Subject: FIXED!!! PASV mode, anonymous users, and Solaris 2.4

From: Simon Rakov <[email-masked]>
Date: 16 Nov 95 12:16:35 EDT

Hi everyone, 

I am delighted to announce a fix for the problem documented below.  Here's what 
you have to do:

> cd ~ftp/dev
> chgrp ftp tcp
> chmod 775 tcp

Apparently it needs the write bit on the tcp device.  Thanks, everyone, for 
your help with this.  I would be interested in comment on the security 
implications of this fix.

Thanks for everyone's help on this.  Save this message in case you ever have to 
work with Solaris!!

--Simon Rakov
AT&T New Media Services

---------------------------------------------------Original 
Message----------------------------------------------------------

Hi folks,

I am a new site administrator for a web and ftp site at AT&T and I simply 
cannot figure out what the fella before me (who is totally unreachable) has 
done to turn off the PASV mode in wu-ftpd for anonymous users.  Every time I 
log in to the wu-ftpd server as a user (myself) it goes into passive mode 
without a problem, saying:

227 Entering Passive Mode (198,112,160,40,164,30)

as it should.

However, whenever I log in as user anonymous, it *rejects the PASV command* 
which is an extreme irritation as most web browsers these days use that command 
to initiate FTP connections.  Here's the message that I get when I issue the 
PASV command as anonymous:

425 Can't open passive connection: Permission denied.

Please help me to solve this problem.  I am running wu-ftpd 2.4 on a Solaris 
2.4 Sparc 20.  I don't know whether the wu-ftpd has been patched.   
Interestingly, the problem is not restricted to wu-ftpd - I tried the Solaris 
ftp daemon and it wouldn't let the anonymous user make a passive connection 
either.  It said:

425 Can't open passive connection

without saying anything about permissions.

Re permissions:  the directories look fine, and you can literally do everything 
as anonymous that one would expect to be able to do, *except* enter passive 
mode.  Please help!!!!!  My site is www.ichange.com, if you want to see what it 
does just connect via telnet to port 21.  This will let you issue the standard 
FTP commands and see the server's responses.

Thanks very much.

Yours sincerely,
Simon Rakov
Internet Services Specialist
AT&T New Media Services