Subject: FAQ for wu-ftpd

From: [email-masked]
Date: Mon, 18 Dec 95 09:46:24 gmt

Allright, a lynx -dump of the faq, revised and improved. Additions allways
more then welcome.

Frequently Asked Questions about wu-ftpd, with answers

   Comments : this version is still lacking with details about certain
   operating systems. Comments about those are welcome.
   
   Also, a pure text version hasn't been made yet.
     _________________________________________________________________

  Contents of this FAQ

         1. What is wu-ftpd itself and this mailing list in particular ? 
              1. How do I subscribe/unsubscribe ? 
              2. Is this list archived anywhere ? 
              3. What are related documents ? 

         2. Where do I get the wu-ftpd ? 
              1. Where do I get the updated version ? 

         3. Compiling the wu-ftpd 
              1. cc complains about strunames, typenames, modenames, ..
                 being undeclared. 
              2. wu-ftpd doesn't use the shadow passwords on my Linux
                 machine. 
              3. I need to use S/KEY authorisation 
              4. The timezone in the xferlog is wrong 

         4. Installing the wu-ftpd 
              1. Command-line options for wu-ftpd 

         5. The ftpaccess file 
              1. Some files (banners, etc) don't get shown to anonymous
                 users. 

         6. Programs (ls, gzip, tar) work for real users, not for
            anonymous users, giving errors like 425 Can't create data
            socket (0.0.0.0,20): Bad file number or simply no output. 
              1. Solaris 
              2. Linux 
              3. Dec OSF 

         7. Running wu-ftpd 
              1. ftpd allways says "221 Server shutting down. Goodbye." 
              2. Anonymous ftp works fine, but real users are denied
                 access 
              3. I want a real user to be able to access the host only
                 via ftp, not via telnet 
              4. Somebody uploaded a file with a weird name 
              5. I want anonymous users to be able to upload files, but
                 in the most secure manner possible 
              6. I heard something about 'SITE EXEC' having a security
                 hole 
              7. How do I make reports more readable ? 

         8. Credits 

    1. What is wu-ftpd itself and this mailing list in particular ? 
       
       Wuarchive-ftpd, more affectionately known as wu-ftpd, is a
       replacement ftp daemon for Un*x systems developed at Washington
       University (*.wustl.edu) by Bryan D. O'Connor. wu-ftpd is the most
       popular ftp daemon on the Internet, used on many anonymous ftp
       sites all around the world.
       
       This mailing list is for discussing problems with maintaining this
       daemon and ftp-sites where it is used.
       
         1. How do I subscribe/unsubscribe ? 
            
            To subscribe, send a mail message with a _body_ of _SUBSCRIBE
            WU-FTPD <your full name>_ to the list server
            [email-masked].
            
            To unsubscribe, send a mail message with a _body_ of
            _UNSUBSCRIBE WU-FTPD_ to the list server
            [email-masked].
            
            To send mail to all people on the list, send it to
            [email-masked].
            
         2. Is this list archived anywhere ? 
            
            YES. Searchable archive of this mailing list is available at
            <URL:http://freeway.oact.hq.nasa.gov/wuarchive.html>.
            
            The page at <URL:http://freeway.oact.hq.nasa.gov/wuftp.html>
            contains basic questions and answers about wu-ftpd.
            
            This archive is created and maintained by Judy Pellerin
            ([email-masked]).
            
         3. What are related documents ? 
            
            The information sheet for the last version from washington
            university itself is at <URL:http://www.wustl.edu/ftp>/A>
            
            'ANONYMOUS FTP CONFIGURATION GUIDELINES'
            
            A set of guidelines from CERT (Computer Emergency Response
            Team) about setting up anonymous ftp.
            
            <URL:ftp://ftp.cert.org/pub/tech_tips/anonymous_ftp>
            
            _'How to set up a secure ftp server'_
            
            A file describing how to set up anonymous ftp in general in a
            secure way, avoiding misuse.
            
            <URL:ftp://sunsite.unc.edu/pub/sun-info/sun-faq/FAQs/SettingU
            pSecureFTP.faq>
            
            _'guestgroup howto'_
            
            A document describing the set up of guestgroups in the
            wu-ftpd server. At this moment a seperate document from this
            document.
            
            <URL:ftp://ftp.fni.com/pub/wu-ftpd/guest-howto>
            
            A document describing virtual ftp servers
            
            <URL:http://www.westnet.com/providers/multi-wu-ftpd.txt>
            
            _Read these. Something like_

#> telnet xxx.yyy.nl
Trying XXX.XXX.XXX.XXX ...
Connected to xxx.yyy.nl.
Escape character is '^]'.

SunOS UNIX (xxx.yyy.nl)

login: ftp
Last login: Sat Oct 28 22:11:36 from xxxxxx.xxx.xxx.nl
SunOS Release 4.1.3 (HSIS_X25) #1: Wed Apr 7 14:19:15 MET DST 1993
%>
        should not happen.

    2. Where do I get the wu-ftpd ? 
       
       The wu-ftpd home is wuarchive.wustl.edu, the exact URL is:
       
       ftp://wuarchive.wustl.edu/pub/unix/wuarchive-ftpd/
       
       This daemon is available in source code and binaries from many
       other ftp-sites, ask _archie_ where to find it. Best is to compile
       it yourself, since it has a lot of compile-time options.
       
         1. Where do I get the updated version ? 
            
            The above is the last version created by wuarchive. On the
            mailing list, an updated version has been created which is
            maintained by Stan Barber ([email-masked]).
            
            You can get this beta by ftp from the directory :
            
            ftp://ftp.academ.com/pub/wu-ftpd/private/ the directory is
            not browsable, a .message file will point you to what is the
            latest version.
            
            Remember, these are _BETA_ versions. Before asking/trying
            anything, check first that you have the latest version. And
            if you run this version, keep up with the list to make sure
            you get news of updates.
            
    3. Compiling the wu-ftpd 
       
       In general, editing _src/pathnames.h_ and typing _build arch_
       should be enough.
       
         1. cc complains about strunames, typenames, modenames, .. being
            undeclared. 
            
            This error is fully explained in the INSTALL/INSTALL.orig
            file in wu-ftpd package. A few relevant lines :

If cc complains about strunames, typenames, modenames, ... being undefined
you need to install support/ftp.h as /usr/include/arpa/ftp.h (always make
a backup of the old ftp.h just in case!) and do the build again.  The new
ftp.h should be a compatible superset of your existing ftp.h, so you
shouldn't have problems with this replacement.

         2. wu-ftpd doesn't use the shadow passwords on my Linux machine.

            Since most recent Linux distributions don't include shadow
            passwords, wu-ftpd assumes Linux does not have shadow
            passwords. To compile for shadow passwords with Linux :
            
               o Get the shadow.h from the latest shadow package.
               o After building the shadow package, you have a
                 libshadow.a.
               o Copy shadow.h to the src dir.
               o Copy libshadow.a to the support dir.
               o Edit src/config.h to say '#define SHADOW_PASSWORD'
                 instead of #undef.
               o Edit the LIBES line in src/Makefile to read :
                 _LIBES = -lsupport -lbsd -lshadow_

            Modify _src/ftpd.c_ around line 1061 to read :

        xpasswd = pw_encrypt(passwd, salt);

         3. I need to use S/KEY authorisation 
            
            Michael Brennen ([email-masked]) wrote on the list:

The general SKEY procedure is something like this:

The last thing in config.h is an #undef SKEY; comment that out.  That is
a gotcha that can take some time to find, although that doesn't seem to=20
be the problem.

Copy skey.h into the src directory.

Copy libskey.a into the support directory.

Edit the appropriate Makefile.* in src/makefiles and add the following:
   add "-DSKEY" to the CFLAGS macro;
   add "-lskey" to the LIBES macro.

That should do it; if not, holler back.

         4. The timezone in the xferlog is wrong 
            
            You compiled with support for setting the process title
            (SETPROCTITLE) on a machine that doesn't support this, where
            changing the process title clobbers the environment.
            Recompile with SETPROCTITLE #undef-ined.
            
            Systems which don't support SETPROCTITLE : Solaris.
            
    4. Installing the wu-ftpd 
       
       In general, change the line for the ftp-server in /etc/inetd.conf
       (the file that defines the servers started by inetd. For some
       operating systems, this is another file).

         1. Command-line options for wu-ftpd 
            
            With the latest versions, using no command-line options will
            set it to a default-mode, in which it will _not_ parse the
            ftpaccess file. Add the option _-a_ to the command line in
            inetd.conf.
            
    5. The ftpaccess file 

         1. Some files (banners, etc) don't get shown to anonymous users.

            Files with absolute pathnames are relative to the current
            root. Put them in the ~ftp filesystem and make a link to
            there, or use this possibility to use different banners.
            
    6. Programs (ls, gzip, tar) work for real users, not for anonymous
       users, giving errors like 425 Can't create data socket
       (0.0.0.0,20): Bad file number or simply no output. 
       
       First, consider if you can't relink them staticly so the shared
       libraries aren't needed. You can get the GNU fileutils from :
       <URL:ftp://prep.ai.mit.edu/pub/pub/gnu/fileutils-3.12.tar.gz>
       (_version numbers may vary_).
       
       For different operating systems, different libraries and/or
       devices are needed. You can test if things are running correctly
       by doing a chroot to the ftp homedir. To test if /bin/ls is
       working in the ~ftp dir, type :
       
       _chroot ~ftp /bin/ls_

         1. Solaris 
            
            Solaris needs ~ftp/dev/tcp and ~ftp/dev/zero and the
            libraries. Use the command _truss_ to find out which
            libraries a program uses.
            
         2. Linux 
            
            Use the command _ldd_ to find out which libraries a program
            uses.
            
         3. Dec OSF 
            
            Copy the static version of ls (/sbin/ls) and not the dynamic
            one. The static version is about 400K.
            Make passwd and group files in ~ftp/etc. Copy the '/etc/sia'
            dir to ~ftp/etc/sia
            
    7. Running wu-ftpd 

         1. ftpd allways says "221 Server shutting down. Goodbye." 
            
            The directive ftpshut in the ftpaccess file points to a file
            that exists at that moment. Either change the directive or
            delete the file.
            
            Also, after you've used the ftpshut command, you'll need to
            remove the ftpshut file by hand.
            
         2. Anonymous ftp works fine, but real users are denied access 
            
            Check the following :
            
               o Their shell is in the /etc/shells file. Note : AIX
                 doesn't even have this file, so you need to create it
                 for wu-ftpd.
               o If you're using shadow passwords : make sure the daemon
                 is compiled with shadow password support.

         3. I want a real user to be able to access the host only via
            ftp, not via telnet 
            
            Create a shell for this purpose (for example, a program that
            says the above or a copy of /bin/true). Put this shell in
            /etc/shells. Change the shell of the user to that shell.
            
              The same, for AIX.
                      Use chuser (or SMIT) to set the user to login=no,
                      su=no, telnet=no, rlogin=no.
                      
         4. Somebody uploaded a file with a weird name 
            
            Somebody is trying to misuse your ftp-site for transferring
            software (_worst case scenario_). Check if the directive
            _path-filter_ in the ftpaccess file is something like :

path-filter anonymous /etc/paths.msg ^[-A-Za-z0-9\._]*$ ^\. ^-

         5. I want anonymous users to be able to upload files, but in the
            most secure manner possible 
            
            In that case, set your path-filter to the one mentioned
            above. Make the incoming directory owned by something else
            then ftp (root, or nobody) with another group then ftp
            (nobody). Something like :

drwx-wx-wt       root    nobody        incoming
        This will allow ftp to write in the directory, but not read it.
            Set the _upload_ directive in ftpaccess to something like :

upload    /home/ftp    /incoming   yes root daemon 0400 nodirs
        One note : files get created as root and changed to the owner
            mentioned in the upload line. This will fail on some secure
            NFS setups.
            
         6. I heard something about 'SITE EXEC' having a security hole 
            
            In some slackware distributions the __PATH_EXECPATH_ is set
            to something like /bin. Recompile wu-ftpd with it set to a
            special path like /bin/ftp-exec.
            
            To test for this hole, type (when logged in as a real user,
            not anonymous) :
            _This has changed from the previous FAQ version!_
            
            ftp> SITE EXEC bash -c id
            
            If you get a return with '200-uid=0(root) gid=0(root)' in it,
            you have the problem.
            
         7. How do I make reports more readable ? 
            
            There are a couple of scripts to make better reports from the
            xferlog.
               o _dumpxfer_ processes the xferlog and gives more humanly
                 readable output
               o _processlog_ script to run dumpxfer, email you the
                 output and truncate the log
        These are available via anonymous ftp via
            <URL:ftp://tnt.microimages.com/tools/> both need Perl.
            
            I (Koos van den Hout) also wrote a Perl script to process the
            log, mail daily statistics and uploaded files, and create a
            top most downloaded files. It is available from
            <URL:ftp://ftp.cetis.hvu.nl/pub/koos/ftplogcheck>
            
    8. Credits 
       
       A number of people deserve credit :
          + Alexander L. Haiut ([email-masked]), creator of the
            original faq.
          + *Hobbit* ([email-masked]) for the first security patches to
            wu-ftpd.
          + Stan Barber ([email-masked]), maintainer of the
            current patch-archive for wu-ftpd.
          + Reinier Post ([email-masked]), for the scripts that
            maintain this FAQ.
          + And offcourse, Bryan O'Connor at Washington University who
            wrote wu-ftpd in the first place.
   _(No chocolate cookies)_

     _________________________________________________________________
   
   Created by : _Koos van den Hout_

    [email-masked]