[Bug 276462] New: Yast FTP Server cannot upload
https://bugzilla.novell.com/show_bug.cgi?id=276462 Summary: Yast FTP Server cannot upload Product: openSUSE 10.3 Version: Alpha 4 Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: YaST2 AssignedTo: juhliarik@novell.com ReportedBy: al4321@gmail.com QAContact: jsrain@novell.com hi all ! Yast FTP Server in SUSE 10.3 alpha4 can work only in RO mode, not in RW mode. I have set it up to: Anonymous -only authentication, Anonymous can upload and Anonymous can create directories. I think It uses "vsftpd" but I'm not sure, because both buttons are grayed. Anyway: when I access the ftp server via Konqueror via: ftp://localhost I see the files that I created on /srv/ftp but I cannot upload/create nor files and nor folders. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=276462 ------- Comment #1 from al4321@gmail.com 2007-05-19 12:41 MST ------- Created an attachment (id=141170) --> (https://bugzilla.novell.com/attachment.cgi?id=141170&action=view) rpmlist.txt - list of RPM packages installed on my openSUSE 10.3 Alpha4 testbed. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=276462 juhliarik@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |al4321@gmail.com ------- Comment #2 from juhliarik@novell.com 2007-05-21 02:11 MST ------- Hello, radiobuttons for switching between daemons are greyed because only one of them is installed. It is not necessary allowed switching between daemons in this case. BUT one of them are selected and it is daemon which is configured. Could you check values from /etc/vsftpd.conf (or could you send me this file) for anon_mkdir_write_enable and anon_upload_enable? My opinion is that home directory after login where you tried upload or make subdirectory has not permissions for writting. I only change options in vsftpd config file. BTW: I agree that change permissions for home directory after login for anonymous users I can do via ftp-server but it si not supported now. I will prepare design for this action. It is not save change permissions for home directory after login becasue it can by different from /srv/ftp. Probably I ask user for this action in dialog. You can write me your idea about it. :) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=276462 al4321@gmail.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|al4321@gmail.com | ------- Comment #3 from al4321@gmail.com 2007-05-21 08:58 MST ------- Created an attachment (id=141273) --> (https://bugzilla.novell.com/attachment.cgi?id=141273&action=view) vsftpd.conf - vsftpd server configuration. (autogenerated by Yast FTP) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=276462 ------- Comment #4 from al4321@gmail.com 2007-05-21 09:49 MST ------- Well, you are correct, I have filesystem permission problems: opensuse103a4:/home/alexey # ll /srv/ total 0 drwxr-xr-x 2 root root 80 2007-05-19 21:31 ftp drwxr-xr-x 5 root root 120 2007-05-19 20:09 www That is: /srv/ftp is not allowed for writing. And yes: I think Yast-FTP server could ask the user to increase privileges at that point... "chmod -R a+rw ..." The drawback is that this will hurt the security model of openSUSE. =============================================================================== But I also have idea for completely different approach for managing file privileges: The AppArmor way. That is: Instead of running the FTP service as "ftp" user mode, we can run it in confined "root" mode. Since we are using AppArmor, it is not that risky. This will give us several advantages: -The files will be RO or RW depending on Yast FTP Server configuration, not on traditional user permissions. -traditional user permissions will stay as-is, so users can continue working like before locally, but this won't matter for FTP access anymore, because FTP server will run as root. -Via AppArmor's dynamic profiles *only* files that are needed to be shared, will be. Be it RW or RO. -AppArmor gives protection against zero-day attacks to the FTP server. New disadvantages: -AppArmor will not work with non-SUSE kernels. -Using AppArmor increases complexity. (of Yast-FTP server) Implementation details: -Yast FTP server must create AppArmor profile *dynamically*, that is, with every configuration changes, the apparmor-rules change must follow. This could be made modular: first-part is static, human-made (for FTP server itself) and second part will be dynamic (for files that FTP server serves), plus it must #include the first part it in. Dynamic part must allow the target directory to be accessible (such as /srv/ftp) in either RO or RW mode. -If AppArmor is disabled (due to non-AppArmored kernel or otherwise), FTP server must detect this and stop immediately, because otherwise we are risking security hole. Should I write it down as separate bugzilla feature-request? I have some basic experience writing AppArmor profiles. Novell guys have plenty of it :) As far as I can see the AppArmored FTP Server, despite being run with "root" user, has no-less security than traditional model with "ftp" user. =============================================================================== I don't believe about AppArmor only way because it's too new and experimental. I would like to see choice between the old-and-tested traditional UNIX security model and the new AppArmored model. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=276462 ------- Comment #5 from al4321@gmail.com 2007-05-26 03:20 MST ------- To solve the FTP-RW problem easily, we must make the Yast-FTP server configureble with which user it must run: say "tux", "ftp" or "root". So if you want your FTP server to be really RW, you should set your service to "root", which will give you the full access to those files. Yes, I know this is not exactly wise from security standpoint, but again, it should be configurable. (some people work with FTP on LAN, so I know all the people around me) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=276462 juhliarik@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED ------- Comment #6 from juhliarik@novell.com 2007-05-28 06:40 MST ------- You have good ideas but: - Using AppArmor with ftp-server is question for managers. Only they can do decision about using AppArmor. I will add your idea to our tool for features and we will see later. - Your next idea is little be danger :( Problem with permissions for home directory after login. If you change permissions for home directory (+w) after login you can see output 500 OOPS: vsftpd: refusing to run with writable anonymous root I tried to find some solution and result is: create subdirectory for uploading with permissions for uploading. for example: - home dir: /srv/ftp/ - subdirectory for uploading: /srv/ftp/upload/ ftp (anonymous) user has home dir /srv/ftp/ and subdirectory /srv/ftp/upload/ has permission for uploading. ftp user can upload to /srv/ftp/upload/ I know it is not perfect solution. Maybe later I will change it. The patch for this problem you will find in ftp-server version 2.15.5 If you have some hints about this bug you can write me mail or reopen this bug. have a nice day. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
participants (1)
-
bugzilla_noreply@novell.com