Subject: A better virtual implementation?

From: Jay Soffian <[email-masked]>
Date: Sun, 21 Jul 1996 02:18:42 -0400

If anyone is interested...

I found the current virtual implentation under beta 11 to be rather
inflexible. So I decided to hack in my own virtual support. I wasn't
clear whether or not beta-11 had any security issues, and I know that
2.4 hasn't had any CERT advisories on it in quite some time, leading
me to believe it is at least as secure, if not more so, than 2.4.2
beta. So my hacks are against 2.4. But wait, it gets better (or worse,
depending on your perspective)... I hacked the support into 2.4 after
I applied the Linux patches. I also applied a patch to take care of
the pasv-mode zombie problem.

With that all said, here is a generic description of what I did
to see if anyone still wants my hacks:

Basically, wherever any portion of wu-ftpd refers to a config file of
any sort, I placed a "%s" into the file name (where it is defined in
pathnames.h). Then when I call wu-ftpd (or any of its support
programs), I pass it an argument (I use the virual host name) which it
inserts into the pathname wherever the "%s" occurs. I've written a
wrapper (in perl currently) which calls wu-ftpd with the appropriate
argument depending on which virtual IP the socket is connected to.

To make this a little clearer, here is part of my pathnames.h:

 #ifdef VIRTUAL
 #define _PATH_FTPUSERS  "/lw/ftp/conf/%s-ftpusers"
 #define _PATH_FTPACCESS "/lw/ftp/conf/%s-ftpaccess"
 #define _PATH_PIDNAMES  "/var/pid/ftp.pids-%s-%s"
 #define _PATH_XFERLOG   "/var/log/ftp/%s-xferlog"
 #define _PATH_PRIVATE   "/lw/ftp/conf/%s-ftpgroups"
 #define _PATH_ROOT      "/lw/ftp/accounts/%s"
 #ifdef  HOST_ACCESS
 #define _PATH_FTPHOSTS  "/lw/ftp/conf/%s-ftphosts"
 #endif /* HOST_ACCESS */

And here is my perl-wrapper:

 #!/usr/bin/perl
 $conf_file="/lw/ftp/conf/vftphosts";
 $mysockaddr = getsockname(STDIN);
 ($family, $port, $myaddr) =  unpack("S n a4 x8",$mysockaddr);

 open(FILE, "$conf_file") || die "Can't open $conf_file\n";
 while(<FILE>) {
    next if /^\s*#/;
    next if /^\s*$/;
    chop;
    ($hostname, $cmd) = split(/\s/,$_,2);
    ($name, $aliases, $addrtype, $length, @addrs) = gethostbyname ($hostname);
    foreach (@addrs) { exec $cmd if $_ eq $myaddr; }
 }

Then, my vftphosts file has entries like so:

 #hostname		command
 foobar.com              /local/sbin/vftpd foobar.com
 barfoo.com              /local/sbin/vftpd barfoo.com

I've also hacked addiional support for the ftpusers file. Users with a
"+" before their name are explicitly allowed. Users with a "-" before
their name, or appearing without a "+" or a "-" are explicitly
disallowed. Also, a file with a "-" at the end will deny any users
that have not appeared without a "+" entry. A file with a "+" at the
end, or no "+" or "-" at the end will allow all users that have not
been explictly denyed. Because of this implementation, it is
compatible with "old-style" ftpusers files, while still providing
additional functionality. And remember, the ftpusers file is per
virtual-host. This means you have exact control over which users are
allowed onto each virtual ftp server.

This implementation allows maximum flexibilty, since it is like having
a wu-ftpd configured for each virtual host to use its own set of
configuration files. It also allows for interesting possibilties. You
can run ftpshut on any of the virtual-hosts, and it will read that
hosts' ftpaccess to determine where to put the shutdown message. You
can also run ftpwho or ftpwhich with to determine how many users a
particular ftpd is handling. You also get to configure a 

I've been running my "vftpd" for about a month now under a light
load. As far as I can tell, I've fixed any bugs I had introduced.
I do not use the ftphosts or ftpgroups files, so I haven't really
tested them, but I think my support for them is "correct."

I should (and probably will) make a few other changes. For example,
when syslog is called, it would be nice to see which "vftpd" is making
the entry. Also, the "ftpd server ready" message which appears on
login still spits out the name of the host it is running on, and not a
"virtual" host name. These are all rather trivial changes, I just
haven't gotten around to them yet.

Anyone interested?

If enough people think that this method of virtual-ftpd support is
good, I could probably make these same changes to whatever the current
beta of 2.4.2 is. I guess that this method of virtual support could
even live alongside the current method (of virtual support). I think
that this method is much less elegant, but it provides a lot more
options for configuring vitual hosts, which is what I was looking for.

j.

---------------------------------------------------------------------------
 Jay Soffian            |       Livewire         |              [email-masked]
 Systems Administrator  |  Communications, Inc.  |  http://www.lw.net/~jay  
---------------------------------------------------------------------------