One Hat Cyber Team

Edit File: mod_deflate.html

<!DOCTYPE html>
<html>
<head>
<title>ProFTPD module mod_deflate</title>
</head>

<hr>
<center>
<h2>ProFTPD module <code>mod_deflate</code></h2>
</center>
<hr>

The <code>mod_deflate</code> module is designed to provide support for
<code>MODE Z</code> commands, which allows FTP clients and servers to
compress data for transfer.

This module is contained in the <code>mod_deflate.c</code> file for
ProFTPD 1.3.x, and is not compiled by default. Installation instructions
are discussed <a href="#Installation">here</a>. Detailed documentation on
<code>mod_deflate</code> usage can be found <a href="#Usage">here</a>.

The most current version of <code>mod_deflate</code> can be found at:
<pre>
 <a href="http://www.castaglia.org/proftpd/">http://www.castaglia.org/proftpd/</a>
</pre>

<h2>Author</h2>

Please contact TJ Saunders &lt;tj at castaglia.org&gt; with any
questions, concerns, or suggestions regarding this module.

<h2>Directives</h2>
<ul>
 <li><a href="#DeflateEngine">DeflateEngine</a>
 <li><a href="#DeflateLog">DeflatefLog</a>
</ul>

<hr>
<h3><a name="DeflateEngine">DeflateEngine</a></h3>
Syntax: DeflateEngine on|off 
Default: off 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_deflate 
Compatibility: 1.3.0rc1 and later

The <code>DeflateEngine</code> directive enables or disables the
<code>mod_deflate</code> compression functionality. If set to on,
then <code>mod_deflate</code> will advertise support for <code>MODE Z</code>
compression via the <code>FEAT</code> command, and handle <code>MODE Z</code>
requests appropriately.

<hr>
<h3><a name="DeflateLog">DeflateLog</a></h3>
Syntax: DeflateLog path|&quot;none&quot; 
Default: None 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_deflate 
Compatibility: 1.3.0rc1 and later

The <code>DeflateLog</code> directive is used to specify a log file for
<code>mod_deflate</code> reporting and debugging. The path parameter
must be the full path to the file to use for logging. Note that this path must
not be to a world-writable directory and, unless
<code>AllowLogSymlinks</code> is explicitly set to on
(generally a bad idea), the path must not be a symbolic link.

If path is &quot;none&quot;, no logging will be done at all.

<hr>
<h2><a name="Installation">Installation</a></h2>
The <code>mod_deflate</code> module is distributed with ProFTPD. Follow the
usual steps for using third-party modules in ProFTPD:
<pre>
 $ ./configure --with-modules=mod_deflate
</pre>
To build <code>mod_deflate</code> as a DSO module:
<pre>
 $ ./configure --enable-dso --with-shared=mod_deflate
</pre>
Then follow the usual steps:
<pre>
 $ make
 $ make install
</pre>

For those with an existing ProFTPD installation, you can use the
<code>prxs</code> tool to add <code>mod_deflate</code>, as a DSO module, to
your existing server:
<pre>
 $ prxs -c -i -d mod_deflate.c
</pre>

<hr>
<h2><a name="Usage">Usage</a></h2>

Example <code>mod_deflate</code> configuration:
<pre>
 &lt;IfModule mod_deflate.c&gt;
 DeflateEngine on
 DeflateLog /var/log/proftpd/deflate.log
 &lt;/IfModule&gt;
</pre>

Sites that run <code>proftpd</code> 1.3.0 should disable sendfile use
when using <code>mod_deflate</code>, as the two features do not interoperate
well:
<pre>
 &lt;IfModule mod_deflate.c&gt;
 DeflateEngine on
 DeflateLog /var/log/proftpd/deflate.log

UseSendfile off
 &lt;/IfModule&gt;
</pre>

Logging 
The <code>mod_deflate</code> module supports different forms of logging. The
main module logging is done via the <code>DeflateLog</code> directive.
For debugging purposes, the module also uses <a href="../howto/Tracing.html">trace logging</a>, via the module-specific log channels:
<ul>
 <li>deflate
</ul>
Thus for trace logging, to aid in debugging, you would use the following in
your <code>proftpd.conf</code>:
<pre>
 TraceLog /path/to/ftpd/trace.log
 Trace deflate:20
</pre>
This trace logging can generate large files; it is intended for debugging use
only, and should be removed from any production configuration.

<a name="FAQ">
Frequently Asked Questions

<a name="DeflateRFC2228">
Question: I have compiled and configured <code>mod_deflate</code> properly in my <code>proftpd</code>, but I still can't use the MODE
Z functionality. In my client, I see the following error. Why?
<pre>
 501 'MODE Z' unrecognized transfer mode
</pre>
Answer: The most likely culprit is that your FTP client
is using an RFC 2228 protection mechanism (e.g. SSL/TLS). In the
<code>DeflateLog</code>, you might see a message like:
<pre>
 Jul 21 23:01:37 mod_deflate/0.3.2[31084]: declining MODE Z (RFC2228 mechanism 'TLS' in effect)
</pre>

There are two reasons for the current behavior. First, the SSL/TLS ciphersuite
that is negotiated can (depending on the ciphersuite) already include
compression of the encrypted data -- in which case, <code>MODE Z</code> is
redundant (and in effect inefficient, as it would waste CPU cycles trying to
re-compress already-compressed data). Second, the internal ProFTPD APIs that
<code>mod_deflate</code> uses are the same APIs that <code>mod_tls</code> uses;
and that API does not currently handle chaining together of registered
handlers. This would be needed in order to support <code>mod_deflate</code>'s
<code>MODE Z</code> functionality and the <code>mod_tls</code> encryption
at the same time.

<a name="DeflateDataError">
Question: I'm uploading a file using <code>MODE Z</code>,
but the upload always fails. In the <code>DeflateLog</code>, I see:
<pre>
 error inflating data: [-3] Data error
</pre>
What is going wrong? It is a <code>mod_deflate</code> bug? 
Answer: The most common cause of this error is when
the client is trying to upload a binary file (e.g. PDF, MPG, etc)
in <a href="http://www.proftpd.org/docs/howto/ASCII.html">ASCII</a> mode.

If <code>MODE Z</code> is not used in cases like this, the upload succeeds,
but the uploaded file on the server is corrupted. When <code>MODE Z</code>
is in effect, the corruption (translation of newlines inappropriately) is
detected earlier (since <code>mod_deflate</code> can't uncompress the
compressed data properly, hence the report of a "Data error"), and the
upload fails.

The solution is make sure that the client uploads (and downloads) non-ASCII
files as binary files, not as ASCII files.

</body>
</html>