https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c2 Benjamin Brunner <bbrunner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|maintenance@opensuse.org | --- Comment #2 from Benjamin Brunner <bbrunner@suse.com> 2012-10-22 14:16:11 CEST --- Michal could you do a maintenancerequest with the fixed package for 12.2 and submit it to factory too, please? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c4 Michal Vyskocil <mvyskocil@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #4 from Michal Vyskocil <mvyskocil@suse.com> 2012-10-22 13:40:38 UTC --- 12.2: 138997 factory: 138998 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c6 --- Comment #6 from Swamp Workflow Management <swamp@suse.de> 2012-10-29 12:08:40 UTC --- openSUSE-RU-2012:1405-1: An update that has one recommended fix can now be installed. Category: recommended (low) Bug References: 786024 CVE References: Sources used: openSUSE 12.2 (src): vsftpd-3.0.2-3.4.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c Michal Vyskocil <mvyskocil@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |ASSIGNED -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c9 Michal Vyskocil <mvyskocil@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Network |Network Version|12.3 Milestone 0 |RC 1 AssignedTo|mvyskocil@suse.com |bnc-team-screening@forge.pr | |ovo.novell.com Product|openSUSE Factory |openSUSE 12.3 Target Milestone|--- |RC 2 OS/Version|openSUSE 12.2 |Linux --- Comment #9 from Michal Vyskocil <mvyskocil@suse.com> 2013-02-04 14:11:59 UTC --- Changed the product to appear on a list of 12.3 bugs ... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c10 --- Comment #10 from Michal Vyskocil <mvyskocil@suse.com> 2013-02-12 16:47:42 UTC --- It seems there is some race - when I've added vfs_cmdio_write into the code to find the location, where it happens, the priv_sock_get_cmd disappeared. So still under investigating. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c12 Thorsten Kukuk <kukuk@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|kukuk@suse.com | --- Comment #12 from Thorsten Kukuk <kukuk@suse.com> 2013-02-21 13:37:26 UTC --- (In reply to comment #11)

Well, I suspect the pam subsystem try to open a /dev/log.

PAM calls syslog(), which I assumes opens /dev/log.

2013-02-21T14:20:17.693042+01:00 linux-xtv2 vsftpd[1]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=mvyskocil rhost=::1 user=mvyskocil 2013-02-21T14:20:18.407159+01:00 linux-xtv2 vsftpd[1]: pam_sss(vsftpd:auth): authentication success; logname= uid=0 euid=0 tty=ftp ruser=mvyskocil rhost=::1 user=mvyskocil 2013-02-21T14:20:18.409089+01:00 linux-xtv2 vsftpd[1]: PAM audit_log_acct_message() failed: Operation not permitted 2013-02-21T14:20:18.411338+01:00 linux-xtv2 vsftpd[1]: [mvyskocil] FAIL LOGIN: Client "::1"

@thorsen: I would say both CAP_AUDIT_* are needed for vsftpd. I'm right?

I have no idea about CAP_AUDIT_*, but PAM is using the audit subsystem for logging. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c14 Michal Vyskocil <mvyskocil@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P2 - High |P1 - Urgent --- Comment #14 from Michal Vyskocil <mvyskocil@suse.com> 2013-02-25 14:55:37 UTC --- @cboltz: thanks, I'll patch vsftpd to keep CAP_AUDIT_WRITE then. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c16 --- Comment #16 from Michal Vyskocil <mvyskocil@suse.com> 2013-02-28 13:19:11 UTC --- Created an attachment (id=527476) --> (http://bugzilla.novell.com/attachment.cgi?id=527476) strace output of vsftpd This is the full strace output, but I was not able to realize which syscall triggered the audit error. Note that process calls capset for CAP_AUDIT_WRITE (+ _CONTROL, which shall not be needed). I would not say there are no more capabilities to try. This is a part relevant starting with what audit_init do 7462 14:01:23.677346 socket(PF_NETLINK, SOCK_RAW, 9) = 4 7462 14:01:23.677412 fcntl(4, F_SETFD, FD_CLOEXEC) = 0 7462 14:01:23.677463 socket(PF_NETLINK, SOCK_RAW, 0) = 5 7462 14:01:23.677499 bind(5, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 0 7462 14:01:23.677541 getsockname(5, {sa_family=AF_NETLINK, pid=1, groups=00000000}, [12]) = 0 7462 14:01:23.677583 sendto(5, "\24\0\0\0\26\0\1\3#U/Q\0\0\0\0\0\0\0\0", 20, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 20 7462 14:01:23.677634 recvmsg(5, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"0\0\0\0\24\0\2\0#U/Q\1\0\0\0\2\10\200\376\1\0\0\0\10\0\1\0\177\0\0\1\10\0\2\0\177\0\0\1\7\0\3\0lo\0\0<\0\0\0\24\0\2\0#U/Q\1\0\0\0\2\22\200\0\2\0\0\0\10\0\1\0\nd3Y\10\0\2\0\nd3Y\10\0\4\0\nd?\377\t\0\3\0eth0\0\0\0\0<\0\0\0\24\0\2\0#U/Q\1\0\0\0\2\27\200\0\3\0\0\0\10\0\1\0\225,\2106\10\0\2\0\225,\2106\10\0\4\0\225,\211\377\n\0\3\0wlan0\0\0\0", 4096}], msg_controllen=0, msg_flags=0}, 0) = 168 7462 14:01:23.677687 recvmsg(5, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"@\0\0\0\24\0\2\0#U/Q\1\0\0\0\n\200\200\376\1\0\0\0\24\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\24\0\6\0\377\377\377\377\377\377\377\377j\3\0\0j\3\0\0@\0\0\0\24\0\2\0#U/Q\1\0\0\0\n@\200\375\2\0\0\0\24\0\1\0\376\200\0\0\0\0\0\0>\227\16\377\376q\2767\24\0\6\0\377\377\377\377\377\377\377\377]\321\3\0]\321\3\0@\0\0\0\24\0\2\0#U/Q\1\0\0\0\n@\200\375\3\0\0\0\24\0\1\0\376\200\0\0\0\0\0\0\206:K\377\376[\253\314\24\0\6\0\377\377\377\377\377\377\377\377\241\322\3\0\241\322\3\0", 4096}], msg_controllen=0, msg_flags=0}, 0) = 192 7462 14:01:23.677730 recvmsg(5, {msg_name(12)={sa_family=AF_NETLINK, pid=0, groups=00000000}, msg_iov(1)=[{"\24\0\0\0\3\0\2\0#U/Q\1\0\0\0\0\0\0\0", 4096}], msg_controllen=0, msg_flags=0}, 0) = 20 7462 14:01:23.677769 socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 6 7462 14:01:23.677804 connect(6, {sa_family=AF_FILE, sun_path="/var/run/nscd/socket"}, 110) = 0 7462 14:01:23.677847 sendto(6, "\2\0\0\0\r\0\0\0\6\0\0\0hosts\0", 18, MSG_NOSIGNAL, NULL, 0) = 18 7462 14:01:23.677882 poll([{fd=6, events=POLLIN|POLLERR|POLLHUP}], 1, 5000) = 1 ([{fd=6, revents=POLLIN}]) 7462 14:01:23.677936 recvmsg(6, {msg_name(0)=NULL, msg_iov(2)=[{"hosts\0", 6}, {"\310O\3\0\0\0\0\0", 8}], msg_controllen=24, {cmsg_len=20, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, {7}}, msg_flags=MSG_CMSG_CLOEXEC}, MSG_CMSG_CLOEXEC) = 14 7462 14:01:23.678022 mmap(NULL, 217032, PROT_READ, MAP_SHARED, 7, 0) = 0x7fc3b1cf7000 7462 14:01:23.678113 close(7) = 0 7462 14:01:23.678169 close(6) = 0 7462 14:01:23.678252 close(5) = 0 7462 14:01:23.678388 readlink("/proc/self/exe", "/usr/sbin/vsftpd", 4096) = 16 7462 14:01:23.678541 sendto(4, "\204\0\0\0L\4\5\0\1\0\0\0\0\0\0\0op=PAM:authentication acct=\"test\" exe=\"/usr/sbin/vsftpd\" hostname=127.0.0.1 addr=127.0.0.1 terminal=ftp res=success\0", 132, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 132 7462 14:01:23.678605 poll([{fd=4, events=POLLIN}], 1, 500) = 1 ([{fd=4, revents=POLLIN}]) 7462 14:01:23.678654 recvfrom(4, "\230\0\0\0\2\0\0\0\1\0\0\0005\357\377\377\377\377\377\377\204\0\0\0L\4\5\0\1\0\0\0\0\0\0\0op=PAM:authentication acct=\"test\" exe=\"/usr/sbin/vsftpd\" hostname=127.0.0.1 addr=127.0.0.1 terminal=ftp res=success\0", 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 152 7462 14:01:23.678709 recvfrom(4, "\230\0\0\0\2\0\0\0\1\0\0\0005\357\377\377\377\377\377\377\204\0\0\0L\4\5\0\1\0\0\0\0\0\0\0op=PAM:authentication acct=\"test\" exe=\"/usr/sbin/vsftpd\" hostname=127.0.0.1 addr=127.0.0.1 terminal=ftp res=success\0", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 152 7462 14:01:23.678759 getuid() = 0 7462 14:01:23.678802 getuid() = 0 7462 14:01:23.678880 socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5 7462 14:01:23.678927 connect(5, {sa_family=AF_FILE, sun_path="/dev/log"}, 110) = 0 7462 14:01:23.678977 sendto(5, "<82>Feb 28 14:01:23 vsftpd[1]: PAM audit_log_acct_message() failed: Operation not permitted", 91, MSG_NOSIGNAL, NULL, 0) = 91 7462 14:01:23.679050 close(4) = 0 But despite the recvfrom(4 did not failed, the Operation not permitted is returned, but I have no idea why. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c18 --- Comment #18 from Bernhard Wiedemann <bwiedemann@suse.com> 2013-02-28 17:00:07 CET --- This is an autogenerated message for OBS integration: This bug (786024) was mentioned in https://build.opensuse.org/request/show/156829 Factory / vsftpd -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c20 Tony Jones <tonyj@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tonyj@suse.com --- Comment #20 from Tony Jones <tonyj@suse.com> 2013-02-28 19:51:50 UTC --- I need to get this string data in a format that's easier to understand. The \230 part is a netlink header but "strace -xx" format would be much easier for me to decipher. 7462 14:01:23.678654 recvfrom(4, "\230\0\0\0\2\0\0\0\1\0\0\0005\357\377\377\377\377\377\377\204\0\0\0L\4\5\0\1\0\0\0\0\0\0\0op=PAM:authentication acct=\"test\" exe=\"/usr/sbin/vsftpd\" hostname=127.0.0.1 addr=127.0.0.1 terminal=ftp res=success\0", 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 152 7462 14:01:23.678709 recvfrom(4, "\230\0\0\0\2\0\0\0\1\0\0\0005\357\377\377\377\377\377\377\204\0\0\0L\4\5\0\1\0\0\0\0\0\0\0op=PAM:authentication acct=\"test\" exe=\"/usr/sbin/vsftpd\" hostname=127.0.0.1 addr=127.0.0.1 terminal=ftp res=success\0", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 152 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c22 --- Comment #22 from Tony Jones <tonyj@suse.com> 2013-03-01 20:40:43 UTC --- (In reply to comment #17)

@tonyj: can you check the strace output and find why the pam returns such error? The Linux-PAM-1.1.6/lib/pam_audit.c does this

rc = audit_log_acct_message (audit_fd, type, NULL, buf, (retval != PAM_USER_UNKNOWN && pamh->user) ? pamh->user : "?", -1, pamh->rhost, NULL, pamh->tty, retval == PAM_SUCCESS );

/* libaudit sets errno to his own negative error code. This can be an official errno number, but must not. It can also be a audit internal error code. Which makes errno useless :-((. Try the best to fix it. */ errno = -rc;

pamh->audit_state |= PAMAUDIT_LOGGED;

if (rc < 0) { if (rc == -EPERM && getuid() != 0) return 0; if (errno != old_errno) { old_errno = errno; pam_syslog (pamh, LOG_CRIT, "audit_log_acct_message() failed: %m"); } } return rc;

so audit_log_acct_message returned negative value, but if I have no idea why.

The code in audit (lib/netlink.c::check_ack()) /* NLMSG_ERROR can indicate success, only report nonzero */ if (rep.error->error) { errno = -rep.error->error; return rep.error->error; Based on the strace log, rep.error->error is -1 which should be what is returned back to PAM. Is there anything informative in the kernel or audit logs? Otherwise can you give me a quick tutorial on how to setup to reproduce as I'll have to debug the library. Thanks! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c24 --- Comment #24 from Michal Vyskocil <mvyskocil@suse.com> 2013-03-04 13:37:49 UTC ---

Is there anything informative in the kernel or audit logs? Otherwise can you give me a quick tutorial on how to setup to reproduce as I'll have to debug the library.

Hi, I don't see anything useful in system log 2013-03-04T14:27:45.535028+01:00 linux-xtv2 systemd[1]: Started Vsftpd ftp daemon. 2013-03-04T14:28:01.953454+01:00 linux-xtv2 vsftpd[1]: PAM audit_log_acct_message() failed: Operation not permitted 2013-03-04T14:28:01.954845+01:00 linux-xtv2 vsftpd[1]: [test] FAIL LOGIN: Client "127.0.0.1" 2013-03-04T14:28:14.316061+01:00 linux-xtv2 systemd[1]: Started Vsftpd ftp daemon. 2013-03-04T14:28:39.682743+01:00 linux-xtv2 vsftpd[1]: PAM audit_log_acct_message() failed: Operation not permitted 2013-03-04T14:28:39.684083+01:00 linux-xtv2 vsftpd[1]: [test] FAIL LOGIN: Client "127.0.0.1" and dmesg seems to be full of wlan0 related things only. Steps to reproduce 1.) install 12.3 RC2 2.) zypper install vsftpd 3.) useradd test 4.) echo "test" | passwd test 5.) systemctl start vsftpd.service 6.) ftp ftp://test:test@localhost BTW: you might get a OOPS: priv_sock_get_cmd, in this case please add Workaround: add seccomp_sandbox=NO to vsftpd.conf It has been fixed, just I am not sure if it appear in RC2 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c26 --- Comment #26 from Tony Jones <tonyj@suse.com> 2013-03-06 22:29:02 UTC --- (In reply to comment #24)

Steps to reproduce 1.) install 12.3 RC2 2.) zypper install vsftpd 3.) useradd test 4.) echo "test" | passwd test 5.) systemctl start vsftpd.service 6.) ftp ftp://test:test@localhost

BTW: you might get a OOPS: priv_sock_get_cmd, in this case please add

Workaround: add seccomp_sandbox=NO to vsftpd.conf

It has been fixed, just I am not sure if it appear in RC2

Thanks, I can reproduce, but I don't have an answer yet. It's odd as - 'auditctl -m' is working fine, this calls audit_send_user_message() and succeeds. - su succeeds, here PAM is calling audit_log_acct_message() which is calling audit_send_user_message() su: in audit_log_acct_message audit_fd=3, type=1104, pgname='(null)', op='PAM:setcred', name='root', id=4294967295, host='(null)', addr='(null)', tty='pts/3', result=1 return is 6 vsftp: in audit_log_acct_message audit_fd=4, type=1100, pgname='(null)', op='PAM:authentication', name='test', id=4294967295, host='127.0.0.1', addr='(null)', tty='ftp', result=1 return is -1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c28 --- Comment #28 from Michal Vyskocil <mvyskocil@suse.com> 2013-03-20 09:46:00 UTC --- @tonyj: would you say the audit=0 on a commandline can work-around it? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c30 Chuck Davis <cjgunzel@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cjgunzel@gmail.com --- Comment #30 from Chuck Davis <cjgunzel@gmail.com> 2013-03-27 20:15:36 UTC --- When attempting to start vsftpd in system services of YaST a message is returned that network-remotefs service is required. It appears vsftpd is started because port 21 is open from a remote machine but it is not possible to connect to the server. A Linux server with no working FTP server is a real black eye! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c32 --- Comment #32 from Johan Persson <johanp@aditus.nu> 2013-03-27 20:23:37 UTC --- (In reply to comment #30)

A Linux server with no working FTP server is a real black eye!

Until this is fixed an easy workaround for this "black-eye" is to use pure-ftpd instead which works just fine and is functional equivalent in (almost) all practical sense to vsftpd -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c35 Ioannis Theodoridis <ITheodoridis@bankofgreece.gr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ITheodoridis@bankofgreece.g | |r --- Comment #35 from Ioannis Theodoridis <ITheodoridis@bankofgreece.gr> 2013-03-28 11:04:41 UTC --- I am facing the same problem with OpenSuSE 12.3 64bit, network install. Pure-ftpd is reported (OpenSuSE forums) to work only if pam athentication is disabled (and local authentication enabled) in the pure-ftpd configuration. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c37 --- Comment #37 from Ioannis Theodoridis <ITheodoridis@bankofgreece.gr> 2013-03-28 15:22:09 UTC --- When I tried it personally, it refused to start. I will check one more time and repost. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c39 --- Comment #39 from Michal Vyskocil <mvyskocil@suse.com> 2013-03-29 08:10:17 UTC --- vsftpd calls CLONE_NEWPID on SUSE - it is visible in #comment11 (see vsftpd[1]).

Also if I boot with audit=0 then client side ftp fails with "500 OOPS: priv_sock_get_cmd" (seccomp_sandbox=NO in /etc/vsftpd.conf).

This does not makes any sense to me. This bug is related to enabled seccomp sanbox, but it was fixed before 12.3 release. I'll test that. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c Michal Vyskocil <mvyskocil@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |812406 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c42 --- Comment #42 from Michal Vyskocil <mvyskocil@suse.com> 2013-03-29 11:49:19 UTC --- (In reply to comment #41)

Well, I have a question now.

Will the system be updated to run VSFTPD correctly or I have to apply the patch manually?

There will be a maintenance update, once all issues will be resolved. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c43 --- Comment #43 from Bernhard Wiedemann <bwiedemann@suse.com> 2013-04-04 13:00:08 CEST --- This is an autogenerated message for OBS integration: This bug (786024) was mentioned in https://build.opensuse.org/request/show/162591 Factory / vsftpd -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c45 Michal Vyskocil <mvyskocil@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |maintenance@opensuse.org --- Comment #45 from Michal Vyskocil <mvyskocil@suse.com> 2013-04-04 12:02:46 UTC --- Sent an update to 12.3 via 162608 @maintenance, please open a new maintenance incident -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c47 Angelos Tzotsos <tzotsos@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tzotsos@gmail.com --- Comment #47 from Angelos Tzotsos <tzotsos@gmail.com> 2013-04-12 16:25:00 UTC --- Hi all, I see that the update is accepted but not yet released. Is there an ETA on the update? Perhaps a testing repo for the update to see if it works? Cheers, Angelos -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c49 --- Comment #49 from Angelos Tzotsos <tzotsos@gmail.com> 2013-04-12 18:26:28 UTC --- Thanks Markus, I installed the test-update repository and vsftp from there. I get the following error: ftp ftp://test:test@localhost Trying ::1... ftp: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. 220 Welcome message 331 Please specify the password. 500 OOPS: vsftpd: refusing to run with writable root inside chroot() ftp: Login failed. ftp: Can't connect or login to host `localhost' 500 OOPS: priv_sock_get_cmd Any ideas? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c51 --- Comment #51 from Angelos Tzotsos <tzotsos@gmail.com> 2013-04-12 19:54:03 UTC --- Update2: I flushed again everything but did not manage to get it working again. The log message when I run "service vsftpd status" shows login success, but the client reports error 500 and closes connection. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c53 --- Comment #53 from Ioannis Theodoridis <ITheodoridis@bankofgreece.gr> 2013-04-15 05:56:21 UTC --- (In reply to comment #52)

(In reply to comment #37)

...

When I tried it personally, it refused to start. I will check one more time and repost.

Hi Ioannis,

Any updates on that? Did you manage to make it work with pure-ftp? I am having the same problem: pure-ftp refuses to start. I upgraded from 12.2. Did you upgrade too or was it a clean install?

Hello Angelos :) Yes I tried again, it needs to start through xinetd or it will not start on its own (standalone). I can't say I like it, but I will live until we get the official update for vsftpd through official repos, which I am waiting for very patiantly... Let's hope it doesn't take forever.. Guys the limitations of open source are showing in this case.. I know it's unfair, but the reaction I am gettinig in my enterprise is surprise and dissappointment. We are definately not winning over any business people like that. Personally, I am keeping a low profile till this is resolved. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c55 --- Comment #55 from Angelos Tzotsos <tzotsos@gmail.com> 2013-04-15 10:03:35 UTC --- Unfortunately the update did not work for me. I still get the "500 OOPS: priv_sock_get_cmd" error. Disabling seccomp sandbox is not working for me either... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c57 --- Comment #57 from Angelos Tzotsos <tzotsos@gmail.com> 2013-04-18 09:49:34 UTC --- Created an attachment (id=535776) --> (http://bugzilla.novell.com/attachment.cgi?id=535776) configuration file that fails -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c59 --- Comment #59 from Angelos Tzotsos <tzotsos@gmail.com> 2013-04-18 09:52:53 UTC --- And the strace: # strace -p 23677 -tt -s 512 Process 23677 attached 12:51:03.048164 accept(3, {sa_family=AF_INET, sin_port=htons(46433), sin_addr=inet_addr("109.242.165.239")}, [16]) = 4 12:51:12.678545 clone(child_stack=0, flags=CLONE_NEWIPC|SIGCHLD) = 23929 12:51:12.678783 close(4) = 0 12:51:12.678855 accept(3, 0x7fffba89a3a0, [28]) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) 12:51:16.044845 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23929, si_status=2, si_utime=0, si_stime=0} --- 12:51:16.044914 alarm(1) = 0 12:51:16.044968 rt_sigreturn() = -1 EINTR (Interrupted system call) 12:51:16.045047 alarm(0) = 1 12:51:16.045095 wait4(-1, NULL, WNOHANG, NULL) = 23929 12:51:16.045173 wait4(-1, NULL, WNOHANG, NULL) = -1 ECHILD (No child processes) 12:51:16.045224 accept(3, {sa_family=AF_INET, sin_port=htons(46434), sin_addr=inet_addr("109.242.165.239")}, [16]) = 4 12:51:16.083371 clone(child_stack=0, flags=CLONE_NEWIPC|SIGCHLD) = 23936 12:51:16.083620 close(4) = 0 12:51:16.083690 accept(3, 0x7fffba89a3a0, [28]) = ? ERESTARTSYS (To be restarted if SA_RESTART is set) 12:51:25.264770 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=23936, si_status=2, si_utime=0, si_stime=0} --- 12:51:25.264834 alarm(1) = 0 12:51:25.264882 rt_sigreturn() = -1 EINTR (Interrupted system call) 12:51:25.264936 alarm(0) = 1 12:51:25.264977 wait4(-1, NULL, WNOHANG, NULL) = 23936 12:51:25.265053 wait4(-1, NULL, WNOHANG, NULL) = -1 ECHILD (No child processes) 12:51:25.265099 accept(3, {sa_family=AF_INET, sin_port=htons(46437), sin_addr=inet_addr("109.242.165.239")}, [16]) = 4 12:51:25.302455 clone(child_stack=0, flags=CLONE_NEWIPC|SIGCHLD) = 23941 12:51:25.302684 close(4) = 0 12:51:25.302754 accept(3, ^CProcess 23677 detached <detached ...> -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c61 --- Comment #61 from Angelos Tzotsos <tzotsos@gmail.com> 2013-04-18 10:07:41 UTC --- Thanks, it is working locally now. I still cannot access from remote location (error while changing to /home/user) Looking into it. Thanks, Angelos -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c63 Ralph Moenchmeyer <rm@anracon.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |rm@anracon.de --- Comment #63 from Ralph Moenchmeyer <rm@anracon.de> 2013-06-06 06:06:09 UTC --- Hi, I am using Opensue 12.3 64 Bit. Freshly installed and updated to the latest packages from the update repository. In my opinion the problems regarding the present version 3.0.2-4.5.1 of vsftp are far from resolved. As other related bugs as https://bugzilla.novell.com/show_bug.cgi?id=806758 were marked as duplicates of this one I post my findings here. Bug 1 ****** I still need seccomp_sandbox=NO to connect, when TLS is enabled. With this option set to NO everything works as expected. However, if seccomp_sandbox=YES I get the following messages in Filezilla when trying too connect from a remote system which also runs under OS 12.3: Status: TLS/SSL-Verbindung hergestellt. Antwort: 331 Please specify the password. Befehl: PASS ******* Antwort: 230 Login successful. Befehl: SYST Antwort: 215 UNIX Type: L8 Befehl: FEAT Antwort: 211-Features: Antwort: AUTH TLS Antwort: EPRT Antwort: EPSV Antwort: MDTM Antwort: PASV Antwort: PBSZ Antwort: PROT Antwort: REST STREAM Antwort: SIZE Antwort: TVFS Antwort: UTF8 Antwort: 211 End Befehl: OPTS UTF8 ON Antwort: 200 Always in UTF8 mode. Befehl: PBSZ 0 Antwort: 200 PBSZ set to 0. Befehl: PROT P Antwort: 200 PROT now Private. Status: Verbunden Status: Empfange Verzeichnisinhalt... Befehl: CWD / Antwort: 250 Directory successfully changed. Befehl: PWD Antwort: 257 "/" Befehl: TYPE I Antwort: 200 Switching to Binary mode. Befehl: PASV Fehler: GnuTLS error -15: Ein unerwartetes TLS-Paket wurde empfangen. Fehler: Verbindung zum Server getrennt: ECONNABORTED - Connection aborted Fehler: Verzeichnisinhalt konnte nicht empfangen werden Bug 2 (maybe related) ****** 2) Even with "seccomp_sandbox=NO", but switching to syslog_enable=YES I get the following message in filezilla: Status: Connecting to 192.168.0.37:21... Status: Connection established, waiting for welcome message... Response: 500 OOPS: priv_sock_get_cmd Error: Critical error Error: Could not connect to server Bug 3: ******

From some OS 12.3 remote systems I cannot connect in case the following option is not set to NO:

require_ssl_reuse=NO So all in all vsftp still shows major deficiencies on Opensuse 12.3 which were not present in OS 12.2. Any ideas what I could do ? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=786024 https://bugzilla.novell.com/show_bug.cgi?id=786024#c65 Alejandro Bonilla <abonilla@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |abonilla@suse.com --- Comment #65 from Alejandro Bonilla <abonilla@suse.com> 2013-07-10 15:48:36 UTC --- guys, a fresh install of the vsftp will still show this problem, we had to use the workaround provided. If a configuration setting has changed, ie "require_ssl_reuse=NO" then we need to push this line to the default config file...! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=786024 Swamp Workflow Management <swamp@suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:2254:moderate -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=786024 Swamp Workflow Management <swamp@suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|ibs:running:2254:moderate |obs:running:5202:moderate |obs:running:5202:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=786024 Swamp Workflow Management <swamp@suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:5202:moderate | -- You are receiving this mail because: You are on the CC list for the bug.