2

I need a FTP server on my machine, a Fedora 23. I want a simple setup, and I decided for ProFTPd and authentication with mod_auth_unix.c (this is just about my machine).

I installed ProFTPd and configured it. I had some problem in logging in from the local machine, and eventually I realized the problem was related to SeLinux (by simply tring to set it as Permissive).

I'm trying (and failing) to figure out how to change the SELinux configuration in order to add the permission I need. This is what I've done so far:

  1. From the Audit I got:

    denied  { dac_read_search } for
      pid=16049
      comm="proftpd"
      capability=2
      scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
      tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
      tclass=capability
      permissive=0
    
  2. According to this article I need to enable the ftp_home_dir and allow_ftpd_full_access booleans. I started by setting the first one, and obtaining a different situation:

    • Still failure to log, but no audit message
    • /var/log/secure says:

      proftpd[16070]: 127.0.0.1 (::1[::1]) - USER dave (Login failed): No such user found
      
  3. Apparently there's no allow_ftpd_full_access in my semanage boolean -l. I can enable it anyway, but without getting a different behaviour.

  4. None of the following not-always related booleans seem to work (tried all of them, just for good measure):

    sftpd_full_access
    ftpd_anon_write
    ftpd_connect_db
    ftpd_full_access
    ftpd_use_cifs
    sftpd_enable_homedirs
    ftpd_connect_all_unreserved
    sftpd_write_ssh_home
    ftpd_use_passive_mode
    sftpd_anon_write
    ftpd_use_nfs
    ftpd_use_fusefs
    

It must be a selinux problem because it works if I set it to permissive. Weirdly enough, however, the Audit log is not reporting SELinux activity.

I believe the FTP server is forbidden to access /etc/passwd or /etc/shadow.

Any hint or idea?

3

Answering my own question:

I was able to solve the problem by restoring the configuration of my /etc/proftpd.conf to

AuthOrder mod_auth_pam.c* mod_auth_unix.c

SELinux was configured by setting the following flags:

setsebool ftpd_full_access 1
setsebool ftp_home_dir 1

Apparently the problem was related with mod_auth_unix.c which is forbidden by SELinux to work, while mod_auth_pam.c can do it just fine. A case of PEBCAK.

The only think I cannot figure out at this point is why nothing was reported in /var/log/audit/audit.log: I'm positive that SELinux prevented the login, since I was able to login while in Permissive mode.

1

I believe the FTP server is forbidden to access /etc/passwd or /etc/shadow.

This is not true. From the AVC message, you see

tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023

which is some part of ftpd_t, not shadow or passwd (these files have different context, as you can see from ls -Z /etc/passwd).

It is not complete solution, but moving forward. You did all things according to the article? Also the groups settings?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.