1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
|
1.3.8 Release Notes
------------------------
This file contains a description of the major changes to ProFTPD for the
1.3.8 release cycle, from the 1.3.8rc1 release to the 1.3.8 maintenance
releases. More information on these changes can be found in the NEWS and
ChangeLog files.
1.3.8c
------
+ Fixed segfault when TLSOptions StdEnvVars is used in conjunction with
an FTPS session.
+ Properly use all configured ECDSA SSH hostkeys, not just the first
configured ECSA SSH hostkey.
+ Fixed issue with RADIUS authentication when using mod_radius and newer
FreeRADIUS, due to BlastRadius mitigation.
1.3.8b
------
+ Implemented mitigations for "Terrapin" SSH attack (CVE-2023-48795).
1.3.8a
------
+ Fixed builds when using OpenSSL 3.x
1.3.8
------
+ Implement support for the CSID FTP command, from an IETF Draft.
+ The mod_auth_otp module improperly allowed keyboard-interactive
authentication to succeed for users lacking OTP entries.
+ Changed Directives
FSCachePolicy
The default value for FSCachePolicy is now "off".
1.3.8rc4
---------
+ Ensure that mod_sftp algorithms work properly when OpenSSL 3.x is used.
+ New Directives
SFTPHostKeys
This directive for the mod_sftp module can be used to specify
the list of SSH host key algorithms that will be presented to
clients; see doc/contrib/mod_sftp.html#SFTPHostKeys for more
information.
+ Changed Directives
SFTPClientMatch
The SFTPClientMatch directive has been expanded to allow setting
some SSH algorithms based on the matched client banner, including
encryption and signature algorithms. See
doc/contrib/mod_sftp.html#SFTPClientMatch for details.
SFTPKeyExchanges
The mod_sftp module now supports the "curve448-sha512" key
exchange algorithm, and the SFTPKeyExchanges directive has been
updated accordingly. See
doc/contrib/mod_sftp.html#SFTPKeyExchanges.
1.3.8rc3
---------
+ Improved consistency/support for name-based virtual hosts.
+ Support for the AES-GCM ciphers "aes128-gcm@openssh.com" and
"aes256-gcm@openssh.com" have been added to mod_sftp.
+ Support SSH hostkey rotation via OpenSSH "hostkeys-00@openssh.com" and
"hostkeys-prove-00@openssh.com" extensions.
+ Support for the "home-directory" SFTP extenssion.
+ Support use of PCRE2, rather than PCRE, via the `--enable-pcre2` configure
option.
+ New Directives
FactsDefault
This directive can be used to explicitly configure the list of "facts"
returned, per path, in the MLSD/MLSD FTP responses.
See doc/modules/mod_facts.html#FactsDefault for more details.
LDAPConnectTimeout
When connecting to LDAP servers, use this directive to configure
a longer timeout, if necessary. See
doc/contrib/mod_ldap.html#LDAPConnectTimeout for more information.
+ Changed Directives
RegexOptions
With the additional support for the PCRE2 library, the RegexOptions
directive now supports explicitly selecting that as the regex "engine";
see doc/modules/mod_core.html#RegexOptions for details.
SFTPCiphers
The OpenSSH-specific AES GCM ciphers are now implemented; see
doc/contrib/mod_sftp.html#SFTPCiphers.
SFTPDigests
The OpenSSH-specific Encrypt-Then-MAC (ETM) digests are now supported;
see doc/contrib/mod_sftp.html#SFTPDigests.
SFTPExtensions homeDirectory
The `mod_sftp` module supports the SFTP extension for querying a
user's home directory (once the client has authenticated). Use
the SFTPExtensions directive to disable support for this extension if
necessary.
SFTPOptions NoHostkeyRotation
The `mod_sftp` module now supports the OpenSSH-specific "hostkey"
extensions, for hostkey rotation. Use this option to disable support
for those extensions where needed; see
doc/contrib/mod_sftp.html#SFTPOptions.
SocketOptions ReusePort
The SocketOptions directive now support configuring the `SO_REUSEPORT`
socket option, for cases where this is useful, such as specific
ProFTPD + Docker networking situations.
TransferOptions AllowSymlinkUpload
In past releases, ProFTPD allows uploads to symlinks; this was
inadvertently broken at some point. Such uploading to symlinks is
possible once more, using this new TransferOption.
See doc/modules/mod_xfer.html#TransferOptions.
1.3.8rc2
---------
+ Fix memory disclosure to RADIUS servers by mod_radius (Issue #1284).
+ PCRE expressions with capture groups were not being handled properly
(Issue #1300).
+ Add support for the libidn2 library, over libidn, for e.g. mod_rewrite
mappings (Issue #1286).
+ Changed Directives
RegexOptions Engine
The RegexOptions directive now supports explicitly configuring which
regular expression "engine" to use, POSIX or PCRE. Thus ProFTPD
installations with PCRE support enabled (via the --enable-pcre configure
option) can be told to treat all regular expressions as POSIX expressions
at run-time.
TLSRenegotiate default behavior
The TLSRenegotiate directive configures when the mod_tls module requests
TLS renegotations on both control and data connections. TLS
renegotiations, as a protocol feature, have a long and sordid history
of abuse; many TLS libraries/clients no longer implement them, or
disable support for renegotiation by default. Thus mod_tls will no
longer request TLS renegotations by default now, either.
+ Developer Notes
The generated Make.rules file will now be installed alongside the
installed ProFTPD headers. It contains build rules used by third-party
modules that use multiple source files.
1.3.8rc1
---------
+ Minimum DH parameter size for TLS has been raised from 1024 to 2048.
+ Passive transfers fail unexpectedly due to use of SO_REUSEPORT socket
option (Issue #1171).
+ Fixed occasional segfaults with FTPS data transfers using TLSv1.3, when
session tickets cannot be decrypted (Issue #1063).
+ Fixed "Corrupted MAC on inptut" errors when SFTP uses the
umac-64@openssh.com digest (Issue #1111).
+ Fixed memory use-after-free issue in mod_sftp which can cause unexpected
login/authentication issues.
+ Fixed speed regression for logins, directory listings when AuthUserFile
is used.
+ ftpasswd now generates SHA256 password hashes by default, rather than MD5.
* Set the `OPENSSL_API_COMPAT` API version compatibility macro. We currently
set our OpenSSL API version to 1.0.0 and later; code which uses an OpenSSL
API earlier than 1.0.0 will cause the build to fail. Use the new
`--disable-openssl-api-compat` configure option to disable use of this
macro.
+ Fixed SQL syntax regression for some generated SQL statements
(Issue #1149).
+ Deprecated Directives
MultilineRFC2228
This directive has caused many issues unexpectedly, particularly for
responses of the FEAT command, and is not necessary.
+ New Directives
ListStyle
This directive is used to emit Windows-style directory listings, for
compatibility with certain FTP clients. See
doc/modules/mod_ls.html#ListStyle for more information.
RedisLogFormatExtra
This directive supports adding custom key/values to the JSON logging
done by the RedisLogOnCommand, RedisLogOnEvent directives. See
doc/modules/mod_redis.html#RedisLogFormatExtra for details.
+ Changed Directives
AuthFileOptions SyntaxCheck
Syntax checks of configured AuthUserFile, AuthGroupFile can now be
performed, at startup time, via this option. See
doc/modules/mod_auth_file.html#AuthFileOptions for more information.
BanOnEvent MaxLoginAttemptsFromUser
The mod_ban module now supports bans for a given user/IP address
combination; see Issue #1170 for details.
RedisSentinel
Support for using TLS when connecting to Redis Sentinels has been
implemented; see doc/modules/mod_redis.html#RedisSentinel for details.
RedisServer
Redis 6.x changed its AUTH command, due to the Redis ACL system, for
supporting multiple users. Thus the `RedisServer` directive now takes
a username, as well as a password. The Redis server version is auto-
detected; the configured username will be ignored for Redis servers
older than Redis 6.x.
Support for using TLS when connecting to Redis servers has been
implemented; see doc/modules/mod_redis.html#RedisServer for details.
SFTPKeyExchanges
"curve25519-sha256" has been added as an alias/synonym for
"curve25519-sha256@libssh.org".
TLSCipherSuite
TLSv1.3 ciphersuites have different names, and are configured differently
in OpenSSL. To support configuration of TLSv1.3 ciphersuites, the
`TLSCipherSuite` directive takes an optional protocol specifier; see
the documentation for details.
TLSOptions
Support for the long-deprecated `NoCertRequest` TLSOption has been
removed.
AllowWeakSecurity TLSOption added, for cases where interacting with
"insecure" (by system OpenSSL policy) clients is required; see
doc/contrib/mod_tls.html#TLSOptions for more details.
Wrap2Tables
The mod_wrap2 module now supports including additional files for
its allow/deny tables; see Issue #1133.
+ Developer Notes
The new `pr_pool_debug_memory2` function uses a visitor pattern to walk
the memory pools, and provides the pool data to the callback via
structure, allowing the callback to format/use the memory pool information
as needed, including emitting the data as JSON.
The "make install" target now will _only_ try to install existing
code/binaries, and will no longer attempt to recompile existing binaries.
That is, this sequence will no longer work:
$ ./configure
$ make install
Instead, the officially documented and supported sequence is now required:
$ ./configure
$ make
$ make install
This ensures that no unexpected recompilation occurs; see Issue #548.
|
