Subject: SITE EXEC problems

From: Chad Phillips <[email-masked]>
Date: Wed, 28 Jun 1995 15:25:41 -0500 (CDT)

I am trying to set up some programs to be executed via wu-ftpd and I have not
been able to get the site exec to work.  I have not found much info on site
exec, is there a faq or some other document that might help me out?

Thanks

 Chad K. Phillips              Mail:   ILO2-SH2                     *   *     
                               Phone:  (708) 576-0756              *** ***    
 Systems                       Fax:    (708) 576-0973             **  *  **   
 Radio Products Group          E-mail: [email-masked]      *         *  
 Land Mobile Products Sector

---

From: Edward Murphy <[email-masked]>
Date: Wed, 28 Jun 1995 16:10:44 -0500 (CDT)

I recently installed wu-ftpd 2.4 on our DEC Alphabox (OSF/1 3.2). It 
allows user "anonymous" to login, but *not* real users. I'll get as far 
as typing in my username and password only to have the message "Login 
incorrect" appear.

I have search the archives of this list and found one thread that was 
*exactly* this problem. The replies centered around making sure that your 
the user's shell was in /etc/shells. I have verified that my shell is 
indeed in the /etc/shells file. There were no other suggestions in the 
archives regarding this problem.

Likewise, a search of DEC's WWW site and tech support database yeilded 
nothing.

At this point I'm grasping at straws. Any help is appreciated.

Ed

   ----------------------------------------------------------------
			    Edward Murphy
	  [email-masked] * http://www.uno.edu/~emurphy

---

From: [email-masked] (Andrew Draskoy)
Date: Thu, 29 Jun 1995 09:08:52 -0230 (NDT)

See my posting yesterday about getting wu-ftpd to work on OSF under C2.
One other thing that I discovered you need to do is chnage the strcmp
of the encrypted passwords to a strncmp, since crypt will only return
the first portion of the encrypted string.  (This is in ftpd.)  This
and the minor change I posted yesterday will let it work fine under
DEC OSF/1 3.2 on an Alpha.

Andrew Draskoy
[email-masked]

---

From: Edward Murphy <[email-masked]>
Date: Thu, 29 Jun 1995 10:39:35 -0500 (CDT)

Thanks to a recent post, I was able to get WU-FTPD 2.4 working for both 
anonymous and real logins with DEC Alpha OSF/1 3.2. (Thanks AD).

I did come across another problem however.

After I successfully logged into several real user account using wu-ftpd, 
I received a phone call from a user who could not use FTP. It was 
curious, but sure enough, using that *particular* user's account I 
*couldn't* access our FTP server.

After a few attempts to figure it out, I hit upon a solution: the user's 
password was longer than 8 characters.

I have been told that a "max password length" can be set in OSF/1. My
suspicion is that OSF/1 is using/not using passwords of more than length 8
and the WU ftpd is not using/using characters beyond the eighth position when
it does it's negotiation. 

Regards,
Ed

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Thu, 29 Jun 95 17:49:58 MET DST

> it does it's negotiation. 

I found out (almost the hard way ;-) that I needed to set my shadow library
here to accept passwords > 8 chars. At the moment I have a > 8 char password,
and I can't login to the wu-ftpd server.

I have been looking through the source to find out where the limit of 8
in wu-fptd comes from, but I couldn't find it.

                                        Grtz. KH

-- 
  Koos van den Hout,           Internetter, Unix freak and BBS SysOp at large
  [email-masked] (Home)        BBS Koos z'n Doos (+31-3402-36637 28k8)
  [email-masked] (Work)  <-- finger for PGPkey       (+31-3402-56619 14k4)
  http://www.hvu.nl/~koos (WWW)    Looking for a license plate with "RFC 822"
  GCS d- p(-) c++(+++) l+ u+++ e++ m+(-) s+/- !n h f+ g+ w(++) t+ r !y(*)

---

From: Bjarki Magnusson <[email-masked]>
Date: Thu, 29 Jun 1995 02:45:06 +0000 (GMT)

Where can I get a compiled wu-ftp for linux thats secure.  The version I have
now (disabled) allows hackers to gain control of root!

---

From: Edward Murphy <[email-masked]>
Date: Thu, 29 Jun 1995 14:37:13 -0500 (CDT)

What is the cause of the 8 character limit on passwords?

Recap: I've just installed wu-ftpd 2.4 on our DEC Alpha OSF/1 3.2 system with
C2 security enhancements. The max password length is 10. Users who have
passwords of length greater than 8 cannot use the WU ftpd programs, they get
"Login incorrect". 

There was a post about a year ago which stated "Most ftp clients chop it
[password] at 8...". I am absolutely sure that the FTP client I'm using does
not do this since it works with the normal OSF/1 ftpd (indeed if "most
clients" did truncate passwords, I would be shocked!). 

The same post also included that there was no problem with the server
(wu-ftpd 2.4) truncating passwords (though there's no mention of what type of
security the system the poster was using and whether it allowed password
longer than 8 characters). This seems reasonable to me and additionally I
cannot find the code in the ftpd.c program where the password would be
truncated. 

So, based on my assumptions, if the FTP client is not truncating the password
and the WU ftpd (2.4) is not truncating the password, what the heck is
causing the password length to prevent use of WU ftpd 2.4?

Any help appreciated. Are my assumptions incorrect?

Ed

---

From: Michael Brennen <[email-masked]>
Date: Thu, 29 Jun 1995 14:58:50 -0500 (CDT)

I think it is crypt() itself - the DES encryption library routine.  I
think it cuts more than 8 characters.

Michael Brennen
Intecom, Inc.

---

From: Edward Murphy <[email-masked]>
Date: Fri, 30 Jun 1995 09:31:56 -0500 (CDT)

I put that following post in the newsgroup comp.unix.osf.osf1 and received a
solution to my problem from one of the persons there. He wrote to me that the
crypt() function is the cause of the 8 character limit in that 8 characters
is all it processes. Since C2 security allows longer passwords, crypt is
inadequate here. He further mentioned an (undocumented) routine named
"bigcrypt" (part of prot.h) which does successive calls to the encryption
routines for different sections of a longer password. I replaced the crypt()
call with the bigcrypt() call and it seems to be working now.

Is there a developer's address for WU-FTPD? Or is posting to this forum 
enough to let the developers know about this change?

Many thanks to all those who replied from here as well.

Ed Murphy

P.S. And a special thanks to the poster in the OSF/1 newsgroup!