Subject: Re: wu-ftpd: guestgroup+virtual?

From: Will Brown <[email-masked]>
Date: Wed, 30 Oct 1996 20:44:16 -0500 (EST)

> Bill Myers said:
> My copy of the code for wu-ftpd 2.4.2 B11 says this:

(code elided)

Mine is different, (probably missing one of your patches Bill :) The
following fragment:

#ifdef VIRTUAL
            if (virtual_mode) {
                strcpy(pw->pw_dir, virtual_root);
            }
#endif 

occurs before the test for if(anonymous || virtual).

With your version, guestgroup would seem to always take precedence
over virtual_root. So if someone logs into a virtual IP as a guest
user that is meant for the "main IP" or some other virtual IP, I
think they get guest privileges (and chroot) according to the path in
the passwd file.

Probably a good fix. Passwords should prevent such abuse from occuring.

--
Will Brown
ZNS

---

From: Bob Myers <[email-masked]>
Date: Wed, 30 Oct 1996 19:04:10 -0800

> occurs before the test for if(anonymous || virtual).

Oops, you're right.  I did "fix" the code like this.  Should have
checked 
my changes before posting that last message, but I forgot I'd modified
that.

> Probably a good fix. Passwords should prevent such abuse from occuring.

Well, that's what I thought...