Subject: WU-FTPD:Re:

From: [email-masked] (Christofer Hoff)
Date: Thu, 1 Aug 1996 15:44:11 -0700

Hello All!

Being new to this ListServ, I am sure this issue has been
raised before, but alas I am not privy to it's solution.

I am running wu-ftpd 2.4 under Solaris 2.5.  I am able to
compile the daemons successfully, however GCC issues a
compiler error/warning during the build:

---------------------------

hercules% build sol
make args are : 
make opts are : 

Linking Makefiles.

Making support library.
gcc -g -DDEBUG   -c fnmatch.c
gcc -g -DDEBUG   -c strcasestr.c
gcc -g -DDEBUG   -c strsep.c
gcc -g -DDEBUG   -c authuser.c
In file included from authuser.c:7:
/usr/include/arpa/inet.h:46: warning: `struct in_addr' declared inside parameter list
/usr/include/arpa/inet.h:46: warning: its scope is only this definition or declaration,
/usr/include/arpa/inet.h:46: warning: which is probably not what you want.
/usr/include/arpa/inet.h:46: warning: parameter has incomplete type
/usr/include/arpa/inet.h:49: warning: parameter has incomplete type
/usr/include/arpa/inet.h:50: warning: parameter has incomplete type
rm -f libsupport.a
ar cq libsupport.a fnmatch.o strcasestr.o strsep.o authuser.o
touch libsupport.a
.
.
.
(no other error messages)
---------------------------------

The daemons all function properly except in one condition:
(and thus I am suspicious of this as the culprit)

When I define the 'guestgroup' class in ftpaccess and set
up a user using the xxx/./yyy structure in the passwd file,
said user receives a strange error message upon attempting
any ftp command (ls, put, get, etc...):

220 FTP server (Version wu-2.4(4) Fri Jul 5 12:04:13 PDT 1996) ready.
Name (0:fred): bob
331 Password required for bob.
Password:
230 User bob logged in.  Access restrictions apply.
ftp> pwd
550 .
ftp> ls
200 PORT command successful.
425 Can't create data socket (0.0.0.0,20): Bad file number.

While I certainly wish the user to be chroot()'d within a
file system, this is a little extreme!  Please note that
the file system in question exists, the permissions are 
all sane and files do exist in the directory.

Any help you can give me would be REALLY appreciated as I
need this chroot() functionality QUITE badly!

Thanks,

CHris

            ,,,
           (o-o)
------.oOO--(_)--OOo.--------------------------------------------------
Christofer L. Hoff            \             No true genius is
Network Operations Manager     \             possible without a
NodeWarrior Networks, Inc.      \             little intelligent
                                 \              madness!
[email-masked]              \
http://www.nodewarrior.net         \             -Peter Uberoth
-----------------------------------------------------------------------

---

From: John Sletten <[email-masked]>
Date: Fri, 02 Aug 1996 02:45:18 +0200

Hi

I experienced the same using gcc. wu-ftpd seemed to have security holes, 
i.e. as a guest user I could delete and rename files although this 
should not have been possible because of settings in the ftpaccess file.

What I did was to modify inet.h by removing struct in_addr from the 
parameter list at the line indicated, thus ending up with an empty 
parameter list. I also had to make a similar change a couple of lines 
below as well. Remember to save a copy of the original inet.h

I dont know how sensible this was, but afterwards it compiled without 
problems and seems to be working ok.

I did not get a "cant create socket error", this I think has to do with 
missing or incorrect device files in your /dev directory in your chroot 
environment.

If anyone has an opinion on the changes i made to inet.h, I 
would be grateful to hear.

Best Regards

John Sletten
Independent Consultant
Oslo, Norway

Christofer Hoff wrote:
> ------.oOO--(_)--OOo.--------------------------------------------------> Christofer L. Hoff            \             No true genius is