Hi Rui,

Are you trying to set up proftpd (with sftp) to use galaxy user credentials read from a postgresql database? Do you have the postgresql part working on regular ftp?

1- The proftpd version on ubuntu 16.04's repository works fine, you don't need to compile it yourself (unless you really want/have to). An apt install proftpd-basic proftpd-mod-pgsql would do it.

2- The user and group under which proftpd runs are defined in proftpd.conf. You didn't show that part of your file, but it's these two lines:
User                            proftpd
Group                           nogroup

3- I see you're missing:
#Before the <IfModule mod_sftp.c>
LoadModule      mod_sql_postgres.c
LoadModule      mod_sql_passwd.c

AuthPAM                         off

#Within the <IfModule mod_sftp.c>
TLSProtocol TLSv1

I suppose you can specify tls 1.1 or 1.2 here, but never really tried it.

In my setup I also commented out the AuthOrder line.

I guess these changes should do it.


Best,
Tiago






On 22-03-2017 08:29, Rui Wang wrote:
Hi Folks,

I'm trying to set up the ftp for the local galaxy instance. I got the regular ftp working, but not the sftp. After a few hours attempts, I'm wondering what I'm missing. Here is the related info:

1. Configure the build

install_user=bioinfoadmin install_group=bioinfoadmin ./configure --prefix=/media/libraryfiles/proftpd --enable-openssl --with-modules=mod_sql:mod_sql_postgres:mod_sql_passwd --with-modules=mod_sftp:mod_tls
make
make install

2. Start the server

sudo sbin/proftpd --config /media/libraryfiles/proftpd/etc/proftpd.conf -n -d 10

I notice that even though I start it using sudo, the real user that is running proftpd is 'nobody'.

3. Config file snippet, I inserted the following piece to the original config file, Add 'VirtualHost' or no doesn't change anything in result

<IfModule mod_sftp.c>

        SFTPEngine on
        Port 2222
        SFTPLog /var/log/proftpd/sftp.log
        AuthOrder mod_auth_unix.c mod_sql.c

        # Configure both the RSA and DSA host keys, using the same host key
        # files that OpenSSH uses.
        SFTPHostKey /etc/ssh/ssh_host_rsa_key
        SFTPHostKey /etc/ssh/ssh_host_dsa_key

        #SFTPAuthMethods publickey
        SFTPAuthMethods password

        # Enable compression
        SFTPCompression delayed

</IfModule>

Now when I start the server, and then when I try to test the login, I got this:

$ sftp -P 2222 localhost
packet_write_wait: Connection to 127.0.0.1 port 2222: Broken pipe
Couldn't read packet: Connection reset by peer

Accordingly, I got the following segfault in log:

2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65: ROOT PRIVS at main.c:1227
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65: RELINQUISH PRIVS at main.c:1231
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65: no matching vhost found for 127.0.0.1#2222, using 'ProFTPD Default Installation' listening on wildcard address
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): ROOT PRIVS at main.c:1034
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): SETUP PRIVS at main.c:1039
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): session requested from client in unknown class
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): performing module session initializations
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): mod_cap/1.1: adding CAP_SETUID and CAP_SETGID capabilities
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): ROOT PRIVS at mod_sftp.c:1674
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): RELINQUISH PRIVS at mod_sftp.c:1677
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): ROOT PRIVS at keys.c:2001
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): RELINQUISH PRIVS at keys.c:2008
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): ROOT PRIVS at keys.c:703
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): RELINQUISH PRIVS at keys.c:710
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): ROOT PRIVS at keys.c:703
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): RELINQUISH PRIVS at keys.c:710
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): ROOT PRIVS at keys.c:2001
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): RELINQUISH PRIVS at keys.c:2008
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): mod_sql/4.3: defaulting to 'postgres' backend
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): mod_ident/1.0: ident lookup disabled
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): ROOT PRIVS at mod_delay.c:1756
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): RELINQUISH PRIVS at mod_delay.c:1759
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): ROOT PRIVS at mod_auth.c:140
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): opening scoreboard '/media/libraryfiles/proftpd/var/proftpd.scoreboard'
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): RELINQUISH PRIVS at mod_auth.c:142
2017-03-22 00:51:14,786 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): AuthOrder in effect, resetting auth module order
2017-03-22 00:51:14,787 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): connected - local  : 127.0.0.1:2222
2017-03-22 00:51:14,787 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): connected - remote : 127.0.0.1:58014
2017-03-22 00:51:14,787 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): SSH2 session opened.
2017-03-22 00:51:14,787 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): dispatching LOG_CMD command 'KEXINIT' to mod_sql
2017-03-22 00:51:14,787 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): dispatching LOG_CMD command 'KEXINIT' to mod_log
2017-03-22 00:51:14,787 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): dispatching LOG_CMD command 'ECDH_INIT' to mod_sql
2017-03-22 00:51:14,787 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): dispatching LOG_CMD command 'ECDH_INIT' to mod_log
2017-03-22 00:51:14,789 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): ProFTPD terminating (signal 11)
2017-03-22 00:51:14,789 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): ProFTPD terminating (signal 11)
2017-03-22 00:51:14,789 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): mod_sftp/0.9.9: scrubbing 2 passphrases from memory
2017-03-22 00:51:14,789 cal-hsl-65 proftpd[56922] cal-hsl-65 (localhost[127.0.0.1]): SSH2 session closed.

Seems that it is connected in the middle...

And the /var/log/proftpd/sftp.log shows things like(many identical snippets, I just picked one randomly):

2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]: sent server version 'SSH-2.0-mod_sftp/0.9.9'
2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]: received client version 'SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.1'
2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]: handling connection from SSH2 client 'OpenSSH_7.2p2 Ubuntu-4ubuntu2.1'
2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]:  + Session key exchange: ecdh-sha2-nistp256
2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]:  + Session server hostkey: ssh-rsa
2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]:  + Session client-to-server encryption: aes128-ctr
2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]:  + Session server-to-client encryption: aes128-ctr
2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]:  + Session client-to-server MAC: umac-64@openssh.com
2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]:  + Session server-to-client MAC: umac-64@openssh.com
2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]:  + Session client-to-server compression: none
2017-03-22 01:16:06,753 mod_sftp/0.9.9[58288]:  + Session server-to-client compression: none

The version of proftpd is 1.3.5d on ubuntu 16.04.2. Not sure if anyone has seen this before. Any input will be greatly appreciated.

Thanks,
Rui


___________________________________________________________
Please keep all replies on the list by using "reply all"
in your mail client.  To manage your subscriptions to this
and other Galaxy lists, please use the interface at:
  https://lists.galaxyproject.org/

To search Galaxy mailing lists use the unified search at:
  http://galaxyproject.org/search/