search

crazy-max / docker-pure-ftpd

Pure-FTPd Docker image based on Alpine Linux with MySQL, PostgreSQL and LDAP support
MIT License
54 stars 14 forks source link

ChrootEveryone does not seem to work #54

Open PreciousRoy0 opened 1 year ago

PreciousRoy0 commented 1 year ago

Behaviour

When logging in I have full access to the system files. even though in /etc/pure-ftpd.conf ChrootEveryone is set to yes

i was trying stuff out, if i delete everything in /etc/pure-ftpd.conf the server still starts fine. is this file being used?

Steps to reproduce this issue

  1. download the example https://github.com/crazy-max/docker-pure-ftpd/tree/master/examples/mariadb
  2. create an account docker-compose exec db mysql -u pureftpd -p'asupersecretpassword' -e "INSERT INTO users (User,Password,Uid,Gid,Dir) VALUES ('foo',ENCRYPT('test'),'1003','1005','/home/foo');" pureftpd
  3. login in with a ftp client in my case winscp

Expected behaviour

well i should not be able to see the system files.

Actual behaviour

i can see everything and navigate and download.

Configuration

Docker info

Client: Context: default Debug Mode: false Plugins: buildx: Docker Buildx (Docker Inc., v0.10.4) compose: Docker Compose (Docker Inc., v2.17.2) dev: Docker Dev Environments (Docker Inc., v0.1.0) extension: Manages Docker extensions (Docker Inc., v0.2.19) init: Creates Docker-related starter files for your project (Docker Inc., v0.1.0-beta.2) sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc., 0.6.0) scan: Docker Scan (Docker Inc., v0.25.0) scout: Command line tool for Docker Scout (Docker Inc., v0.9.0)

Server: Containers: 4 Running: 4 Paused: 0 Stopped: 0 Images: 5 Server Version: 20.10.24 Storage Driver: overlay2 Backing Filesystem: extfs Supports d_type: true Native Overlay Diff: true userxattr: false Logging Driver: json-file Cgroup Driver: cgroupfs Cgroup Version: 2 Plugins: Volume: local Network: bridge host ipvlan macvlan null overlay Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog Swarm: inactive Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc Default Runtime: runc Init Binary: docker-init containerd version: 2456e983eb9e37e47538f59ea18f2043c9a73640 runc version: v1.1.4-0-g5fd4c4d init version: de40ad0 Security Options: seccomp Profile: default cgroupns Kernel Version: 5.15.90.1-microsoft-standard-WSL2 Operating System: Docker Desktop OSType: linux Architecture: x86_64 CPUs: 32 Total Memory: 15.57GiB Name: docker-desktop ID: R23H:JWFG:UAWE:IGO5:KG2E:KKN5:F4UA:P677:OU4Y:SX47:BGKE:F2XV Docker Root Dir: /var/lib/docker Debug Mode: false HTTP Proxy: http.docker.internal:3128 HTTPS Proxy: http.docker.internal:3128 No Proxy: hubproxy.docker.internal Registry: https://index.docker.io/v1/ Labels: Experimental: false Insecure Registries: hubproxy.docker.internal:5555 127.0.0.0/8 Live Restore Enabled: false

Logs

2023-04-08 17:03:18 [s6-init] making user provided files available at /var/run/s6/etc...exited 0. 2023-04-08 17:03:18 [s6-init] ensuring user provided files have correct perms...exited 0. 2023-04-08 17:03:18 [fix-attrs.d] applying ownership & permissions fixes... 2023-04-08 17:03:18 [fix-attrs.d] done. 2023-04-08 17:03:18 [cont-init.d] executing container initialization scripts... 2023-04-08 17:03:18 [cont-init.d] 01-config.sh: executing... 2023-04-08 17:03:18 Setting timezone to Europe/Paris... 2023-04-08 17:03:18 Use MySQL authentication method 2023-04-08 17:03:18 Waiting 45s for MySQL database to be ready... 2023-04-08 17:03:32 MySQL database ready! 2023-04-08 17:03:32 Flags 2023-04-08 17:03:32 Secure: --maxclientsnumber 5 --maxclientsperip 5 --antiwarez --customerproof --dontresolve --norename --prohibitdotfilesread --prohibitdotfileswrite 2023-04-08 17:03:32 Additional: 2023-04-08 17:03:32 All: --bind 0.0.0.0,2100 --ipv4only --passiveportrange 30000:30009 --noanonymous --createhomedir --nochmod --syslogfacility ftp --forcepassiveip 83.83.84.207 --maxclientsnumber 5 --maxclientsperip 5 --antiwarez --customerproof --dontresolve --norename --prohibitdotfilesread --prohibitdotfileswrite --login mysql:/data/pureftpd-mysql.conf 2023-04-08 17:03:32 [cont-init.d] 01-config.sh: exited 0. 2023-04-08 17:03:32 [cont-init.d] 02-service.sh: executing... 2023-04-08 17:03:32 [cont-init.d] 02-service.sh: exited 0. 2023-04-08 17:03:32 [cont-init.d] 03-uploadscript.sh: executing... 2023-04-08 17:03:33 [cont-init.d] 03-uploadscript.sh: exited 0. 2023-04-08 17:03:33 [cont-init.d] ~-socklog: executing... 2023-04-08 17:03:33 [cont-init.d] ~-socklog: exited 0. 2023-04-08 17:03:33 [cont-init.d] done. 2023-04-08 17:03:33 [services.d] starting services 2023-04-08 17:03:33 [services.d] done. 2023-04-08 17:03:37 ftp.info: Apr 8 15:03:37 pure-ftpd: (?@172.26.0.1) [INFO] New connection from 172.26.0.1 2023-04-08 17:03:43 ftp.warn: Apr 8 15:03:43 pure-ftpd: (?@172.26.0.1) [WARNING] Authentication failed for user [banana] 2023-04-08 17:03:43 ftp.info: Apr 8 15:03:43 pure-ftpd: (?@172.26.0.1) [INFO] Logout. 2023-04-08 17:04:13 ftp.info: Apr 8 15:04:13 pure-ftpd: (?@172.26.0.1) [INFO] New connection from 172.26.0.1 2023-04-08 17:04:15 ftp.info: Apr 8 15:04:15 pure-ftpd: (?@172.26.0.1) [INFO] foo is now logged in``

5kr1p7 commented 1 month ago
  1. Add flag to startup: echo "--chrooteveryone" >> data/pureftpd.flags
  2. Apply changes: docker compose up -d or docker compose restart