Subject: Guest Accounts

From: [email-masked] (Tom Lojewski)
Date: Tue, 28 Mar 1995 17:01:07 -0800 (PST)

One very dangerous thing that should be spelled out more cleary in the
docs for wu-ftpd is this.  Although guest accounts share a common
chroot()'ed directory, the system still has their home directory is
the WHOLE PATH specified the password home directory field.  Not just
the field before the dot.  

So for a passwd entry like:

theguest:*:666:666:A. GUEST:/FTP/guests/./theguest:/bin/false

wu-ftpd chroot()'s to /FTP/guests and then "cd's" to /theguest.

>>>> BUT!!! to the system his real $HOME directory is: /FTP/guests/theguest.

You should make sure that this directory is not writable by the guest
user.  Or, at the very least prevent your guest users from creating
".rhosts" and ".forward" files in these home directories.

--------------------------------------------------------------------------
Tom Lojewski  -  ACUSON Corp  -  Mountain View, CA - ([email-masked])