Re: [gentoo-hardened] vsftpd problems

[David A. Cafaro]

James,

Sorry I didn't hear about this earlier (just recently joined this list), 
but did you still want to try to get this working?  I just recently got 
vsftpd up and running on 2.6.7-hardened-r4, I might be able to help. 
I've only been testing with anonymous uploads/downloads though.

-David

James R. Marcus wrote:

> I was unable to solve my problem with vsftpd and the 2.6
> Hardened-dev-sources. Last Thursday I rebuilt the machine and download a
> kernel from the NSA's site and it seems to be working now.
>
> I just wanted to say thanks to all the people who spent a considerable
> amount of time looking at this issue.
>
> Thanks,
> James
>
>
> -----Original Message-----
> From: Viljem Skornik [mailto:bluesman@××××××.no]
> Sent: Thursday, August 19, 2004 11:45 AM
> To: gentoo-hardened@l.g.o
> Subject: Re: [gentoo-hardened] vsftpd problems
>
> On Tuesday 17 of August 2004 19:02, James R. Marcus wrote:
>
>>I have been working with the gentlemen on the SELinux list to resolve
>
> my
>
>>issue with vsftpd.  I haven't really gotten anywhere despite a
>>tremendous effort on their part.
>>
>>I'm still getting the same error that I mentioned in my first email.
>>
>>I have added this line to
>>/etc/security/selinux/src/policy/domains/program/ftpd.te
>>domain_auto_trans(initrc_t, ftpd_exec_t, ftpd_t)
>>
>>ftp program # ls -Z /usr/sbin/vsftpd
>>-rwxr-xr-x  root root system_u:object_r:ftpd_exec_t /usr/sbin/vsftpd
>>ftp program #
>>
>>ftp program # ps -eZ | grep vsftpd
>>22497 system_u:system_r:initrc_t               /usr/sbin/vsftpd
>>/etc/vsftpd/vsftpd.conf
>>
>>/var/log/messages:
>>Aug 17 12:59:01 ftp avc:  denied  { getattr } for  pid=6483
>>exe=/bin/bash path=/usr/sbin/vsftpd dev=hda3 ino=438973
>>scontext=root:staff_r:staff_t tcontext=s
>>ystem_u:object_r:unlabeled_t tclass=file
>>
>>Any help would be appreciated,
>>Thanks,
>>James
>>
>>-----Original Message-----
>>From: James R. Marcus
>>Sent: Wednesday, July 07, 2004 7:34 PM
>>To: gentoo-hardened@l.g.o
>>Subject: [gentoo-hardened] vsftpd problems
>>
>>I just did my first install of hardened Gentoo with the SELiunx
>
> kernel.
>
>>I emerged vsftp and got it running.  However when I login I get this
>>message:
>>230 Login successful.
>>ftp> ls
>>500 OOPS: capset
>>200 PORT command successful. Consider using PASV.
>>500 OOPS: vsf_sysutil_recv_peek
>>Connection closed by remote host.
>>ftp>
>
>
> IIRC, this OOPS: capset looks like something I encountered some time
> ago.
> CHeck if you have Default Linux Capatibilites enabled in your kernel
> (CONFIG_SECURITY_CAPATIBILITIES), I believe that fixed my problem.
>
>
>>
>>Here is my vsftpd config:
>>ftp init.d # cat /etc/vsftpd/vsftpd.conf | grep -v '#'
>>
>>anonymous_enable=NO
>>local_enable=YES
>>write_enable=YES
>>dirmessage_enable=YES
>>connect_from_port_20=YES
>>xferlog_enable=YES
>>xferlog_file=/var/log/vsftpd/vsftpd.log
>>nopriv_user=nobody
>>background=YES
>>listen=YES
>>
>>xinetd.conf:
>>ftp init.d # cat  /etc/xinetd.conf | grep -v '#'
>>
>>
>>defaults
>>{
>>        instances      = 60
>>        log_type       = SYSLOG authpriv info
>>        log_on_success = HOST PID
>>        log_on_failure = HOST
>>        cps            = 25 30
>>}
>>
>>includedir /etc/xinetd.d
>>
>>Any recommendations on how to approach this issue would be great.
>>There is nothing in /var/log/messages
>>Thanks,
>>
>>James
>>
>>


--
gentoo-hardened@g.o mailing list