Subject: WUFTPD Ver wu-2.4(1) problem

From: "P.Ramadurai" <[email-masked]>
Date: Fri, 1 Sep 1995 19:15:32 +0530 (IST)

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
I am  a new member to this list and so if this is not
the correct way to submit queries i plead guilty
pl. donot flame me.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Hi Experts

Want some help in fixing wuftpd problem on Sun Sparc 10 
running Solaris 2.3

Problem no. 1

I could install wuftpd without any problem and everything 
works fine for real users. But when i login as ftp/anonymous 
and do the following (transcript is included )

------------------------starts here------------------
230-
230 Guest login ok, access restrictions apply.
ftp> cd pub
250 CWD command successful.
ftp> ls 
200 PORT command successful.
150 Opening ASCII mode data connection for file list.
hosts
libc.a
226 Transfer complete.
15 bytes received in 0.0034 seconds (4.3 Kbytes/s)
ftp> ls -l
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
226 Transfer complete.
ftp> 
------------------------ends   here------------------

so when i say ls it behaves properly but when i say ls -l
it misbehaves. I donot know why.

Problem no. 2

I also wanted on the fly tarring/compression facilities and
so copied the executables like tar/compress and gzip to
_PATH_EXECPATH subdirectory. but when i try to use them i get
the following transcript as the result.

------------------------starts here------------------
200 Type set to I.
ftp> get libc.a.gz
200 PORT command successful.
150 Opening BINARY mode data connection for /bin/gzip.
226 Transfer complete.

------------------------ends   here------------------
 it creates a file called libc.a.gz with zero bytes 

but  this works properly.

ftp> get libc.a
200 PORT command successful.
150 Opening ASCII mode data connection for libc.a (1070780 bytes).
226 Transfer complete.
local: libc.a remote: libc.a
1074430 bytes received in 7 seconds (1.5e+02 Kbytes/s)

Thinking that library dependencies of the executables 
can be the reason for this 
behaviour i downloaded gnuzip and compiled it with -Bstatic
switch and tried transfer but the result was the same. 
SO i did not try gnuls ( where is gnuls???????) and others.

So HELPPPPPPPPPPPPPPPPPPPPPPP MEEEEEEEEEEEEEE

Also if you can point me to a site where the important
executables are kept compiled for Solaris 2.3 in the
Bstatic mode it will save me time.

thanks in advance for your time.

P.Ramadurai
[email-masked]

---

From: "Steve R. Harding" <[email-masked]>
Date: Fri, 1 Sep 1995 09:12:37 -0700 (PDT)

Hello,

I am new to the server side of ftp, so please bear with me if my question
seems to be a no-brainer.

I have just compiled wu-ftpd-2.4 under Solaris 2.3, and I am experiencing a
problem that I can't figure out.  I would greatly appreciate any insight which
can be offered.

The problem: When I ftp into the server, the daemon logs a record into the
wtmpx file.  Normally, this would be great, but somehow this has the effect of
wiping out the remote host name of all wtmpx entries before the ftp entry.
Here is a shortened output from the "last" command, after I ftp'd into the
server:

orbit01   pts/18       boston           Wed Aug 30 09:45 - 10:06  (00:20)
honey05   pts/15       137.160.231.78   Wed Aug 30 09:38 - 10:21  (00:42)
lock04    pts/15       vagabond.vf.mmc  Wed Aug 30 09:25 - 09:29  (00:04)
honey05   pts/18       137.160.231.78   Wed Aug 30 09:17 - 09:29  (00:12)
loral04   pts/13       boston           Wed Aug 30 09:12 - 09:45  (00:33)
honey05   pts/13       137.160.231.78   Wed Aug 30 09:11 - 09:11  (00:00)
omrl09    pts/15       boston           Wed Aug 30 09:00 - 09:22  (00:21)
pratt01   pts/13       boston           Wed Aug 30 09:00 - 09:06  (00:06)
nrthrp01  pts/5        boston           Wed Aug 30 08:49 - 08:54  (00:04)
cubic01   pts/5        boston           Wed Aug 30 08:41 - 08:47  (00:06)
guest2    ftp                           Wed Aug 30 08:38 - 08:40  (00:02)
allied02  pts/26                        Wed Aug 30 08:28 - 08:42  (00:13)
nrthrp01  pts/25                        Wed Aug 30 08:28 - 08:30  (00:02)
orbit01   pts/18                        Wed Aug 30 08:26 - 08:44  (00:17)
navus01   pts/24                        Wed Aug 30 08:16 - 09:00  (00:44)
gpaulino  pts/23                        Wed Aug 30 08:16 - 13:10  (04:54)
guest2    pts/15                        Wed Aug 30 08:13 - 08:45  (00:32)
lock02    pts/23                        Wed Aug 30 08:04 - 08:12  (00:08)
hughes04  pts/22                        Wed Aug 30 08:03 - 08:33  (00:30)

Notice that the remote host name of all entries from the ftp entry down are
blank.  Many months ago I had a similar problem under Solaris, and I fixed it
with one of their patches.  I have never had this problem since, until I
installed the wu-ftpd.  Normally I wouldn't care where somebody logs in from,
except that we collect this data to find out who is logging in via modem and
who is coming in through the Internet, how often, etc.

Our local network consists of SPARCstations all running Solaris 2.3, operating
under NIS (not NIS+).

Many thanks for any help.
-------------------------------------------------------------------------------
Steve Harding                                      Email: [email-masked]
TACTech, Inc.                                      Voice: (714) 974-7676 ext.15
Yorba Linda, CA

---

From: Russell Street <[email-masked]>
Date: Sat, 02 Sep 1995 09:50:53 +1200 (NZT)

> 150 Opening ASCII mode data connection for /bin/ls.

Follow the instructions on setting up anonymous FTP in the Sun
provided man page for ftpd.  This will tell you all the shared
libraries and device files you need.

Make sure the permissions are exactly as they are in the real file
system.  My FTPD worked first pop doing this.

If it still fails, try:

	cd ~ftp
	chroot . bin/ls

and see what it complains about.

> 150 Opening BINARY mode data connection for /bin/gzip.

Probably the same problem --- you are missing libraries vital to
running programs.  The same chroot trick:
	chroot . bin/gzip libc.a > /tmp/libc.a.gz
should give you an idea what is wrong.

> switch and tried transfer but the result was the same. 

You can not make Solaris executables that are free of shared library
dependancies, according to various Sun engineers.  Even if you did,
you will be missing device files necessary to run programs.

Russell

---

From: Russell Street <[email-masked]>
Date: Sat, 02 Sep 1995 10:02:26 +1200 (NZT)

I believe that the wtmp code is BSD specific and not compatible with
any other vendor's wtmp/utmp files without modification.

The unofficial betas may have fixed that.

The simplest solution would be to recompile it with the daemon looking
at its own files, not the system wide ones.  You do loose the last and
'w' information on users being logged in by FTP, of course.

Either way, I have had no end of trouble with the vendor's wtmp/utmp
files and third party programs that modify them.  If Sun can't get it
right...

Russell

---

From: "Chadwick A. Dubuque" <[email-masked]>
Date: Fri, 1 Sep 1995 19:51:33 -0500 (CDT)

I'm trying to get users to be able to execute a SITE EXEC quota -v, but
here's what the users get:

$ ftp orac
Connected to orac.acm.ndsu.NoDak.edu.
220 orac FTP server (Version wu-2.4.2-academ[BETA-5](1) Thu Aug 24 10:50:34
CDT 1995) ready.
Name (orac:cdubuque): 
331 Password required for cdubuque.
Password:
230 User cdubuque logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> site exec quota -v
200-quota -v
200-Disk quotas for user root (uid 0): 
200- Filesystem blocks quota limit grace files quota limit grace
200-  /dev/hda1  82842     0     0        7489     0     0      
200-  /dev/hdb1     71     0     0           3     0     0      
200  (end of 'quota -v')
ftp> 

Note that if a 'SITE EXEC quota -v username' is done, then the user's (and
only that user's) quota information is displayed, like it should. But, the
user can get *ANYONE'S* quota.

Meaning that the commands aren't being run with the right uid/euid.

This is using 2.4.2 ACADEM BETA 5.

Is this a problem with other people's, or just mine?

-- 
Chadwick A. Dubuque            [email-masked]
http://www.acm.ndsu.NoDak.edu/~cdubuque/   finger for PGP pub. key 
postal:USA/58105-5164/ND/Fargo/IACC 258 NDSU Box 5164/Chad Dubuque

---

From: "Chadwick A. Dubuque" <[email-masked]>
Date: Fri, 1 Sep 1995 20:50:23 -0500 (CDT)

> Is this a problem with other people's, or just mine?

More info on this: I created a program that simply dumped the uid and euid
it was running as, and gave it the same permissions as the "quota" program.

"quota" needs to be 4555 (r-sr-xr-x) because it has to be able to read the
quota tables. (I tried changing the permissions to just 555 (r-xr-xr-x) and
the only quota that could be read was roots. (Not even the user I was logged
in as' quotas!)

So, here's what I get each time I run the program I wrote to echo the uid
and euid:

##############################################################################
> site exec dumper 

dumper  
Core dumped. :-)   
uid==0, euid==501   
 (end of 'dumper')          
##############################################################################

501 is the correct uid of the user I'm logged in as. So, I'm thinking that
the execs have to be suid as well as seuid.

This is Linux 1.2.28 with quotas and shadow passwords and a recompiled 2.4.2
acadmic beta 5.

---

From: "P.Ramadurai" <[email-masked]>
Date: Sat, 2 Sep 1995 14:14:06 +0530 (IST)

> system.  My FTPD worked first pop doing this.
As Russel thought it was  a plain permission problem. when i set
the permissions problems it started working properly.
(thanks a lot Russel)

> you will be missing device files necessary to run programs.
  this a news a to me ( again thanks) 
P.Ramadurai
[email-masked]

---

From: Dovid Zirkind <[email-masked]>
Date: Sun, 3 Sep 1995 02:44:30 -0400

On Fri, 1 Sep 1995, Chadwick A. Dubuque wrote:

This is a bug in wu.ftpd if you issue the command
ftp> SITE EXEC "/bin/bash -c id"
it will show you eid 0, which is a security risk, whereby anyone can do work
as root! there is a ver. which has this corrected (I don't remeber which 
ver.), also I think there's a way to disable SITE EXEC

> Is this a problem with other people's, or just mine?

                        +------------------------------+
                        |    http://www.chabad.org     |
                        |  gopher://gopher.chabad.org  |
                        +------------------------------+

---

From: Chris Woods <[email-masked]>
Date: Sun, 3 Sep 1995 10:40:56 -0400 (EDT)

> ver.), also I think there's a way to disable SITE EXEC

Actually, this was not a wu-ftpd bug. It was a Slackware Linux "bug". 
Simply put, Slackware was being released with wu-ftpd, and it was compiled
with the PATH_EXEC set to something foolish like `/bin'. Either recompile
wu-ftpd, or go fetch the latest binary from sunsite. NOTE: this was not a
problem with any other OS that I am aware of, and if it was, again, it is
not a wu-ftpd bug, but operator error on the part of whoever compiled
wu-ftpd. 

     Chris Woods     Senior System Administrator       USAinternet, Inc.
     GCS/CM/IT d- s++:+ a- C++++$ ULS++++$ P+++$>++++  L++++$ E W$ N+ !o
     K++ !w--- !O !M-- !V-- PS+? !PE !Y+>++ PGP+ t+@ !5 X !R tv? b+ DI++
     D+@ G++ e h---- r+++ y++++
     [email-masked]	      http://www.usa1.com	    508-774-4700

---

From: "Chadwick A. Dubuque" <[email-masked]>
Date: Sun, 3 Sep 1995 12:17:26 -0500 (CDT)

Dovid Zirkind wrote:

> ver.)

Does anyone have a patch for that, or do I have to do this myself? I'd
rather that one of those who are already aware of where these things are
happening.

I know that the security risk is there. (BTW- It appears that programs are
being run uid 0 and euid (regular user id).

>, also I think there's a way to disable SITE EXEC

That's *NOT* what I want. I have the SITE EXEC path set to something that
only has what I want in it, for example, "quota". :-)

This program *is* necessary.

Other than this, wu-ftpd is working fine. :-)

---

From: "Steve R. Harding" <[email-masked]>
Date: Tue, 5 Sep 1995 06:47:28 -0700 (PDT)

> files and third party programs that modify them.  If Sun can't get it

Russell,

Right you are.  While I was looking for a better answer I did the recompile
with _PATH_UTMP and _PATH_WTMP pointing to new files, and that fixed my 
real utmp and wtmp.  Unfortunately, the new files aren't getting written to
(my fault probably, but I really don't have the time to <censor> with 
it).  As long as I can log who is transferring which files, I am happy.  
Thanks for the assist.

---

From: "Steve R. Harding" <[email-masked]>
Date: Tue, 5 Sep 1995 07:03:11 -0700 (PDT)

Here is another question for the magi's out there:

I am setting up multiple (read: over 100) root directories for guest users.
To get it working with a single guest user, I followed the install directions
to duplicate the tree structure, ownership and permissions required in 
~ftp/etc, ~ftp/usr, ~ftp/bin and ~ftp/dev.  This worked great.  Then, dismayed
at the amount of disk space needed to duplicate this over a hundered 
users, I removed one directory at a time, trying it out each time.  It 
finally stopped working with my guest user when I removed the ~ftp/dev 
directory.  As long as I have the ~ftp/dev directory, I don't need any of the
others.

This may seem like a non-problem question, but does this make sense?  If it
should not work this way, why does it?

Regards,

---

From: Brad Burdick <[email-masked]>
Date: Tue, 5 Sep 1995 10:49:54 -0400 (EDT)

> ver.), also I think there's a way to disable SITE EXEC

Easiest way would be to use the _PATH_EXECPATH variable in pathnames.h to set
the site exec path to something other than /bin and only place the programs
that are necessary in that directory.  I think the default is /bin/ftp-exec
which works fine for us.

If there are holes in this approach that I am not aware of, I'd love to hear
about them. :)

-brad
-- 
Brad Burdick                                      [email-masked]
Internet Multicasting Service, NPB, Suite 1155, Washington, DC 20045
                Under contract from UUcom, Inc.

---

From: "Chadwick A. Dubuque" <[email-masked]>
Date: Wed, 6 Sep 1995 11:58:27 -0500 (CDT)

> that are necessary in that directory.  I think the default is /bin/ftp-exec

Again, this is *NOT* what I want. I want the problem fixed, so programs are
run uid AND euid user, not root. P.S. I do have the paths set as such, and
am not worried about any security problems as of yet, since there are no
users on the machine. :-) But, it will need to be fixed soon!

> If there are holes in this approach that I am not aware of, I'd love to hear

You still can't use the programs... :-)