Issues with FTPS and Vaultpress

Hi Eric,

Thanks for your reply. Yes, done everything in the Vaultpress troubleshooting list, and there are no IPs listed in iptables at all.

Didn't think that a default Virtualmin installation would cause the problem, but thought I'd ask in case you or someone had seen this before.

Craig

Hi Eric,

It's just FTPS they're trying to connect to and having problems with.

Turns out the cause and solution is described on Stack Overflow. Waiting for Vaultpress to get back to me with a permanent solution that doesn't involve overriding ProFTPD's more secure default.

Craig

Hi again,

Just a further update on this issue for those who may be interested in the future. As mentioned in the link in my last update, this is caused by an issue in PHP FTP. There is an open PHP bug about the issue that was opened almost a year ago, and the developer at Vaultpress/Wordpress/Automattic that I have been in contact with added a new -- and the only -- comment on the issue two days ago as a result of my interaction with them.

As mentioned in the link in my last update, downgrading the default security in ProFTPD (which is also the default in vsftpd) allows Vaultpress to work. I was hoping that this would be a temporary security downgrade but, to quote Vaultpress support, "There is some discussion around us submitting a patch for this but, unfortunately, this is a low priority issue for us at this time. We are looking into possibly just patching this on our end. If that does happen, we will let you know. Otherwise, we are [at] the whim of the PHP community at this point for the most stable solution." (Emphasis mine.) I have strongly criticised Automattic in my reply about not patching this issue themselves or implementing a workaround (non-PHP if necessary), given that (a) Vaultpress is a paid service, (b) there are only (as far as I know, as I don't use Vaultpress myself) three or four connection options available (FTPS, SFTP, FTP and [I'm guessing possibly] rsync), and (c) that I've always assumed that Automattic is probably a significant contributor to the PHP codebase.

TL;DR: This will continue to be an issue for some time, one way or the other, requiring server administrators to lower their security for the foreseeable future if they want to interact with a PHP-based FTP service such as Vaultpress.

Craig

Hi Eric,

Thanks for your interest. The option, as detailed at Stack Overflow, is to set ...

... in the mod_tls configuration.

Yes, I suppose I could allow SFTP but, as I believe is documented in my other support tickets here, I find the revealing of the entire server's file system to unprivileged users (without significant effort to prevent that) to be a major issue. Others say it's not an issue, especially if all file permissions on several thousand OS files are flawlessly set, and others say that the FTP jail/chroot is not much of a deterrent to a skilled cracker anyway, and they're probably both right. But to me the SFTP option is a significant cosmetic issue that reveals far too much for my liking to curious users who are not otherwise inclined to try and break out of an FTP jail.

To be clear, I don't believe ProFTPD is the issue here; according to my reading, they (and vsftpd) seem to be doing FTPS right and in a secure fashion. It's PHP that is behind here, and Vaultpress (or at least the customer service "happiness engineer" drones rather than their "code wrangler" developer/programmer counterparts) are being very slow to realise that there is an issue here that they need to address with their own systems to use FTPS in a fully secure manner.

Craig

I should update this ticket with the resolution from a week or two ago.

To make a long story short, despite my earlier criticism of Automattic, they seem to have been the driving force behind getting this PHP bug addressed and fixed. So this is no longer an issue, and now FTPS works with PHP-based FTP(S) using the default ProFTPD configuration.

Craig