From 721de88621100f6ed33f1602415bc249f3ed3219 Mon Sep 17 00:00:00 2001
From: Martin Sehnoutka <msehnout@redhat.com>
Date: Thu, 17 Nov 2016 10:22:32 +0100
Subject: [PATCH 19/59] Introduce reverse_lookup_enable option.
vsftpd can transform IP address into hostname before
PAM authentication. You can disable it to prevent
performance issues.
---
parseconf.c | 1 +
sysdeputil.c | 14 +++++++++-----
tunables.c | 2 ++
tunables.h | 1 +
vsftpd.conf.5 | 9 +++++++++
5 files changed, 22 insertions(+), 5 deletions(-)
diff --git a/parseconf.c b/parseconf.c
index 30df598..3e0dba4 100644
--- a/parseconf.c
+++ b/parseconf.c
@@ -91,6 +91,7 @@ parseconf_bool_array[] =
{ "mdtm_write", &tunable_mdtm_write },
{ "lock_upload_files", &tunable_lock_upload_files },
{ "pasv_addr_resolve", &tunable_pasv_addr_resolve },
+ { "reverse_lookup_enable", &tunable_reverse_lookup_enable },
{ "userlist_log", &tunable_userlist_log },
{ "debug_ssl", &tunable_debug_ssl },
{ "require_cert", &tunable_require_cert },
diff --git a/sysdeputil.c b/sysdeputil.c
index 3bbabaa..2063c87 100644
--- a/sysdeputil.c
+++ b/sysdeputil.c
@@ -354,12 +354,16 @@ vsf_sysdep_check_auth(struct mystr* p_user_str,
return 0;
}
#ifdef PAM_RHOST
- sin.sin_addr.s_addr = inet_addr(str_getbuf(p_remote_host));
- host = gethostbyaddr((char*)&sin.sin_addr.s_addr,sizeof(struct in_addr),AF_INET);
- if (host != (struct hostent*)0)
- retval = pam_set_item(s_pamh, PAM_RHOST, host->h_name);
- else
+ if (tunable_reverse_lookup_enable) {
+ sin.sin_addr.s_addr = inet_addr(str_getbuf(p_remote_host));
+ host = gethostbyaddr((char*)&sin.sin_addr.s_addr,sizeof(struct in_addr),AF_INET);
+ if (host != (struct hostent*)0)
+ retval = pam_set_item(s_pamh, PAM_RHOST, host->h_name);
+ else
+ retval = pam_set_item(s_pamh, PAM_RHOST, str_getbuf(p_remote_host));
+ } else {
retval = pam_set_item(s_pamh, PAM_RHOST, str_getbuf(p_remote_host));
+ }
if (retval != PAM_SUCCESS)
{
(void) pam_end(s_pamh, retval);
diff --git a/tunables.c b/tunables.c
index b30fca1..c737465 100644
--- a/tunables.c
+++ b/tunables.c
@@ -72,6 +72,7 @@ int tunable_force_anon_data_ssl;
int tunable_mdtm_write;
int tunable_lock_upload_files;
int tunable_pasv_addr_resolve;
+int tunable_reverse_lookup_enable;
int tunable_userlist_log;
int tunable_debug_ssl;
int tunable_require_cert;
@@ -213,6 +214,7 @@ tunables_load_defaults()
tunable_mdtm_write = 1;
tunable_lock_upload_files = 1;
tunable_pasv_addr_resolve = 0;
+ tunable_reverse_lookup_enable = 1;
tunable_userlist_log = 0;
tunable_debug_ssl = 0;
tunable_require_cert = 0;
diff --git a/tunables.h b/tunables.h
index e44d64c..9553038 100644
--- a/tunables.h
+++ b/tunables.h
@@ -73,6 +73,7 @@ extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */
extern int tunable_mdtm_write; /* Allow MDTM to set timestamps */
extern int tunable_lock_upload_files; /* Lock uploading files */
extern int tunable_pasv_addr_resolve; /* DNS resolve pasv_addr */
+extern int tunable_reverse_lookup_enable; /* Get hostname before pam auth */
extern int tunable_userlist_log; /* Log every failed login attempt */
extern int tunable_debug_ssl; /* Verbose SSL logging */
extern int tunable_require_cert; /* SSL client cert required */
diff --git a/vsftpd.conf.5 b/vsftpd.conf.5
index 72bb86f..fb6324e 100644
--- a/vsftpd.conf.5
+++ b/vsftpd.conf.5
@@ -423,6 +423,15 @@ so you may want to disable it. For a discussion of the consequences, see
http://scarybeastsecurity.blogspot.com/2009/02/vsftpd-210-released.html
(Added in v2.1.0).
+Default: YES
+.TP
+.B reverse_lookup_enable
+Set to YES if you want vsftpd to transform the ip address into the hostname,
+before pam authentication. This is useful if you use pam_access including the
+hostname. If you want vsftpd to run on the environment where the reverse lookup
+for some hostname is available and the name server doesn't respond for a while,
+you should set this to NO to avoid a performance issue.
+
Default: YES
.TP
.B run_as_launching_user
--
2.14.4