Subject: wu-ftpd problem with rights!

From: Gregory Luneau <[email-masked]>
Date: Wed, 21 Feb 1996 18:48:34 -0600

Hi Folks, i'm setting up my Linux box for ftp access only for my users. I have setup all the good stuff like a login shell if they try to telnet in:

#!/bin/sh
echo ""
echo "   Hello, your access is restricted to FTP only.  Thanks."
echo ""

and added it to the /etc/sheels.

Then installed the etc (passwd, group) and bin (ls) directory so they can see file ownership.

And here is part of my /etc/ftpaccess file:

class   local   real,guest 204.112.6.*
class   remote  real *
limit   local   20  Any                 /etc/msgs/msg.toomany
limit   remote  100 SaSu|Any1800-0600   /etc/msgs/msg.toomany
limit   remote  60  Any                 /etc/msgs/msg.toomany
private         yes
delete          yes      guest         # delete permission?
overwrite       yes      guest         # overwrite permission?
rename          yes     guest         # rename permission?
chmod           yes     guest         # chmod permission?
umask           no      guest         # umask permission?
path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
guestgroup ftponly
guestgroup users

By using guestgroup for users the ftpd is doing a chroot() at the home dir of the user!

And to show you what is happening here we go:

ftp foo.bar.net
Connected to foo.bar.net.
220 Charlie FTP server (Version wu-2.4(1) Sun Jul 31 21:15:56 CDT 1994) ready.
Name (foo.bar.net:greg): foo
331 Password required for foo.
Password:
230 User foo logged in.  Access restrictions apply.
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
total 8
drwxr-xr-x   4 foo      users        1024 Feb 22 00:01 .
drwxr-xr-x   4 foo      users        1024 Feb 22 00:01 ..
-rw-r--r--   1 root     root            2 Feb 16 18:23 .forward
-rw-r--r--   1 root     root            2 Feb 16 18:23 .klogin
-rw-r--r--   1 root     root            2 Feb 16 18:23 .project
-rw-r--r--   1 root     root            2 Feb 16 18:23 .rhosts
dr-xr-xr-x   2 root     other        1024 Feb 16 18:23 bin
dr-xr-xr-x   2 root     other        1024 Feb 16 18:23 etc
226 Transfer complete.
ftp> del .forward
250 DELE command successful.
ftp>

Heuh! What the hell! Why was my foo user able to delete a file owned by root when all the file properties are saying you can't touch me?

Well then I whent back to the /etc/ftpaccess file and changed the permisions on the delete to this:

delete          no      guest         # delete permission?
overwrite       no      guest         # overwrite permission?
rename          no      guest         # rename permission?
chmod           yes     guest         # chmod permission?
umask           no      guest         # umask permission?

And here is the ftp session to test this conf.:

ftp foo.bar.net
Connected to foo.bar.net
220 foo FTP server (Version wu-2.4(1) Sun Jul 31 21:15:56 CDT 1994) ready.
Name (foo.bar.net:greg): foo
331 Password required for foo.
Password:
230 User foo logged in.  Access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> put bg.gif
local: bg.gif remote: bg.gif
200 PORT command successful.
150 Opening BINARY mode data connection for bg.gif.
226 Transfer complete.
9849 bytes sent in 0.02 seconds (531.86 Kbytes/s)
ftp> dir
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
total 17
drwxr-xr-x   4 foo      users        1024 Feb 22 00:14 .
drwxr-xr-x   4 foo      users        1024 Feb 22 00:14 ..
-rw-r--r--   1 root     root            2 Feb 16 18:23 .klogin
-rw-r--r--   1 root     root            2 Feb 16 18:23 .project
-rw-r--r--   1 root     root            2 Feb 16 18:23 .rhosts
-rw-rw-r--   1 foo      users        9849 Feb 22 00:14 bg.gif
dr-xr-xr-x   2 root     other        1024 Feb 16 18:23 bin
dr-xr-xr-x   2 root     other        1024 Feb 16 18:23 etc
226 Transfer complete.
ftp> del bg.gif
553 bg.gif: Permission denied. (Delete)
ftp>

Hein? Now what my user foo can not delete his own file?

So it's all or nothing? There has to be a middle?

Any help with this whole mess would be apreciated. Thanks.

Gregory Luneau
[email-masked]

---

From: Riku Saikkonen <[email-masked]>
Date: Thu, 22 Feb 1996 02:46:13 +0200 (EET)

>Hi Folks, i'm setting up my Linux box for ftp access only for my users. =
>Heuh! What the hell! Why was my foo user able to delete a file owned by =
>root when all the file properties are saying you can't touch me?

Ah, the old "I discovered a huge security hole in rm!" feature (it's even in
the Linux FAQ). Deletion (and creation) of files depends on the permissions
of the directory, not the file. If a user has write access to a directory,
he can delete any file on it - unless you set the sticky bit (chmod +t) on
the directory (as done in /tmp) and set the owner of the directory to
someone else, in which case he can delete only files owned by himself. (This
one has nothing to do with ftpd...)

>-rw-rw-r--   1 foo      users        9849 Feb 22 00:14 bg.gif
      ^
Fix that (set the default umask for wu.ftpd to 077, or the file upload
permissions to rw-------, or something), otherwise anyone in the group
`users' can write to that file...

-- 
-=- Rjs -=- [email-masked] - http://isil.lloke.dna.fi/rjs/