From: Chris Seiders <[email-masked]>
Date: Thu, 8 Jun 1995 16:03:02 -0400

Can anyone identify the proper permission and ownership settings 
for configuring anonymous ftp using wu-ftpd-2.4?  I'm currently
running it on Digital Unix 3.2 (OSF/1), but would eventually like
to configure it on SCO Unix 3.2 (if I can ever get it to compile).

I can't find a concensus between the CERT anonymous ftp advisory,
the ISS anonymous ftp FAQ, and the ftpd(8) man page that
that came with the wu-ftpd distribution as to what
the ownership and file permissions should be in order to keep the
facility secure.

In particular, the man page states that the ftp home directory should be
owned by the user "ftp".  The cert advisory and the FAQ (as well as     
several other sources) state that if the home directory or any subdirectories
are owned by ftp, that opens up security loopholes.  There are also
discrepencies between the recommended group ownership of the
various ftp directories, and their permissions.  

I'm tending to stick with the CERT recommendations, but don't want to
circumvent any security features that WU built into this particular
ftp daemon.  

-----------------------------------------------------------------------
Chris Seiders ([email-masked])
Network Administrator
Commonwealth of Pennsylvania
-----------------------------------------------------------------------