SFTP is changing the absolute path with mod_vroot

[willyamcts]

Hello,

in version 1.3.7a of proftpd the same problem reported in issue #20 occurs. I'am using mod_clamav, mod_vroot and mod_sftp. I opened a question in mod_clamav thinking that it was related to mod_clamav, but researching and doing the simple file upload test, it seems that it is mod_sftp changes the environment variable and passes mod_clamav the relative file path. If you want to see the case on mod_clamav: jbenden/mod_clamav#issue12.

occurs when is used VRootEngine only, which replaces the DefatulRoot directive.

in the log when uploading a file using sftp:

Wed Sep 16 07:42:13 2020 0 deb1   9   /eicar_com.zip   b _ i r user sftp 0 * c

in the log when uploading a file using FTP simple:

Wed Sep 16 07:49:38 2020 0 deb1   12   /home/ftp/eicar_com.zip   b _ i r user ftp 0 * c

mod_vroot in version 0.9.5

[jbenden]

Does #6 fix this problem for you?

[rzajac]

I'm experiencing the same issue with ProFTPd 1.3.7 and mod_vroot 0.9.5.

[willyamcts]

Does #6 fix this problem for you?

No with mod_clamav @jbenden.

But for modules mod_vroot + mod_exec + directive DefaultRoot ok

---

@Castaglia in the following commits after the pull of @rminsk the change was not included. To test I used the latest commit 46a4aab from version 0.9.4.

Even so in the log it returns the relative path in both variables:

2020-09-19 19: 20: 25,867 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/.', Fullpath = '/.'
2020-09-19 19: 20: 25,867 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/', fullpath = '/'
2020-09-19 19: 20: 25,868 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/ei.txt', fullpath = '/ei.txt'
2020-09-19 19: 20: 25,868 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/ei.txt', fullpath = '/test.com '
2020-09-19 19: 20: 25,868 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/ei.txt', fullpath = '/ei.txt'
2020-09-19 19: 20: 25,868 deb1 proftpd [14081] deb1 (10.1.1.1 [10.1.1.1]): in dir_check_full (): path = '/ei.txt', fullpath = '/ei.txt'

@Castaglia could you include the change in the current version?

ProFTPD in last release 1.3.7a

[Castaglia]

@willyamcts I believe that with #25, mod_vroot + mod_sftp uploads should work better. Can you try it out, let me know how it works in your scenario?

[Castaglia]

@willyamcts any luck/feedback on the above fix?

[willyamcts]

Hi @Castaglia, excusme o time for reply... Thanls for effort

Your correction #25 solve this problem. But I can't say if the fix is 100% because the paths are stored in rel_path and abs_path are not accurate, I don't know what consequences might exist.

Although the abs_path and rel_path variables are strange, malicious FTP and SFTP uploads are detected by clamav even using shortcuts. Check below "Test output".

Scenery

Compilation ProFTPd

• proftpd 1.3.7a
• mod_vroot (commit 2788b)
• mod_clamav (commit 1e555d3)

Test

I practically ran the same settings and tests reported in issue#12 of clamav. The settings are the same, I just changed mod_clamav.c a little to generate the variable outputs:

60a61
> char *abs_path;
217c218,222
<     pr_log_debug(DEBUG4, MOD_CLAMAV_VERSION ": Successfully reconnected to Clamd.");
---
> //    pr_log_debug(DEBUG4, MOD_CLAMAV_VERSION ": Successfully reconnected to Clamd.");
>
> pr_log_debug(DEBUG4, MOD_CLAMAV_VERSION ": Successfully reconnected to Clamd.\n\n vars = \
>  \n\t- pr_fs_getcwd(): %s \n\t- session.chroot_path: %s\n\t- abs_path: %s \n\n", pr_fs_getcwd(), session.chroot_path, abs_path);
>
441c446,448
<   char *abs_path = NULL, *rel_path = NULL;
---
> //  char *abs_path = NULL, *rel_path = NULL;
> abs_path = NULL;
> char *rel_path = NULL;
522a530
>
527a536,537
> pr_log_debug(DEBUG4, MOD_CLAMAV_VERSION ": VIA STREAM: \n\t* abs_path = %s \n\t* rel_path = %s \n\t* fh->fh_path=%s \n\t* buf=%s \n\t* pr_fs_getvwd()=%s\n\n", abs_path, rel_path, fh->fh_path, buf, pr_fs_getvwd());
>
584a595,597
>
> pr_log_debug(DEBUG4, MOD_CLAMAV_VERSION ": SEND VIA STREAM: clamavd_scan_stream(%s) - rel_path=%s.", abs_path, rel_path);

Test output

Directories and paths:

• The user's default directory is: /home/ftp/user
• The symbolic link is: /test.internal -> full path: /home/hostings/test.internal

FTP: send file to subdirectory

2021-08-01 12:38:39,654 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): passive data connection opened - local  : 192.168.52.200:50061
2021-08-01 12:38:39,654 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): passive data connection opened - remote : 192.168.52.100:54154
2021-08-01 12:38:39,657 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: VIA STREAM:
        * abs_path = /home/ftp/user/home/ftp/user/imgs/eicar_com.zip
        * rel_path = /home/ftp/user/imgs/eicar_com.zip
        * fh->fh_path=/home/ftp/user/imgs/eicar_com.zip
        * buf=/home/ftp/user
        * pr_fs_getvwd()=/imgs


2021-08-01 12:38:39,657 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): ROOT PRIVS at mod_clamav.c:377
2021-08-01 12:38:39,657 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): ROOT PRIVS: ID switching disabled
2021-08-01 12:38:39,658 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS at mod_clamav.c:435
2021-08-01 12:38:39,658 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS: ID switching disabled
2021-08-01 12:38:39,659 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Successfully reconnected to Clamd.

 vars =
        - pr_fs_getcwd(): /imgs
        - session.chroot_path: /
        - abs_path: /home/ftp/user/home/ftp/user/imgs/eicar_com.zip


2021-08-01 12:38:39,659 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Streaming 184 bytes (-1207959552, 4) to Clamd.
2021-08-01 12:38:39,667 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Virus 'Win.Test.EICAR_HDB-1' found in '/home/ftp/user/home/ftp/user/imgs/eicar_com.zip'
2021-08-01 12:38:39,667 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: SEND VIA STREAM: clamavd_scan_stream(/home/ftp/user/home/ftp/user/imgs/eicar_com.zip) - rel_path=/home/ftp/user/imgs/eicar_com.zip.
2021-08-01 12:38:39,667 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: No virus detected in filename = '/home/ftp/user/home/ftp/user/imgs/eicar_com.zip'.
2021-08-01 12:38:39,668 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'STOR eicar_com.zip' to mod_exec

FTP: send file to symbolic link

2021-08-01 12:40:38,963 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): passive data connection opened - local  : 192.168.52.200:50089
2021-08-01 12:40:38,963 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): passive data connection opened - remote : 192.168.52.100:49253
2021-08-01 12:40:38,965 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: VIA STREAM:
        * abs_path = /home/hostings/home/ftp/user/test.internal/eicar_com.zip
        * rel_path = /home/ftp/user/test.internal/eicar_com.zip
        * fh->fh_path=/home/ftp/user/test.internal/eicar_com.zip
        * buf=/home/hostings
        * pr_fs_getvwd()=/test.internal


2021-08-01 12:40:38,965 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Clamd did not accept PING (32): Broken pipe
2021-08-01 12:40:38,965 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): ROOT PRIVS at mod_clamav.c:377
2021-08-01 12:40:38,968 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS at mod_clamav.c:435
2021-08-01 12:40:38,968 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS: ID switching disabled
2021-08-01 12:40:38,968 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Successfully reconnected to Clamd.

 vars =
        - pr_fs_getcwd(): /test.internal
        - session.chroot_path: /
        - abs_path: /home/hostings/home/ftp/user/test.internal/eicar_com.zip


2021-08-01 12:40:38,968 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Streaming 184 bytes (-1207959552, 4) to Clamd.
2021-08-01 12:40:38,969 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Virus 'Win.Test.EICAR_HDB-1' found in '/home/hostings/home/ftp/user/test.internal/eicar_com.zip'
2021-08-01 12:40:38,969 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: SEND VIA STREAM: clamavd_scan_stream(/home/hostings/home/ftp/user/test.internal/eicar_com.zip) - rel_path=/home/ftp/user/test.internal/eicar_com.zip.
2021-08-01 12:40:38,969 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: No virus detected in filename = '/home/hostings/home/ftp/user/test.internal/eicar_com.zip'.
2021-08-01 12:40:38,970 deb1 proftpd[30839] deb1 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'STOR eicar_com.zip' to mod_exec

SFTP: send file to subdirectory

2021-08-01 12:43:46,977 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): path = '/home/ftp/user/imgs/eicar_com.zip', fullpath = '/home/ftp/user/imgs/eicar_com.zip'
2021-08-01 12:43:46,977 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): setting umask to 0003 (was 0003)
2021-08-01 12:43:46,977 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'OPEN /imgs/eicar_com.zip' to mod_exec
2021-08-01 12:43:46,977 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching LOG_CMD command 'OPEN /imgs/eicar_com.zip' to mod_log
2021-08-01 12:43:46,978 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): path = '/home/ftp/user/imgs/eicar_com.zip', fullpath = '/home/ftp/user/imgs/eicar_com.zip'
2021-08-01 12:43:46,978 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): setting umask to 0003 (was 0003)
2021-08-01 12:43:46,978 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'WRITE 97110dc2e24c6754 0 184' to mod_exec
2021-08-01 12:43:46,979 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching LOG_CMD command 'WRITE 97110dc2e24c6754 0 184' to mod_log
2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: VIA STREAM:
        * abs_path = /home/ftp/user/home/ftp/user/imgs/eicar_com.zip
        * rel_path = /home/ftp/user/imgs/eicar_com.zip
        * fh->fh_path=/home/ftp/user/imgs/eicar_com.zip
        * buf=/home/ftp/user
        * pr_fs_getvwd()=/


2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Clamd did not respond to fgets (2): No such file or directory
2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): ROOT PRIVS at mod_clamav.c:377
2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS at mod_clamav.c:435
2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS: ID switching disabled
2021-08-01 12:43:46,980 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Successfully reconnected to Clamd.

 vars =
        - pr_fs_getcwd(): /
        - session.chroot_path: /
        - abs_path: /home/ftp/user/home/ftp/user/imgs/eicar_com.zip


2021-08-01 12:43:46,981 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Streaming 184 bytes (-1207959552, 4) to Clamd.
2021-08-01 12:43:46,982 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Virus 'Win.Test.EICAR_HDB-1' found in '/home/ftp/user/home/ftp/user/imgs/eicar_com.zip'
2021-08-01 12:43:46,982 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: SEND VIA STREAM: clamavd_scan_stream(/home/ftp/user/home/ftp/user/imgs/eicar_com.zip) - rel_path=/home/ftp/user/imgs/eicar_com.zip.
2021-08-01 12:43:46,982 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: No virus detected in filename = '/home/ftp/user/home/ftp/user/imgs/eicar_com.zip'.
2021-08-01 12:43:46,982 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'STOR /home/ftp/user/imgs/eicar_com.zip' to mod_exec
2021-08-01 12:43:46,983 deb1 proftpd[32294] 0.0.0.0 (192.168.52.100[192.168.52.100]): REVOKE PRIVS at mod_exec.c:489

SFTP: send file to symbolic link

2021-08-01 12:45:08,223 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching PRE_CMD command 'STOR /test.internal/eicar_com.zip' to mod_vroot
2021-08-01 12:45:08,223 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching PRE_CMD command 'STOR /test.internal/eicar_com.zip' to mod_xfer
2021-08-01 12:45:08,223 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): path = '/home/ftp/user/test.internal/eicar_com.zip', fullpath = '/home/ftp/user/test.internal/eicar_com.zip'
2021-08-01 12:45:08,224 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): setting umask to 0003 (was 0003)
2021-08-01 12:45:08,224 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'OPEN /test.internal/eicar_com.zip' to mod_exec
2021-08-01 12:45:08,224 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching LOG_CMD command 'OPEN /test.internal/eicar_com.zip' to mod_log
2021-08-01 12:45:08,225 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): path = '/home/ftp/user/test.internal/eicar_com.zip', fullpath = '/home/ftp/user/test.internal/eicar_com.zip'
2021-08-01 12:45:08,226 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): in dir_check_full(): setting umask to 0003 (was 0003)
2021-08-01 12:45:08,226 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'WRITE 184084f59bbb5e1f 0 184' to mod_exec
2021-08-01 12:45:08,226 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching LOG_CMD command 'WRITE 184084f59bbb5e1f 0 184' to mod_log
2021-08-01 12:45:08,227 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: VIA STREAM:
        * abs_path = /home/ftp/user/home/ftp/user/test.internal/eicar_com.zip
        * rel_path = /home/ftp/user/test.internal/eicar_com.zip
        * fh->fh_path=/home/ftp/user/test.internal/eicar_com.zip
        * buf=/home/ftp/user
        * pr_fs_getvwd()=/


2021-08-01 12:45:08,227 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Clamd did not accept PING (32): Broken pipe
2021-08-01 12:45:08,227 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): ROOT PRIVS at mod_clamav.c:377
2021-08-01 12:45:08,227 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS at mod_clamav.c:435
2021-08-01 12:45:08,228 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): RELINQUISH PRIVS: ID switching disabled
2021-08-01 12:45:08,228 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Successfully reconnected to Clamd.

 vars =
        - pr_fs_getcwd(): /
        - session.chroot_path: /
        - abs_path: /home/ftp/user/home/ftp/user/test.internal/eicar_com.zip


2021-08-01 12:45:08,228 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Streaming 184 bytes (-1207959552, 4) to Clamd.
2021-08-01 12:45:08,229 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: Virus 'Win.Test.EICAR_HDB-1' found in '/home/ftp/user/home/ftp/user/test.internal/eicar_com.zip'
2021-08-01 12:45:08,229 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: SEND VIA STREAM: clamavd_scan_stream(/home/ftp/user/home/ftp/user/test.internal/eicar_com.zip) - rel_path=/home/ftp/user/test.internal/eicar_com.zip.
2021-08-01 12:45:08,229 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): mod_clamav/0.14rc2: No virus detected in filename = '/home/ftp/user/home/ftp/user/test.internal/eicar_com.zip'.
2021-08-01 12:45:08,229 deb1 proftpd[32012] 0.0.0.0 (192.168.52.100[192.168.52.100]): dispatching POST_CMD command 'STOR /home/ftp/user/test.internal/eicar_com.zip' to mod_exec
2021-08-01 12:45:08,230 deb1 proftpd[713] 0.0.0.0 (192.168.52.100[192.168.52.100]): REVOKE PRIVS at mod_exec.c:489

[Castaglia]

Thanks for the thorough testing! I'm considering this issue as fixed.