Bug 1397316

Summary: VSFTPD syslog functionality is not fully implemented.
Product: Red Hat Enterprise Linux 7 Reporter: arthurguru <arthurg.work>
Component: vsftpdAssignee: Ondřej Lysoněk <olysonek>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: low Docs Contact:
Priority: medium    
Version: 7.2CC: thozza
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-03-28 14:40:59 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
vsftpd syslog format patch
none
vsftpd syslog format patch
none
vsftpd syslog format patch none

Description arthurguru 2016-11-22 10:06:37 UTC
Created attachment 1222650 [details]
vsftpd syslog format patch

Description of problem:
vsftpd supports two output log file formats (old and new) which are selectable via a configuration switch. vsftpd also allows you send your log file output to the syslog facility via another configuration switch. 

When syslog logging is enabled vsftpd only sends the new logging format to syslog and completely ignores the setting to use the old log file format.

Should the syslog service be restarted vsftpd syslog logging stops and can only be resumed by restarting the vsftpd service.


Version-Release number of selected component (if applicable):
vsftpd-3.0.2-11.el7.src.rpm

How reproducible:
Consistently

Steps to Reproduce:
1. Edit vsftpd.conf and enable extxferlog logging (the old log format)
2. Edit vsftpd.conf and enable syslog
3. Set up a ftp.* facility in syslog to capture the output to file.

Actual results:
The new log format appears in syslog.


Expected results:
Desire the old log format as requested in the vsftpd.conf file.

Additional info:
A patch has been submitted for review.

Comment 2 arthurguru 2016-11-23 12:25:01 UTC
Comment on attachment 1222650 [details]
vsftpd syslog format patch

I downloaded the latest source vsftpd-3.0.2-21.el7.src.rpm today and noted the name of the attached patch file to this ticket may conflict with a recently added syslog patch in revision -21. 

I've renamed my patch to vsftpd-3.0.2-syslog-format.patch

Comment 3 Martin Sehnoutka 2016-11-24 08:14:11 UTC
Hello,

thank you for your report. I'll take a look on this issue.

Comment 4 arthurguru 2016-12-11 01:27:54 UTC
Created attachment 1230452 [details]
vsftpd syslog format patch

I've uploaded a revised patch because me previous patch changed documented functionality.

The unmatched version of vsftpd allows three logging outputs to run concurrently: 
file:old_format
file:new_format
syslog:new_format

I've rewritten the patch so that the above is mostly preserved and if I want to use the new feature of:
syslog:old_format
Then I just enable syslog and file:old_format only.

I've been running this patch in my production environment (vsftpd 3.0.3/RH7.3) for a while without any issues.

What it really needs is a dedicated syslog switch but that would require a change in the documentation. The current logging switches logic used by vsftpd are bad enough as it is already.

Comment 5 arthurguru 2016-12-11 01:32:54 UTC
Created attachment 1230453 [details]
vsftpd syslog format patch

Does actually help to select and upload the latest patch.

Comment 6 Martin Sehnoutka 2017-02-13 15:32:28 UTC
Have you tried to contact the upstream developer and discuss this patch?

Comment 7 arthurguru 2017-02-22 10:10:08 UTC
Yes I did contact the upstream developer first requesting this feature, however I received no response so ended up writing my own patch for the RedHat release that I was using.

I agree with you that this change needs to go back to the upstream developer because to implement it properly requires a new or enhanced switch in the vsftpd config file and its documentation updated - which is outside the scope of the patch I provided.

If you want to close this ticket then that is fine, at least a patch is available to anyone that can roll their own.

Comment 9 Tomáš Hozza 2018-03-28 14:40:59 UTC
closing per comment #7