READ flag (which mod_delay *does* use) is used.

If this is the case, and your filesystem on which the DelayTable lies is
mounted no-exec, then it could explain your warning.  That being the case,
you might consider disabling mod_delay using the following in your
proftpd.conf:

  <IfModule mod_delay.c>
    DelayEngine off
  </IfModule>

> Jan 03 08:45:13 ftp proftpd[9499] ftp (xxx.xxx.xxx[192.168.x.xx]):
> Preparing to chroot to directory '/ftp/XXX'
> Jan 03 08:45:13 ftp proftpd[9499] ftp (xxx.xxx.xxx[192.168.x.xx]):
> ProFTPD terminating (signal 11)

This is the real reason for your issue, why FTP clients are unable to
login.

Would it be possible to see the other configuration file:

  Include /etc/proftpd/modules.conf

which probably loads more modules into your proftpd, and which might also
be causing issues?

> $ proftpd -V
> Compile-time Settings:
>   Version: 1.3.0
>   Platform: LINUX
>   Built With:
>     configure linux gnu

I find this very interesting, since your configure options don't include
any special command-line options, but...

>   Features:
>     + Autoshadow support
>     + Controls support
>     + curses support
>     + Developer support
>     + DSO support
>     + IPv6 support
>     + Largefile support
>     + ncurses support
>     + POSIX ACL support
>     + Shadow file support
>     + Sendfile support

...some of these features, such as IPv6 support, DSO support, and
developer support are only enabled when special configure command-line
options are used.  Either things are not quite as they look, or the
proftpd package you are running has been tweaked from the original
distribution (in which case, I can offer no help without knowing what
those non-standard modifications were).

TJ

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

   But let there be spaces in your togetherness.

     -Kahlil Gibran

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
ProFTPD Users List   <proftpd-users <at> proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Douglas Walker | 4 Jan 2008 04:08

Re: [Proftpd-user] Proftpd errors with "error mapping DelayTable"

<IfModule mod_delay.c> DelayEngine off </IfModule> Yes that fixed it up. Thanks for the help.

I didn't think it relevant so didn't mention it  - the ftp server is a virtual - I'm using Virtuozzo.

I haven't checked yet but i'd assume that Virtuozzo is mounting my virtual filesytem as no-exec.

I'll be moving the /ftp directory to shared storage (ie a different filesytem) in a month or so, so I may change this setting back.

Is this setting just to guard against hacking  - ie there are no other implications of not using it?

Also can you tell me (or point me to info on) what a DelayTable is?


$ proftpd -V Compile-time Settings: Version: 1.3.0 Platform: LINUX Built With: configure linux gnu
I find this very interesting, since your configure options don't include any special command-line options, but...

...some of these features, such as IPv6 support, DSO support, and developer support are only enabled when special configure command-line options are used. Either things are not quite as they look, or the proftpd package you are running has been tweaked from the original distribution (in which case, I can offer no help without knowing what those non-standard modifications were).
nope, I installed proftpd from the Ubuntu repositories.


Thanks again for the help


D


-- Douglas Walker Systems Administrator Jones Coulter Young Architects 321 Murray St, Perth WA, 6000
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
ProFTPD Users List   <proftpd-users <at> proftpd.org>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html

Gmane