Subject: Re: server using system passwd for cd ~user commands (fwd)

From: Tom Lojewski <[email-masked]>
Date: Sun, 22 Dec 1996 00:03:17 -0800 (PST)

Alain Magloire writes:
> From [email-masked] Sat Dec 21 21:21 PST 1996
> Message-Id: <[email-masked]>
> Date: Sun, 22 Dec 1996 00:06:08 -0500 (EST)
> Reply-To: [email-masked]
> Sender: [email-masked]
> From: Alain Magloire <[email-masked]>
> To: [email-masked]
> Subject: Re: server using system passwd for cd ~user commands
> In-Reply-To: <[email-masked]> from "Tom Lojewski" at Dec 20, 96 06:31:09 pm
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> X-Mailer: ELM [version 2.4 PL25]
> X-Listprocessor-Version: 7.1 -- ListProcessor by CREN
> Content-Type: text/plain; charset=US-ASCII
> Content-Length: 1319
> 
> According to `Tom Lojewski':
> > 
> > 
> > Dear wu-ftpd user,
> > 
> > I've built wu-ftpd-2.4 under Solaris 2.5.1 (libc patches installed)
> > using gcc gcc-2.7.2.1.
> > 
> > There is a user named "username" defined in the system passwd file but
> > not in the ~ftp/etc/passwd file.  His home directory is
> > "/home/username".
> > 
> > When an anonymous ftp client logs into the machine and types
> > "cd ~username" wu-ftpd responds "/home/username" no such file or
> > directory.  The chroot is working, the client itself doesn't have
> > access to the system passwd file.
> > 
> > The problem is that it lets anon users probe to see what accounts are
> > defined.
> > 
> > I suspect this is a cacheing problem with nscd.  Truss shows calls to
> > "door_info" and "door_call".
> > 
> > Has anyone experienced a similar problem?  Any help would be
> > appreciated.
> > 
> 
> The expand of "~" is done by wu-ftpd
> On my SunOS4 boxes the behaviour is right
> if you loggin anonymous and try to do 
> cd ~username
> and username is not defined in ~ftp/etc/passwd
> you'll get the "550 ..Unknow user.." error
> Eventhough username is a real user.
> 
> Now i didn't try this on Solaris.
> but If you find it to be a nuisance
> you can disable the behaviour by
> recompiling.
> 
> in ftpcmd.y, look for pathname:
> and get rid of the strncmp(..,"~")
> this will stop the globbing for ~
> 
> --
> au revoir, alain
> 

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ Tom Lojewski  ([email-masked])   =+=     ProNet Consulting  Alameda, CA +
+                                   =+=                                    +
+ phone: (510)864-8633              =+=                  fax:(510)864-8637 +
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

---

From: Tom Lojewski <[email-masked]>
Date: Sun, 22 Dec 1996 01:20:36 -0800 (PST)

> > Eventhough username is a real user.

I tested this on a SunOS4.1.4 machine and doing this causes wu-ftpd
to dump core.

> > this will stop the globbing for ~

I had posted that the following fixes my problem.  It stops revealing
my real system passwd users.  But it also causes wu-ftpd to dump core.

  enable-cache   passwd   no