forked from proftpd/proftpd
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathNEWS
3575 lines (3471 loc) · 194 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
-----------------------------------------------------------------------------
More details on the bugs listed below can be found by using the bug number
indicated in the following URL:
http://bugs.proftpd.org/show_bug.cgi?id=N
where `N' is the bug number.
If the issue listed below mentions "Issue" instead of "Bug", the number
there references a GitHub issue, which can be found using a URL like:
https://github.com/proftpd/proftpd/issues/N
where `N' is the issue number.
-----------------------------------------------------------------------------
1.3.9rc3
--------------------------------
- Issue 1785 - Bad handling of lack of extended attributes leads to SFTP out of
memory error.
- Issue 1780 - Using mod_facl and mod_vroot at same time causes unexpected
permissions issues.
- Issue 1529 - mod_sftp_sql logs "header value too long" due to unexpected key
header text.
- Issue 1792 - SFTP statvfs extension fails when mod_vroot is in use.
- Issue 1798 - Implement [email protected] SFTP extension.
- Issue 1806 - Implement SFTPAuthPublicKeys directive for configuring the list
of public key algorithms allowed for authentication.
- Issue 1819 - Stack trace changing to directory with DisplayChdir file using
%F variable on a large filesystem.
- Issue 1836 - Remove inherited supplemental groups when started with root
privileges.
- Issue 1839 - SSH ECDSA host key algorithms not being used as expected despite
configuring appropriate key.
- Issue 1840 - RADIUS Message-Authenticator verification failed with ProFTPD
mod_radius.
- Issue 1830 - Supplemental group inheritance grants unintended access to
GID 0 due to lack of supplemental groups from mod_sql.
1.3.9rc2 - Released 19-Dec-2023
--------------------------------
- Issue 1730 - 1.3.9rc1 mod_sftp fails to compile if EVP_chacha20 is
unavailable, as when using older OpenSSL versions.
- Issue 1746 - Error resolving DNS name for implicit "server config" vhost
leads to DelayTable not being found.
- Issue 1749 - Log message for exceeding quota does not include the
user/group/class quota type.
- Issue 1756 - Build system fails for specific module names.
- Issue 1760 - mod_sftp is affected by "Terrapin" Prefix Truncation Attacks in
SSH Specification (CVE-2023-48795).
- Issue 1770 - Using FTPS after upgrading from 1.3.8a to 1.3.8b leads to crash.
- Issue 1775 - Add support for logging SFTP ciphers/algorithms in SQL databases.
- Issue 1764 - Using mod_quotatab hard limits in combination with mod_vroot
causes inaccessible files.
1.3.9rc1 - Released 08-Oct-2023
--------------------------------
- Bug 4494 - mod_tls build fails for OpenSSL before 1.1.x.
- Issue 1570 - mod_sftp should advertise standard extensions for protocol
version 3.
- Issue 1569 - mod_sftp "check-file" extension uses wrong block size when
offset and length are specified.
- Issue 379 - Use JSON for Controls protocol messages.
- Issue 1114 - Provide richer exit status values for ftpdctl for better
scripting.
- Issue 1581 - mod_sftp fails to handle SFTP requests to truncate files to
zero size.
- Issue 1584 - mod_sftp improperly handles SFTP WRITE requests for files opened
for appending.
- Bug 4495 - Enforce requirement of preceding RewriteCondition for RewriteRule
directives to avoid confusion.
- Issue 1568 - Build-time detection of Linux POSIX ACL support broken since
1.3.8rc2.
- Issue 1590 - Unable to load mod_rewrite as a dynamic module due to
incomplete/missing library linker flags.
- Issue 1597 - <Class> section is allowed to be in <Global>, but From directive
is not.
- Issue 535 - Implement LogFormat variable for data transfer average speed.
- Issue 1596 - Optimize per-connection file I/O when reading SFTPHostKey from
disk.
- Issue 1610 - ProFTPD does not detect FIPS when using OpenSSL 3.x built with
FIPS support.
- Issue 1617 - ExtendedLog SSH, SFTP classes not working as expected.
- Issue 1623 - Reduce latency due to signal handling in the daemon process.
- Issue 1626 - SSH key exchange requests should be classifed into the "SEC"
ExtendedLog class.
- Issue 1630 - Update mod_exec to use the Jot API for resolving variables.
- Issue 1636 - Use system TCP backlog value by default.
- Issue 1639 - Gracefully handle directory creation requests when the directory
already exists.
- Issue 1646 - mod_sftp does not handle multiple concurrent open file
handles/transfers well for logging.
- Issue 1661 - Remove asynchronous FTP responses emitted while computing digest
values.
- Issue 1679 - "TLSRequired off" plus Protocols directive causes mod_tls to
terminate the session abruptly.
- Issue 1640 - Support terminating connection after USER command when TLS is
required.
- Issue 1676 - Support OPTS commands for querying configured policy for resumed
uploads, downloads.
- Issue 1686 - MaxStoreFileSize for single user not properly honored for SFTP
uploads.
- Issue 1689 - mod_tls fails to compile against OpenSSL 3.0.8 due to missing
ENGINE_METHOD_ flags.
- Issue 1688 - DisplayChdir using absolute path should work properly with
DefaultRoot.
- Issue 1659 - Unknown named connection error when using different SQL backends.
- Issue 1697 - mod_sql is not properly closing all named backend connections on
session exit.
- Issue 1700 - Clients should be disconnected when unable to be added to the
ScoreboardFile.
- Issue 1701 - Support injecting random delay when clients connect via
DelayOnEvent.
- Issue 1694 - SSH key exchanges fail unexpectedly with "unable to write X
bytes of raw data" errors due to small ProFTPD buffer.
- Issue 1118 - Support OpenSSH FIDO security keys in mod_sftp.
- Issue 1678 - High session memory usage caused by SFTP outgoing data buffering.
- Issue 1683 - Out-of-bounds buffer read when handling FTP commands.
- Issue 1716 - Support obtaining default UID/GID values for AD directories in
mod_ldap.
- Issue 1712 - SFTP algorithm settings in <Global> section not being used.
- Issue 1433 - Update upload progress in scoreboard when throttling.
- Issue 1721 - Null pointer reference encountered for FTPS connection due to
config parser ignoring Include file problem.
- Issue 456 - Support the [email protected] SSH cipher.
- Issue 1562 - mod_auth_otp should require per-user OTP entries by default.
1.3.8 - Released 04-Dec-2022
--------------------------------
- Issue 1488 - 1.3.8rc4 failing to build mod_sftp with OpenSSL 1.1.0 due to
X448 check.
- Issue 1494 - 1.3.8rc4 failing to build on Solaris due to missing type
declarations.
- Issue 1500 - mod_ifsession doesn't change the effect of SFTPMaxChannels.
- Issue 1533 - mod_tls module unexpectedly allows TLS handshake after
authentication in some configurations.
- Issue 1528 - Disable FSCachePolicy by default.
- Issue 1539 - Avoid logging "session closed" messages unless there is a
corresponding "session opened" log message, to avoid user confusion.
- Issue 1550 - Implement support for the CSID FTP command.
- Bug 4491 - unable to verify signed data: signature type 'rsa-sha2-512' does
not match publickey algorithm 'ssh-rsa'.
- Issue 1560 - mod_auth_otp improperly allows keyboard-interactive logins for
users lacking OTP entries.
1.3.8rc4 - Released 23-Jul-2022
--------------------------------
- Issue 1434 - mod_sftp should fail on startup when SFTP and TLS are both
enabled for a vhost.
- Issue 1440 - DelayTable not properly using documented default value. This
is a regression caused by the changes for Bug#4020.
- Issue 1444 - Support customizing SSH ciphers, digests, key exchanges via
SFTPClientMatch.
- Issue 1448 - Ensure that mod_sftp algorithms work properly with OpenSSL 3.x.
- Issue 1445 - BanOnEvent BadProtocol triggers segfault.
- Issue 1439 - SFTP "check-file" implementation computes incorrect results.
- Issue 1457 - Implement SFTPHostKeys directive for configuring the SSH host
key algorithms.
- Issue 1437 - Implement the "curve448-sha512" SSH key exchange algorithm.
- Issue 1472 - Include directive broken when using wildcards for directory
components.
- Bug 4485 - mod_sftp fails to build using OpenSSL 1.0.x: undefined reference
to `EVP_MD_CTX_reset'.
- Issue 1476 - Reload after omitting explicit ModulePath value causes fatal
module load failures.
1.3.8rc3 - Released 23-Apr-2022
--------------------------------
- Issue 1323 - Support SSH hostkey rotation via OpenSSH extensions.
- Issue 1325 - NLST does not behave consistently for relative paths.
- Bug 3759 - Support AES Galois Counter Mode (AES-GCM) in SSH. Support for
the "[email protected]" and "[email protected]" ciphers has been
added to mod_sftp.
- Issue 1333 - Implement an LDAPConnectTimeout directive, to configure the
timeout used when connecting to LDAP servers.
- Issue 1330 - Implement OpenSSH "Encrypt-Then-MAC" (ETM) algorithm extensions.
- Issue 1346 - Implement AllowForeignAddress class matching for passive data
transfers.
- Issue 1353 - Implement support for PCRE2.
- Bug 4466 - ProFTPD won't start with several locales.
- Issue 1367 - Auth sources providing space-bearing user/group names cause
compliance issues with MLSD/MLST responses.
- Bug 4467 - DeleteAbortedStores removes successfully transferred files
unexpectedly.
- Issue 1383 - Omit EPRT/EPSV from FEAT response when denied by <Limit>
configuration.
- Issue 1379 - Support uploading to symlinked files.
- Issue 1401 - Keepalive socket options should be set using IPPROTO_TCP, not
SOL_SOCKET.
- Issue 1402 - TCP keepalive SocketOptions should apply to control as well as
data connection.
- Issue 1396 - ProFTPD always uses the same PassivePorts port for first
transfer.
- Issue 1410 - mod_sftp needs to handle unknown SSH messages in an
RFC-compliant manner, ignoring rather than disconnecting.
- Issue 1418 - Improve handling of some globally applied configuration
directives.
- Issue 1369 - Name-based virtual hosts not working as expected after upgrade
from 1.3.7a to 1.3.7b.
1.3.8rc2 - Released 29-Aug-2021
--------------------------------
- Bug 4401 - mod_sftp crashes when handling aes256-ctr OpenSSH-specific key
with some old OpenSSL versions.
- Issue 1273 - Improve mod_tls log messages for unsupported older TLS protocol
requests.
- Issue 1284 - Fix memory disclosure to RADIUS servers by mod_radius.
- Issue 1282 - Properly handle <VirtualHost> sections that use interface/device
names.
- Bug 4315 - mod_ifsession fails to reset directory config lookup after
<Directory> section merges.
- Issue 1296 - Support <Limit> configurations for HELP command.
- Issue 1300 - PCRE expressions with capture groups are not being handled
properly.
- Issue 1307 - AuthUserFile permissions check fails during SIGHUP, causing
ProFTPD to stop.
- Issue 1286 - Add support for the libidn2 library, over libidn, for e.g.
mod_rewrite mappings.
- Bug 4443 - Changed the default behavior of mod_tls, such that TLS
renegotiations on control/data connections are not requested by default.
TLS renegotiations have a long and sordid history; many SSL/TLS libraries no
longer implement them, or disable them by default.
- Issue 1319 - mod_auth_otp should honor RequireTableEntry semantics for SFTP
logins.
1.3.8rc1 - Released 13-Jun-2021
--------------------------------
- Issue 1063 - FTPS data transfers using TLSv1.3 might segfault when session
tickets cannot be decrypted.
- Issue 1070 - Implement support for Redis 6.x AUTH semantics.
- Issue 1068 - Define an OpenSSL API version compatibility macro, currently
set to OpenSSL 1.0.0 and later.
- Bug 4405 - Memory use-after-free in mod_sftp causes unexpected
login/authentication issues.
- Bug 4402 - Inappropriate handling of aborted FTP data transfers causes issues
for some FTP clients.
- Issue 1084 - Implement support for configuring TLSv1.3 ciphersuites.
- Issue 1086 - Update TLSRenegotiate to work properly for TLSv1.3 sessions.
- Issue 1079 - prxs fails to detect module-specific configure/Makefile,
leading to unexpected module load errors.
- Issue 1074 - TLS SNI connections to name-based VirtualHosts with
TLSCertificateChainFile fail unexpectedly.
- Issue 1089 - Deprecate the MultilineRFC2228 directive.
- Issue 1067 - Generate new DH parameters for mod_tls, mod_sftp for 1.3.8.
- Issue 1101 - Update TLS minimum supported DH parameter size to 2048.
- Issue 811 - Support adding custom key/values to RedisLogOnCommand.
- Issue 1106 - TLS SNI can cause mod_quotatab to crash due to null pointer
dereferences.
- Issue 1076 - TLS client-initiated renegotiations are supported unexpectedly.
- Issue 1105 - Improper handling of multiple IP addresses, ServerAliases in
<VirtualHost> sections.
- Issue 1048 - Support using weak TLS certificates via the new AllowWeakSecurity
TLSOption.
- Issue 1149 - mod_quotatab_sql failing due to SQL syntax errors. This is a
regression caused by Issue #392.
- Issue 1061 - Freeing uninitialized memory causes SFTP issues with ed25519
keys.
- Issue 1111 - "Corrupted MAC on input" errors using SFTP [email protected]
digest.
- Issue 1171 - PassivePort randomization is broken due to SO_REUSEPORT option.
- Issue 1072 - Support configurable certificate settings in Redis SSL/TLS
connections.
- Issue 369 - Provide function for obtaining memory pool information as e.g.
JSON.
- Issue 1134 - AuthUserFile-based logins, directory listings are very slow due
to unbuffered reads.
- Issue 1193 - Improper checking for reused TLS session for data transfers
using OpenSSL 1.1.1.
- Issue 1168 - Improve error handling of OpenSSH host keys converted to PEM
format.
- Issue 1179 - TLSRSACertificateKeyFile sanity checks fail unexpectedly for
passphrase-protected keys.
- Issue 1174 - ftptop segfaults when using libncursesw on Gentoo.
- Issue 1204 - Once TLSTimeoutHandshake is reached, internal "timed out" flag
never reset.
- Issue 1133 - Support include files in mod_wrap2 allow/deny tables.
- Issue 1200 - Disconnect SFTP clients that request unsupportable protocol
versions.
- Issue 1207 - On Gentoo, "./configure --disable-ncurses" fails to link ftptop,
due to "undefined reference to symbol 'stdscr'" error.
- Issue 1212 - mod_sql_mysql needs to quote table names due to reserved MySQL
keywords.
- Issue 1175 - Unable to set per-user TLSOptions using mod_ifsession.
- Issue 754 - Some mod_snmp counters were not being incremented properly.
- Issue 548 - `make install` target should install only, not recompile any code.
- Bug 4428 - <VirtualHost> name resolution does not include all associated
IPv6 records.
- Issue 1230 - Stack overflow due to unlimited recursion possible when parsing
JSON text.
- Issue 1232 - Unable to use %{env:FTPS} in a SQLNamedQuery. The fix is to now
use %{note:FTPS} instead.
- Issue 1170 - Implement support for user/host combination bans in mod_ban.
- Issue 1246 - mod_sftp_sql crashes (sigsegv) on NULL key.
- Issue 1237 - ftpasswd should default to SHA256, not MD5.
- Issue 490 - Support syntax checks on AuthUserFiles, AuthGroupFiles on startup.
1.3.7 - Released 20-Jul-2020
--------------------------------
- Issue 1027 - mod_ldap crashes at ldap_mod_init().
- Issue 1038 - Support the SOURCE_DATE_EPOCH environment variable, for
reproducible builds.
- Issue 1043 - Invalid SCP command leads to null pointer dereference.
1.3.7rc4 - Released 30-May-2020
--------------------------------
- Bug 4376 - mod_sftp incorrectly handles SFTP protocol version 5/6
disposition flag.
- Issue 908 - mod_sql_passwd fails to compile on FreeBSD due to timingsafe_bcmp
function.
- Issue 907 - Implemented support for RSA SHA-2 publickey signatures in
mod_sftp, per RFC 8332.
- Issue 912 - Support logging of data transfer remote ports in ExtendedLog.
- Issue 317 - Implement pread(2), pwrite(2) FSIO API.
- Issue 857 - Fixed regression in the handling of `%{env:...}` configuration
variables when the environment variable is not present.
- Issue 940 - Second LIST of the same symlink shows different results.
- Bug 4394 - LogFormat %a gives local server IP address instead of remote
client IP address.
- Issue 946 - Improve handling of ldaps URLs, LDAPUseTLS directive in mod_ldap.
- Issue 82 - Support configurable certificate settings in LDAP SSL/TLS
connections.
- Issue 947 - Support use of SASL auth mechanisms for LDAPBindDN binds.
- Issue 954 - Support buggy/ill-behaved FTPS client shutdown behavior for CCC
command.
- Issue 959 - FTPS uploads using TLSv1.3 are likely to fail unexpectedly.
- Issue 682 - IPv6 addresses not properly parsed in From directives, causing
unexpected <IfClass> mismatches.
- Issue 964 - Unable to load mod_sftp, mod_sql_passwd as shared modules on
Alpine.
- Issue 968 - Require TLSv1.3 data connection sessions to reuse same session as
control connection for TLSv1.3 session tickets.
- Issue 366 - ftptop should support batch mode. ftptop now supports -b and -n
command-line options, like top(1).
- Issue 808 - ProFTPD should ignore supplemental groups when run as a non-root
user.
- Issue 980 - mod_sftp sends broken response when CREATETIME attribute is
requested.
- Bug 4390 - Implement keepalive support for mod_sql/database connections.
- Issue 693 - mod_sftp unsuccessful login count issues on AIX.
- Issue 984 - Do not send EXT_INFO messages to SSH clients which did not
signal "ext-info-c".
- Issue 983 - Use re-entrant versions of time functions where available.
- Bug 4398 - Handle zero-length SFTP WRITE requests without error.
- Bug 4185 - Implement options for tuning fields used in syslog/module logging.
- Issue 1010 - Allow ban entries to apply to all <VirtualHost> sections.
- Issue 1018 - PidFile should not be world-writable.
- Issue 1014 - TLSv1.3 handshake fails due to missing session ticket key on
some systems.
- Issue 1023 - Lowercased FTP commands not properly identified.
1.3.7rc3 - Released 20-Feb-2020
--------------------------------
- Issue 810 - mod_tls does not compile with LibreSSL 2.9.x.
- Issue 750 - MaxClientsPerUser not enforced for SFTP logins when mod_digest
enabled.
- Issue 850 - mod_tls should honor SNI in TLS handshake.
- Issue 692 - Support bcrypt passwords in mod_sql_passwd.
- Issue 793 - mod_sftp does not support OpenSSH-specific private key format.
- Bug 4221 - Add support for ssh-ed25519 keys.
- Issue 863 - Directory listing is slower compared to previous ProFTPD versions.
- Issue 859 - Improper handling of TLS CRL lookups.
- Bug 4340 - "SocketOptions keepalive off" does not disable TCP keepalive on
control connection.
- Issue 870 - Leaking PAM handler and data in case of unsuccessful
authentication.
- Bug 4385 - SSH authentication fails for many clients due to receiving of
SSH_MSG_IGNORE packet.
- Issue 872 - Show PathAllowFilter, PathDenyFilter failure in system logging.
Commands denied by these Filter directives are now logged at the NOTICE
level in the system logging.
- Bug 4382 - Incorrect %F SQLLog with SFTP, not FTP, uploads.
- Issue 882 - mod_sql "named connection already exists" error when using
name-based virtual hosts.
- Issue 890 - SFTP publickey authentication fails unexpectedly when user has
no shadow password info.
- Issue 898 - ftpasswd fails to restore password file permissions in some cases.
- Issue 903 - Use-after-free vulnerability in memory pools during data transfer.
- Issue 902 - Out-of-bounds read in mod_cap getstateflags() function. This
happens because of an out-of-date libcap version; we now rely solely on the
system-provided libcap library.
1.3.7rc2 - Released 19-Oct-2019
--------------------------------
- Issue 846 - Remote denial-of-service due to issue in network IO handling
(CVE-2019-18217).
1.3.7rc1 - Released 12-Oct-2019
--------------------------------
- Bug 4304 - Configure script wrongly detects AIX lastlog functions.
- Bug 3127 - ProFTPD does not build when configure is run from directory other
than source directory.
- Bug 4279 - Disable Blowfish, RC4, RIPE-MD160 SSH2 algorithms by default.
- Bug 4306 - AllowChrootSymlinks off could cause login failures depending on
filesystem permissions.
- Issue 269 - Disable building of mod_ident by default.
- Issue 501 - mod_ctrls: error: unable to bind to local socket: Address already
in use.
- Issue 507 - Failed to handle multiple %{env:...} variables in single word
in configuration.
- Issue 515 - Support %b variable for ExecEnviron directive.
- Issue 521 - Broken OCSP Stapling implementation fails to find issuing
certificate properly.
- Issue 518 - Provide option to disable sending of fake "tryLater" OCSP
response.
- Issue 519 - Improve handling of cached OCSP responses.
- Bug 4307 - High CPU load on CWD to non existing directory. This has been
addressed by improving the in-memory config tree DFS algorithm to
short-circuit recursive searching where possible.
- Issue 505 - Support MODE Z even for FTPS sessions.
- Issue 351 - Support FTP RANG command.
- Bug 4308 - mod_sftp fails to check shadow password information when publickey
authentication used.
- Bug 4309 - Use of "AllowEmptyPasswords off" breaks SFTP/SCP logins.
- Issue 534 - Support configuring multiple curves using TLSECDHCurve.
- Bug 4310 - Use of mod_facl as static module causes ProFTPD to die on
SIGHUP/restart.
- Bug 4311 - Directory creation in mod_site_misc, mod_copy does not honor
directory Umask.
- Issue 445 - Remove non-functional TransferPriority directive.
- Issue 550 - Support Redis SELECT for multiple databases.
- Issue 396 - Support for Redis Sentinel deployments in mod_redis.
- Issue 556 - Use of [email protected] SSH2 key exchange sometimes
fails.
- Issue 536 - Support TLSv1.3 (assuming OpenSSL support).
- Bug 4312 - Close extra file descriptors at startup.
- Bug 4314 - <Anonymous> with AuthAliasOnly in effect does not work as expected.
- Issue 568 - CreateHome NoRootPrivs only works partially.
- Bug 4313 - ExtendedLog incorrectly/unexpectedly logs unknown/unsupported
commands.
- Issue 578 - SFTP OPEN response includes attribute flags that are not actually
provided.
- Bug 4318 - Truncation of file while being downloaded with sendfile enabled
causes timeouts due to infinite loop.
- Bug 4320 - Confusing mod_sftp log message "disconnected by user (Application
error)" changed to "(Application disconnected)".
- Bug 4241 - RootRevoke should be on/true by default.
- Bug 4281 - Redesign support for Backend SQLAuthType for MySQL. If the MySQL
client library cannot support the SQLAuthType Backend, mod_sql_mysql will
emit a warning on startup.
- Bug 4319 - FTP uploads frequently break due to "Interrupted system call"
error.
- Issue 618 - Site-to-site transfers over TLS fail.
- Bug 4322 - Can't see symlinks using any FTP client when using MLSD.
- Issue 610 - Generate new DH parameters for mod_tls, mod_sftp for 1.3.7.
- Bug 4325 - mod_tls 1.3.6 fails to compile using OpenSSL 0.9.8e.
- Bug 4326 - Using MaxClientsPerHost 1 in <Anonymous> section denies logins.
- Issue 642 - SQLNamedConnectInfo with different backend database does not work
properly.
- Issue 654 - mod_sql_sqlite should error if configured SQLite database does
not exist.
- Issue 656 - Segfault with mod_sftp+mod_sftp_pam after successful
authentication using keyboard-interactive method
- Issue 660 - autoconf always fails to detect support for FIPS.
- Issue 663 - SFTP connections fail when using "arcfour256" cipher.
- Bug 4335 - mod_auth_otp fails to build with OpenSSL 1.1.x.
- Bug 4341 - scp broken on FreeBSD 11.
- Issue 676 - SQLLog for SCP: %{file-size} is not available.
- Issue 674 - Update mod_sftp to handle changed APIs in OpenSSL 1.1.x releases.
- Bug 4356 - Infinite loop possible in mod_sftp's set_sftphostkey() function.
- Bug 4352 - Some ASCII text files corrupted when downloading.
- Issue 797 - Properly use the --includedir, --libdir configure variables in
the generated proftpd.pc pkgconfig file.
- Bug 4350 - Reading invalid SSH key from database results in
unexpected/unlogged disconnect failures.
- Bug 4332 - Symlink navigation broken after 1.3.6 update. The changes for
Bug#4219 have been rolled back.
- Issue 795 - Unable to connect to ProFTPD using TLSSessionTickets and TLSv1.3.
- Bug 4372 - SITE CPFR/CPTO do not honor <Limit> configurations.
- Issue 807 - Using "TLSProtocol SSLv23" does not enable all protocol versions.
1.3.6 - Released 09-Apr-2017
--------------------------------
- Bug 4284 - SITE UTIME not working with group permissions.
- Bug 4289 - LDAPSearchScope does not alter search scope as expected. When
the LDAPServer directive is used with LDAP URLs, the LDAPSearchScope should
not be used; the handler was failing to handle this case properly.
- Bug 4285 - In AIX, log failed logins so that user accounts can be locked by
the OS after multiple failed login attempts.
- Added mod_wrap2_redis to the contrib/ modules directory.
- Bug 4295 - AllowChrootSymlinks off does not check entire DefaultRoot path
for symlinks (CVE-2017-7418).
- Bug 4299 - TimeoutLogin not working for SFTP connections.
1.3.6rc4 - Released 15-Jan-2017
--------------------------------
- Bug 4283 - All FTP logins treated as anonymous logins again. This is a
regression of Bug#3307.
1.3.6rc3 - Released 14-Jan-2017
--------------------------------
- Bug 4222 - Add support for [email protected] key exchange.
- Bug 4186 - ProFTPD creates name-based vhost when it should not.
- Bug 4233 - Support enforcing minimum key lengths for SFTP/SCP.
- Bug 4235 - Recursive SCP uploads of directories fail with "No such file or
directory".
- Bug 4154 - Support for scrypt in mod_sql_passwd. This also includes
support for Argon2, assuming use of libsodium-1.0.9 or later.
- Bug 4237 - Corrupted ASCII uploads. The refactoring work for Bug#4151 had
introduced a bug in the handling of ASCII uploads, now fixed.
- Bug 4220 - Support reading geoip filters from SQL databases.
- Bug 4242 - Using mod_memcache results in segfault (signal 11). Caused by
a bug in libmemcached-1.0.18 and earlier.
- Bug 4244 - Long-running sessions consume memory continuously.
- Bug 4248 - ALLO command failed unexpectedly.
- Bug 4247 - ProFTPD runs out of memory when listing very large directories
(e.g. over 400GB).
- Bug 4254 - SSH rekey during authentication can cause issues with clients.
- Bug 4257 - Recursive SCP uploads of multiple directories not handled properly.
- Bug 4252 - Clients sometimes receive extra 450 response on ABOR.
- Bug 4259 - LIST returns different results for file, depending on path syntax.
- Bug 4255 - "AuthAliasOnly on" in server config breaks anonymous logins.
- Bug 4240 - Support OpenSSL 1.1.x API.
- Bug 4262 - SITE CPTO returns 250 even when the copy operation fails due to
the user's quota being exceeded.
- Bug 4263 - SITE CPTO terminated by TimeoutIdle.
- Bug 4265 - Omit version information from ServerIdent banner by default.
- Bug 4264 - Support larger fixed DH groups in SSH key exchange.
- Bug 3849 - Allow wildcarded directory names in Include patterns.
- Bug 3662 - Allow SIZE command while in ASCII mode via build-time option.
- Bug 4272 - CapabilitiesEngine directive not honored for <IfUser>/<IfGroup>
sections.
- Bug 4267 - NLST should allow for sorted output. The ListOptions directive
now supports a SortedNLST flag for such use cases.
- Bug 4260 - Restarting server fails when using password-protected SSL
certificates and no TLSPassPhraseProvider.
- Bug 4216 - SSH rekeying causes invalid packet due to interrupting timer.
- Bug 4278 - Memory leak when mod_facl is used.
1.3.6rc2 - Released 10-Mar-2016
--------------------------------
- Bug 4187 - mod_geoip does not load all of the GeoIPTables properly.
- Bug 4167 - CR/LF characters are not supported in filenames.
- Bug 4188 - Support filtering based on country code and regional code in
mod_geoip.
- Bug 4151 - FTP ASCII mode conversion algorithm is painfully slow.
- Bug 4139 - Support rejecting empty passwords. See new AllowEmptyPasswords
directive.
- Bug 4189 - Support protocol exclusion via TLSProtocol directive.
- Bug 4153 - Support requiring multiple SSH authentication methods.
- Bug 4191 - "Incorrect string value" reported by mod_sql_mysql for some UTF8
characters.
- Bug 4097 - SSH rekey fails when using RSA hostkey smaller than 2048 bits.
- Bug 4198 - MLSD/MLST fact type "cdir" is incorrectly used for the current
working directory.
- Bug 4201 - HiddenStores temporary files not removed when exceeding quota
using SCP.
- Bug 4202 - MLSD lines not properly terminated with CRLF.
- Bug 4209 - Zero-length memory allocation possible, with undefined results.
- Bug 4210 - Avoid unbounded SFTP extended attribute key/values.
- Bug 4104 - Handle MasqueradeAddress resolution errors due to startup
sequencing.
- Bug 4056 - Support using JSON when storing ban information in memcached.
- Bug 4057 - Support using JSON when storing TLS session information in
memcached.
- Bug 4212 - Ensure that FTP data transfer commands fail appropriately when
"RootRevoke on" is in effect.
- Bug 4175 - Support for OCSP stapling.
- Bug 4176 - Support for TLS session tickets.
- Bug 4200 - Support TLS client configuration for SQL servers.
- Bug 4213 - Deprecate the NoCertRequest TLSOption.
- Bug 4214 - Allow UseEncoding to be set on a per-user basis.
- Bug 4217 - Handle FTP re-authentication attempts better.
- Bug 4218 - Support a LogFormat variable for logging command duration in
milliseconds.
- Bug 4223 - Permissions on files uploaded via STOU do not honor configured
Umask.
- Bug 4219 - Better handling of symlinks when chrooted.
- Bug 4224 - Prohibit FTP indexing by web crawlers via auto-generated
robots.txt.
- Added mod_auth_otp, mod_digest, mod_statcache to the contrib/ modules
directory.
- Bug 4227 - Support SFTP clients that send multiple INIT requests.
- Bug 4230 - TLSDHParamFile directive appears ignored because unexpected DH is
chosen.
1.3.6rc1 - Released 27-May-2015
--------------------------------
- Bug 4055 - "error setting listen fd IPV6_TCLASS: Protocol not available" log
message.
- Bug 3944 - Session closed if active data transfer fails due to "Address
already in use" error.
- Bug 3983 - Change default SyslogLevel to be NOTICE rather than DEBUG.
- Bug 3990 - Use 213 response code for STAT on a file. STAT on a directory
now results in a 212 response code as well, per RFC 959.
- Bug 4061 - SNMPAgent should support multiple addresses, including IPv6
addresses.
- Bug 4062 - Support PID variable in HiddenStores filename.
- Bug 4065 - mod_sftp should provide the SSH client banner as environment
variable, for logging.
- Bug 4067 - Create ExtendedLog class for SFTP requests.
- Bug 4068 - MaxClients directive doesn't work for <Anonymous> sessions.
- Bug 4069 - NLST -a shows / directory instead of the current directory.
- Bug 4063 - Unable to create directory on NFS/CIFS partition: Permission
denied.
- Bug 4073 - Polycom VOIP phones unable to use FTPS data transfers.
- Bug 4070 - Support wider range of causes of authentication failure.
- Bug 4077 - ShaperLog not closed/reopened on SIGHUP, causing log rotation
problems.
- Bug 4076 - Ability to disable mod_exec on a per-directory basis.
- Bug 4079 - Invalid response encoding for SFTP space-available request.
- Bug 4080 - mod_sftp does not implement SFTP LINK request properly.
- Bug 4083 - Using SQLDefaultHomedir with null home results in "No such user".
- Bug 4084 - "NLST *" returns files from subdirectories.
- Bug 4081 - Not possible to create relative symlinks with SFTP.
- Bug 4087 - mod_sftp does not handle "MaxLoginAttempts none" properly.
- Bug 4089 - mod_sftp does not allow multiple attempts using a given
authentication method.
- Bug 4090 - mod_wrap2_file does not support IPv6 addresses properly.
- Bug 4091 - Log "Operation not permitted" privs errors at NOTICE rather than
ERROR.
- Bug 4093 - Improve mod_sftp handling of missing packet payloads.
- Bug 4050 - Use of PIPE_BUF causes build failure on platforms without it.
- Bug 4020 - Add minimum delay options to mod_delay functionality.
- Bug 4030 - Cache negative/failed Auth API name/ID lookups.
- Bug 4094 - Available space on file system using %f displays wrong value.
- Bug 4012 - Failure to build mod_tls when using static libcrypto due to libdl
linker errors.
- Bug 4098 - mod_sftp unable to use SFTPHostKey due to being group readable in
CentOS 7.
- Bug 4108 - SSL handshakes for data connections sometimes stall for 3-30
seconds.
- Bug 4109 - setsockopt() call for IPV6_TCLASS should use IPPROTO_IPV6.
- Bug 4110 - proftpd on Solaris should use /dev/conslog instead of /dev/log.
- Bug 4114 - mod_tls should not support SSLv3 by default.
- Bug 4112 - Failure to connect using mod_sftp sometimes due to too-small
buffers.
- Bug 4035 - HiddenStores file not renamed every time.
- Bug 4116 - Report exact SSL/TLS protocol version used in client connections.
- Bug 4124 - DeleteAbortedStores defaults to "on" for all transfers, not just
HiddenStores.
- Bug 4129 - mod_sql caches incorrect UID/GID when name cannot be retrieved.
- Bug 4130 - Support the 3-timestamp form of SITE UTIME.
- Bug 4131 - mod_sftp's autoconf script does not detect OpenSSL SHA2 support.
- Bug 4058 - Create a 'timing' trace channel, for timing-related data.
- Bug 4125 - mod_lang should provide way to reject illegally-encoded filenames.
- Bug 4060 - Support unsorted LIST entries (-U) to decrease memory/CPU usage
for large directory listings.
- Bug 4133 - LDAPUsers directive does not honor uid-number-filter-template
parameter.
- Bug 4137 - GeoIPDenyFilter incorrectly takes precedence over GeoIPAllowFilter.
- Bug 4138 - Support for hex-encoded salts in mod_sql_passwd.
- Bug 4140 - SFTP READLINK requests to symlinks to directories fail.
- Bug 4143 - HTTPS/FTPS protocol confusion leads to XSS.
- Bug 4144 - Support APPE when HiddenStores are enabled.
- Bug 4031 - Support JSON output format for ftpwho.
- Bug 4145 - Segfault if AuthUserFile is a relative symlink.
- Bug 4152 - Reduce logging of non-fatal "unable to open incoming connection"
errors.
- Bug 4155 - SSH keys with too-long Comment headers aren't recognized by
mod_sftp_sql.
- Bug 4159 - Support ability to disable ASCII translation transparently to FTP
clients.
- Bug 4156 - Segfault handling LIST/NLST FTP command on Mac OS X.
- Bug 4160 - Malformed response to SSH_FXP_REALPATH with SFTP version 6.
- Bug 4163 - Remove support for EXPORT grade ciphers.
- Bug 4164 - mod_sql fails to read UID/GID values larger than 32 bits from SQL
tables.
- Bug 4157 - LIST/NLST of 1000s of files is slow on some platforms.
- Bug 4059 - Implement additional RADIUS attributes.
- Bug 4166 - mod_sftp sessions consume large amounts of memory due to rekeying.
- Bug 4169 - Unauthenticated copying of files via SITE CPFR/CPTO allowed by
mod_copy.
- Bug 4170 - Incorrect handling of control-byte field of SSH_FXP_REALPATH as
bitmask rather than enumeration for SFTP protocol version 6.
- Bug 4168 - Race condition with HiddenStores and TimeoutIdle timeout, causing
hidden file not to be cleaned up properly.
- Bug 3125 - Support for Mac OS X implementation of POSIX ACLs.
- Bug 4174 - Support for TLS-PSK (pre-shared keys).
- Bug 4178 - TLS session reuse requirement for data connections not properly
enforced.
- Bug 4184 - Remove support for "weak" Diffie-Hellman groups.
- Bug 3289 - Support the HOST command.
1.3.5 - Released 15-May-2014
--------------------------------
- Bug 4018 - Implement checks for sensitive directories when chrooted.
- Bug 4022 - "Directory not empty" error when creating directory is misleading.
- Bug 4025 - <IfClass> sections do not work for multiple SQLLog directives.
- Bug 4029 - TLSOptions EnableDiags logs "unknown version (771)" for
TLS 1.1/1.2 connections.
- Bug 3938 - mod_wrap2 uses reverse DNS regardless "UseReverseDNS off".
- Bug 4032 - Restarting proftpd with mod_sftp fails due to permissions on
SFTPHostKey file.
- Bug 4033 - mod_sftp fails to create SSH2 session using 'none' cipher.
- Bug 4034 - SSH publickey authentication fails with "MaxLoginAttempts 1".
- Bug 4024 - TLS 1.1/1.2 configurable, but not properly implemented.
- Bug 4046 - ALLO command failed because of bad size check.
- Bug 4048 - Race condition in mod_ban can lead to segfault of all new
connections.
- Bug 4049 - mod_exec should include supplemental groups when running commands
as logged-in user.
- Bug 4042 - MIC command between RNFR and RNTO should not be rejected.
- Bug 4044 - mod_facl prevents a normal SIGHUP reload.
- Bug 4052 - Enhance SQLPasswordPBKDF2 to support per-user query for settings.
1.3.5rc4 - Released 28-Jan-2014
--------------------------------
- Bug 3945 - Spurious log messages at session close.
- Bug 3946 - Null pointer dereference causes segfault when logging
%{transfer-status}, %{transfer-failure} LogFormat variables on EXIT.
- Bug 3947 - LogFormat %f variable not resolved properly for SFTP renames.
- Bug 3950 - LogFormat %d/%D variables not resolved properly for directory
listings.
- Bug 3949 - RNFR/RNTO not logged as expected for SFTP EXTENDED
[email protected] requests.
- Bug 3948 - Support FTP response codes in ExtendedLog for SFTP data transfers.
- Bug 3858 - mod_delay allows too-large values, leading to client hang on
authentication.
- Bug 3951 - Null pointer dereference for mod_ldap logins when
LDAPDefaultAuthScheme not configured.
- Bug 3954 - scp downloads result in segfault.
- Bug 3957 - ProFTPD configuration with thousands of <Directory>/<Limit>
sections leads to slow logins.
- Bug 3959 - mod_sftp does not honor <Directory>/<Limit> sections when symlinks
are involved.
- Bug 3958 - Directory creation does not honor single-parameter Umask setting.
- Bug 3960 - Support the CAP_FSETID Linux capability, for preserving directory
SGID bit.
- Bug 3962 - Directory creation fails (chmod(2) EPERM) when root privs are used
in some cases.
- Bug 3955 - Support secure FXP (site-to-site) transfers using SSCN.
- Bug 3966 - LogFormat %f variable not resolved for some commands.
- Bug 3971 - Support SQLOption for ignoring client library config files when
needed.
- Bug 3972 - Authentication error on Cygwin due to bad code.
- Bug 3973 - mod_sftp can be forced to allocate too much memory for
keyboard-interactive authentication.
- Bug 3974 - PathDenyFilter directive does not work as expected for SFTP
sessions.
- Bug 3963 - Improve permission setting when creating directories.
- Bug 3975 - Error printed to stderr when loading GeoIP Lite country database
using IndexCache flag.
- Bug 3976 - ProFTPD terminating (signal 11) crash for GeoLiteCity-20130903
database lookup.
- Bug 3964 - Support running ExecOnEvent actions with logged-in user's
permissions.
- Bug 3979 - mod_sql_odbc compiler warnings on 64-bit systems using unixODBC.
- Bug 3952 - Make PersistentPasswd default to 'off'.
- Bug 3981 - Null pointer dereference in mod_exec with ExecOption useStdin.
- Bug 3982 - Normalize log messages and levels.
- Bug 3888 - Add LDAPLog directive to mod_ldap.
- Bug 3986 - Support filesystems which do not support chmod(2)/chown(2),
e.g. FAT/ExFAT.
- Bug 3991 - SSL session caching modules use incorrect OpenSSL cache mode flags,
breaking session caching.
- Bug 3987 - LogFormat variable for just the filename.
- Bug 3965 - Timeout directives have inconsistent maximum values.
- Bug 3998 - Support IgnoreSCPUploadTimes SFTPOption.
- Bug 3995 - ftpasswd utility should prevent concurrent modification of files.
- Bug 3994 - ftpasswd utility should support --lock/--unlock options.
- Bug 3970 - ProFTPD should not use fd 2 (stderr) for files.
- Bug 3772 - Support Elliptic Curve Cryptography (ECC) certs for
FTPS connections.
- Bug 3992 - RSA signature issue when connecting using PuTTY/WinSCP.
- Bug 3996 - Handling ALLO command can result in wrong response when chrooted.
- Bug 3876 - ExecOnEvent should be configurable per <VirtualHost>/<Global>.
- Bug 4001 - mod_sftp fails key exchange for 8192-bit DH group.
- Bug 4002 - Add 7680-bit DH parameter to mod_sftp bundled dhparams.pem file.
A 3072-bit DH group was also added.
- Bug 4004 - IgnoreSCPUploadPerms SFTPOption not honored properly for SCP
directory upload.
- Bug 4006 - RADIUS "service-type" attribute encoded with wrong length on
64-bit system.
- Bug 4011 - NLST ../ shows current directory contents rather than parent
directory.
- Bug 4013 - SCP upload of shorter file does not completely overwrite existing
file of same name.
- Bug 4014 - CommandBufferSize should override PR_DEFAULT_CMD_BUFSZ.
1.3.5rc3 - Released 14-Jun-2013
--------------------------------
- Bug 3910 - Clang's scan-build warns on set[u][g]id unchecked return value.
- Bug 3914 - 1.3.5rc2 fails to build on Solaris 10.
- Bug 3917 - Make DeleteAbortedStores on by default when HiddenStores enabled.
- Bug 3918 - mod_sftp segfault after SIGHUP when evaluating client banner.
- Bug 3864 - Support SQL query to lookup/use primary key for logged-in
user/group.
- Bug 3920 - Support [email protected] digest for mod_sftp.
- Bug 3921 - Single failed keyboard-interactive login attempt causes SSH
connection to close prematurely.
- Bug 3923 - mod_cap does not revoke root privileges properly for SFTP
connections.
- Bug 3926 - Support OpenSSH fsync SFTP extension.
- Bug 3925 - SFTP directory listings are sensitive to locale environment
variables.
- Bug 3924 - HideFiles does not filter symlinks.
- Bug 3929 - pam_session_close() requires root privs on some platforms.
- Bug 3932 - SQLAuthType Backend returns "password mismatch" for MySQL
PASSWORD().
- Bug 3934 - HideUser/HideGroup do not work as expected for virtual users.
- Bug 3935 - scp download of nonexistent file results in client hang.
- Bug 3927 - Default ControlsSocket created despite custom ControlsSocket path.
- Bug 3937 - Segfault when retrieving SSH public key from LDAP directory.
- Added new mod_snmp contrib module.
- Bug 3939 - Disable Controls for "ServerType inetd" servers.
- Bug 3942 - mod_sftp_sql should support multiple keys concatenated together
in a single column.
- Bug 3943 - Support for PBKDF2 passwords in mod_sql_passwd.
- Bug 3941 - RLimitProcesses causes problems with setuid/setreuid.
1.3.5rc2 - Released 06-Mar-2013
--------------------------------
- Bug 3859 - MLSD fails to show symlinks when ShowSymlinks is not configured.
- Bug 3860 - Add a default deny option for mod_geoip.
- Bug 3862 - Support for FTPS-specific MasqueradeAddress functionality. A
new TLSMasqueradeAddress directive has been added to mod_tls.
- Bug 3863 - mod_sftp does not handle MaxLoginAttempts properly.
- Bug 3865 - BanEngine not set in "server config" results in "mod_ban not
enabled" ftpdctl error.
- Bug 3866 - Issuing invalid 'ftpdctl ban' request causes segfault.
- Bug 3867 - ftpasswd fails with "Permission denied" when adding subsequent
passwd/group entries.
- Bug 3868 - Only first DH param in TLSDHParamFile is used, regardless of
requested keylength.
- Bug 3870 - Handling of OPTS command can lead to crash.
- Bug 3779 - Generate new DH parameters for mod_tls and mod_sftp.
- Bug 3871 - REALPATH SFTP request not properly handled by <Limit DIRS>
configuration.
- Bug 3872 - Use HiddenStores directive to customise suffix.
- Bug 3873 - Provide FTP response code in ExtendedLog for failed SFTP REMOVE
request.
- Bug 3869 - Use longer SSL session cache expiration by default.
- Bug 3874 - Use of O_EXCL flag on HiddenStores files might break for NFS
filesystems.
- Bug 3878 - QuotaExcludeFilter not honored for uploads when 'hard' limits are
used.
- Bug 3879 - Allow additional columns in SQLNamedQuery queries used for quota
limits and tallies.
- Bug 3882 - DisplayLogin with an absolute path does not work properly within
an <IfGroup> section.
- Added new mod_log_forensic contrib module.
- Bug 3881 - <Directory> sections within <IfGroup> sections not applied as
expected.
- Bug 3884 - Configure script not detecting MySQL make_scrambled_password
functions.
- Bug 3887 - <Limit ALL> erroneously blocks the PROT command used for FTPS.
- Bug 3819 - Second and subsequent LIST of directory with many files is very
slow.
- Bug 3889 - Support millisecond timestamp LogFormat variable.
- Bug 3891 - Allow TLSProtocol directive in <VirtualHost> and <Global> sections.
- Bug 3753 - Support SFTP request names in <Limit> sections better.
- Bug 3892 - mod_auth_file should have strict permission checks of configured
files.
- Bug 3893 - Add SQLLogOnEvent directive, for performing SQL query on
configurable event.
- Bug 3894 - ftptop doesn't work with --enable-nls.
- Bug 3895 - Missing TransferLog entry under some out-of-space conditions.
- Bug 3897 - mod_sftp does not handle a REALPATH request properly for SFTP
protocol version 6.
- Bug 3896 - Warn when world-writable config files are used.
- Bug 3899 - Support authentication of users based on SSL/TLS client
certificate.
- Bug 3903 - With mod_log_forensic enabled, SSH connections fail randomly.
- Bug 3905 - Handle the Linux-specific PAM_RADIO_TYPE message properly.
- Bug 3709 - Support download-triggered emails in the ftpmail script.
- Bug 3904 - scp downloads using glob pattern sometimes fails.
- Bug 3900 - ProFTPD terminating (signal 11) on some sftp connections.
- Bug 3906 - Support ban rule for clients which perform SSL/TLS handshakes too
frequently.
1.3.5rc1 - Released 04-Jan-2013
--------------------------------
- Bug 3712 - mod_wrap2/mod_load build errors: missing config.h.
- Bug 3713 - mod_tls cannot be compiled using Openssl 0.9.6.
- Bug 3646 - Debug logging to stderr should include timestamps and PID.
- Bug 3714 - ftpwho/ftptop are not showing command arguments (e.g. downloaded
file name).
- Bug 3715 - MLSD/MLST fail when "DirFakeUser off" or "DirFakeGroup off" used.
- Bug 3717 - proftpd fails to run with "Abort trap" error message.
- Bug 3719 - LIST -R can loop endlessly if bad directory symlink exists.
- Bug 3720 - Various module logfile permissions are 0600 instead of 0640.
- Bug 3723 - mod_memcache segfault on server restart.
- Bug 3721 - mod_rewrite does not replace characters if there are more than
8 occurrences. To handle this situation, a new RewriteMaxReplace directive
has been added for configuring this limit.
- Bug 3724 - Unloading mod_quotatab causes segfault.
- Bug 3686 - Support SHA2 digests in mod_sftp. See the SFTPDigests directive
documentation for more information.
- Bug 3629 - Support <IfAuthenticated> conditional config section.
- Bug 3682 - Configure does not detect libiconv under Gentoo FreeBSD.
- Bug 3726 - mod_exec does not always capture stdout/stderr output from
executed command.
- Bug 3727 - mod_wrap2 causes unexpected LogFormat %u expansion for SFTP
connections.
- Bug 3729 - mod_ldap can segfault when LDAPUsers is used with no optional
filters.
- Bug 3728 - Build failure in wtmp.c on Gentoo/FreeBSD on sparc.
- Bug 3734 - DirFakeUser/DirFakeGroup off with name causes SIGSEGV for
MLSD/MLST commands.
- Bug 3739 - Allow for configurable SSH version identifiers in mod_sftp. The
SSH version identifier can now be configured for mod_sftp via the
ServerIdent directive.
- Bug 3718 - ftptop fails to build on OpenSUSE.
- Bug 3699 - ProFTPD crash on start up on Mac OSX Lion with NLS enabled.
- Bug 3744 - Support ls(1) -1 option for LIST command.
- Bug 3746 - Support applying ListOptions only to NLST or to LIST commands.
- Bug 3747 - Support option for displaying symlinks via MLSD using syntax
preferred by FileZilla. The new FactsOptions directive can be used for
this purpose.
- Bug 3745 - Reject PASV command if no IPv4 address available.
- Bug 3701 - Modify ScoreboardFile directive to support disabling scoreboarding.
- Bug 3742 - Improper handling of self-signed certificate in client-sent cert
list when "TLSVerifyClient on" is used.
- Bug 3749 - Compile of src/netacl.c fails on Tru64 UNIX (OSF/1) due to
conflict with system header.
- Bug 3743 - Random stalls/segfaults seen when transferring large files
via SFTP.
- Bug 3752 - proftpd process exit status is zero for "Failed binding to
address, port N: Address already in use" startup failure.
- Bug 3751 - mod_ban does not close/reopen the BanLog/BanTable file descriptors
on restart, causing a file descriptor leak.
- Bug 3707 - Add request/transfer ID to the logging of the initial and closing
commands for SFTP file transfers. This can now be accomplished using a
LogFormat variable of '%{note:sftp.file-handle}'.
- Bug 3757 - Support SFTPOption for ignoring requests to modify file ownership.
- Bug 3756 - mod_ctrls no longer listens on ControlsSocket after restart.
- Bug 3731 - Support active data transfers while RootRevoke is in effect.
- Bug 3737 - Allow UTF8 when UseEncoding is used.
- Bug 3573 - Support Elliptic Curve Cryptography (ECC) in SSH.
- Bug 3758 - ProFTPD crashes when handling mod_gss authentication due to null
pointer.
- Ability to load SSH host keys from an SSH agent, in addition to files on
disk. See doc/contrib/mod_sftp.html#SFTPHostKey for more information.
- Bug 3761 - SSH2 key exchange fails if client sends certain SSH message before
NEWKEYS.
- Bug 3763 - Ensure that mod_sftp operates properly when OpenSSL FIPS mode is
enabled.
- Bug 3764 - mod_sftp does not correctly handle a 'guess' KEX message when the
client guesses correctly.
- Bug 3765 - mod_sftp should honor the GroupOwner directive for MKDIR requests.
- Bug 3626 - Display variable %f off by a factor of 1024 on 64-bit platforms.
- Bug 3673 - Support date/timestamp variables in mod_rewrite.
- Bug 3754 - ProFTPD refuses to delete/rename a symlink pointing outside a
writable directory.
- Bug 3766 - Support a QuotaDefault directive, for configuring default limits.
- Bug 3767 - mod_rewrite segfault when handling SITE CHGRP without a parameter.
- Bug 3768 - ExecTimeout 0 (zero) not treated as infinite.
- Added new mod_geoip contrib module.
- Bug 3769 - Ensure that encoded strings are NUL-terminated.
- Bug 3732 - AIX build error: undefined symbol: .alloca.
- Bug 3782 - SQLShowInfo does not work properly for error responses.
- Bug 3780 - AIX gives "error setting listen fd IP_TOS: Invalid argument".
- Bug 3736 - Trying to re-authenticate an existing FTP connection causes invalid
503 response.
- Bug 3785 - Support resolution of tilde (~) within a chrooted session.
- Bug 3787 - Read-only SFTP OPEN request permissions not properly ignored.
- Bug 3740 - Overwrite permission denied when reloading multiple times and
multiple <VirtualHost> sections in proftpd.conf.
- Bug 3791 - Invalid handling of SCP control messages fragmented over multiple
SSH packets.
- Bug 3794 - Cygwin build failure in lib/tpl.c due to wrong include of mman.h.
- Bug 3795 - ProFTPD needs to use -pthread linker option if linking against
OpenSSL with thread support.
- Bug 3790 - Logfile timestamps change to GMT after MFMT command.
- Bug 3798 - Downloading nonexistent file via SCP results in timeout rather
than error.
- Bug 3800 - Multiple *Options directives should be handled properly.
- Bug 3801 - mod_tls should have directive like Apache mod_ssl's
SSLHonorCipherOrder. The mod_tls module now supports a
TLSServerCipherPreference directive.
- Bug 3804 - ioctl(RPROTDIS) code no longer needed on Solaris 11.
- Bug 3808 - Segfault in mod_tls when mod_tls_shmcache used.
- Bug 3809 - Segfaults in mod_radius when configured with RadiusGroupInfo.
- Bug 3811 - ExtendedLog entries not written if MaxClients limit reached.
- Bug 3814 - Support "configtest" command for contrib init.d script.
- Bug 3816 - Installation of ftpasswd does not honor DESTDIR environment
variable.
- Bug 3813 - Ability to use CreateHome to create parent directories as
non-root user, for better interoperability with NFS.
- Bug 3806 - Support reverse DNS resolution for IPv6 addresses when
gethostbyname2(3) is not available.
- Bug 3820 - Support device/interface names in <VirtualHost>, MasqueradeAddress,
and DefaultAddress.
- Bug 3822 - Resolving %U/%u LogFormat variables inconsistent between
mod_log/mod_sql in certain cases.
- Bug 3824 - Use RFC compliant address/port for data transfer if FTP client has
not sent PORT/PASV/EPRT/EPSV commands.
- Bug 3825 - Handle RFC 1918 IP addresses in PORT/EPRT commands.
- Bug 3827 - Use non-filesystem based SFTP handle generator instead of
mktemp(3).
- Bug 3828 - Certain sequences of FTP data transfer commands lead to NULL
pointer dereferences in mod_deflate.
- Bug 3830 - MFF/MFMT command segfaults due to insufficient parameter checks.
- Bug 3829 - RNFR without following RNTO can lead to NULL pointer dereference.
- Bug 3832 - Support disabling of system logging on per-connection basis.
- Bug 3792 - Recursive SCP uploads using preserve-time (-p) option may not work.
- Bug 3831 - Sporadic "451 Insufficient memory or file locked" failure when
downloading.
- Bug 3833 - Enable TCP keepalive by default, with configurable SocketOption.
- Bug 3837 - mod_tls unable to read certificate files after SIGHUP.
- Bug 3842 - Incorrect handling of REALPATH requests for symlink paths in
mod_sftp.
- Bug 3843 - ProFTPD should not fail when starting up due to loading same
module multiple times.
- Bug 3845 - mod_sftp does not provide response codes for %s LogFormat variable
for AUTH ExtendedLog.
- Bug 3846 - Avoid scanning ScoreboardFile needlessly on login if limits are
not configured.
- Bug 3850 - ftpasswd should support generating SHA-256, SHA-512 hashes where