Subject: Help with installing the wu-ftpd daemon

From: [email-masked]
Date: Fri, 15 Dec 95 15:17:20 -0500

I justed pulled over the v2.4 kit, and attempting to install it on a Digital 
Unix v3.2c system.

The build osf works fine, with no errors reported.   The build install doesn't 
work complains about not finding a /usr/local/etc/ftpd.  So, I manual moved the 
daemons and ran the bin/ckconfig procedures, which reports all is well.

The problem is when I connect with a real account, it will not allow the 
connection, reporting login incorrect.  This account is fine.  It does work with 
anonymous, but not real accounts.

I have double checked everything, and can't find the cause of the problem.  Any 
help would be great !

John

---

From: Bart Verspagen MERIT <[email-masked]>
Date: Sat, 16 Dec 1995 11:49:55 +0100 (MET)

> daemons and ran the bin/ckconfig procedures, which reports all is well.

That's right, same thing on my OSF/1 V3.2 system.
 
> anonymous, but not real accounts.

You probably have enhanced security on. I had exactly the same problem. I
found that switching to base security solved the problem. Of course, one
would like to stay on enhanced security, so I asked for help on this list
a couple of days ago. One advice I was given was to change calls to the 
crypt() function in ftpd.c to bigcrypt() calls (an undocumented function 
in libsecurity.a). This works as far as compiling is concerned, but it 
wouldn't help me logging in real users, although ftpd's response is 
different from the first try.

BTW, I found a rather disturbing feature in OSF/1 while experimenting with
all of this. At one time, I was switching from BASE security to ENHANCED
security, and accidentally copied an old version of the /etc/passwd file
on to that file. This version contained a real encrypted password for a
certain user, although one that was several months old, and had been
changed in the mean time. I then found that the "original version" of
wu-ftpd (i.e., the one with the crypt() call instead of the bigcrypt()
call) would log in that user with the OLD password, while a regular telnet
login would only accept the new password. Beware: all of this happened
when enhanced security was switched on... 

Anyway, please send me any solutions you might find for the problem you 
reported...!

All the best,

Bart Verspagen

PS: PLEASE NOTE MERIT'S NEW TELEPHONE AND FAX NUMBERS!!!!

Merit                |   email: [email-masked]
P.O. Box 616         |   tel: (+31) (0)43 3883869 / (+31) (0)43 3883875
6200 MD Maastricht   |   fax: (+31) (0)43 3216518
The Netherlands      |

*** Check out our WWW-site at http://meritbbs.rulimburg.nl ***
*** Anonymous ftp-access to MERIT-files: meritbbs.rulimburg.nl ***