Subject: wu-ftpd: guestgroup+virtual?

From: Will Brown <[email-masked]>
Date: Wed, 30 Oct 1996 18:38:20 -0500 (EST)

wu-ftpd B11

I tried using guestgroup in combination with virtual.  login to the
virtual host as a guest. The chdir() that should follow the chroot()
doesn't happen. Hmm.

connect to the "real" host and the chdir does happen. Hmm.

Started looking at the code. Relevant section seems to be in ftpd.c
lines 1433 to 1460.

Ah. There is a rather obvious conflict here. both virtual and
guestgroup have their own way to specify the chroot dir.  The way the
code is written, virtual wins by clobbering the chdir() path by
saying:

    strcpy(pw->pw_dir, virtual_root);

I propose that this can be improved. In the case where the virtual_root
is the same as the guestgroup "root" the statement above can
be skipped.

Comments?  I am going to write a patch to do this, unless someone
already has, or someone can say why this is a horrible idea.

But hmm, is there ever anything sensible to do if a guest logs in
to a virtual host and his chroot directory doesn't match the
virtual_root? Methinks not. Any other thoughts out there?

--
Will Brown
ZNS, Inc.

---

From: [email-masked] (Alvin Oga)
Date: Wed, 30 Oct 1996 15:56:07 -0800 (PST)

Hi folks
 
[ deleted ]

> already has, or someone can say why this is a horrible idea.

I was wondering, when you do this "patch" if you would consider:
A.  virtual domains that uses different IP addresses for each domain
B.  virtual domains that use ONE IP address for each virtual domain
	( this is my case and since there is only one IP address,
	( it makes chroot() to the proper virtual ftp directory difficult

	difficult- because I do not know how to extract the domain name
	from inside ftpd.c

Example:
	planet:~# ftp ftp.abc.com
	Connected to dns.abc.com.
	Name (ftp.abc.com:alvin)

	planet:~# ftp ftp.xyz.com         
	Connected to dns.xyz.com.	<<<--- this is what I would like to get
	Name (ftp.xyz.com:alvin):	       read from inside ftpd for chroot()

Please let me know if you need me to help test your patch or if you
know how to get the "connected to  machine.domain.name" message

thanx
alvin

---

From: Michael Brennen <[email-masked]>
Date: Wed, 30 Oct 1996 18:17:36 -0600 (CST)

Wierd.  I'm running beta 11 and doing exactly this without problems.  The
chroot() is happening.  I log into the ftp.virtualdomain.com, with the
login account set up as a guest, and there it is.

   -- Michael

---

From: Bob Myers <[email-masked]>
Date: Wed, 30 Oct 1996 16:31:38 -0800

> virtual host as a guest. The chdir() that should follow the chroot()

It does for me....

>     strcpy(pw->pw_dir, virtual_root);

Huh?

My copy of the code for wu-ftpd 2.4.2 B11 says this:

    if (anonymous || guest) {
        /* We MUST do a chdir() after the chroot. Otherwise the old
current
         * directory will be accessible as "." outside the new root! */
        if (anonymous) {
#ifdef VIRTUAL
            if (virtual_mode) {
                strcpy(pw->pw_dir, virtual_root);
            }
#endif 
            if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) {
                reply(550, "Can't set guest privileges.");
                goto bad;
            }
        } else if (guest) {
            char *sp;

            /* determine root and home directory */

            if ((sp = strstr(pw->pw_dir, "/./")) == NULL) {
                if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) {
                    reply(550, "Can't set guest privileges.");
                    goto bad;
                }
            } else {
                *sp++ = '\0';

                if (chroot(pw->pw_dir) < 0 || chdir(++sp) < 0) {
                    reply(550, "Can't set guest privileges.");
                    goto bad;
                }
            }

The strcpy you mention is inside the if (anonymous) clause.
It is only activated if you are an anonymous user, not a guest user.

What does your code say?
 
It sounds like you have a different B11 than I do...

-- 
Bob Myers                              InteleNet Communications, Inc.
Email: [email-masked]               30 Executive Park, Suite 150
Phone: 714-851-8250 x227               Irvine, CA 92614
Fax:   714-851-1088                    http://www.intelenet.net/

---

From: Alain Magloire <[email-masked]>
Date: Wed, 30 Oct 1996 19:53:32 -0500 (EST)

[ .. deleted..]

> A.  virtual domains that uses different IP addresses for each domain

??
That is what the actual Virtual patch is doing ... right ?

> 	difficult- because I do not know how to extract the domain name

IMHO, It's more than difficult .. it's close to impossible.

To achieve Multi-homing, you must be able to make
a distinction somehow. You can do that by getsockname()
this will return the sockaddr struct i.e the IP address.

So if for an ip adress aaa.bbb.ccc.ddd (A RR)
you have  different aliases(CNAME RR) for the same IP
say ftp1.com ftp2.com.

It will not be possible for the ftpd server to
know who you're trying to reach (ftp1.com or ftp2.com).

1- because must ftp client will do the resolving(getsockbyname())
2- all communications is base on IP addresses.

So each name ftp1|ftp2 must match an IP address.

Nowadays must operating systems provide IP aliasing
.i.e having different IPs for the same interface.

For Linux|Solaris|HP-UX10.x, it's part of the 
OS. You can achieve this on SunOS with vif.

Note: Http/1.1 allows multi-homing on a single IP
      But the protocol has been change to permit
      this. In the Headers you can pass the `HOST'
      field(ftp1|ftp2) that will permit httpd daemon
      to make the distinction.

      Also with sendmail(virtual-mail) with some
      nifty hacks in sendmail.cf

Unless FTP protocol changes multi-homing will only
be possible with different IP's.

There is some lengthy discussion on the subject
in wu-ftpd archives. 
--
alain