Subject: Re: Security issues

From: Michael Brennen <[email-masked]>
Date: Fri, 6 Dec 1996 08:28:23 -0600 (CST)

In ftpaccess you can put the following for the later versions of the beta
wu-ftpd: 

noretrieve /etc/passwd core /etc/ /bin/

You should remove all user account info from the password and group files
in both anonymous and guest accounts.  Give at least ~/etc and ~/bin
accounts permissions of 0111 so they cannot see the contents, though per
se that may be worth little since most will know the file names they are
looking for. 

See also <http://www.iss.net> for more anon ftp security docs. 

   -- Michael

On Fri, 6 Dec 1996, Mike Richman wrote:

> Someone was poking around my system tonight.  They grabbed a copy of
> /etc/group /etc/passwd and /etc/netconfig inside the ftp directory.
> This made me wonder just what information ought to be in those files.
> As it stood I had some usernames in the passwd and group file.  There
> were no encryped passwords though this gives me little peace of mind.
> Just what do people do to make wu-ftp as secure as possible?  Are there
> a list of tips?  Finally, once you get a poker doing this, what steps
> should be taken to keep the person who obtained real user names from
> hacking the system.

---

From: Theo Van Dinter <[email-masked]>
Date: Fri, 6 Dec 1996 04:40:30 -0500 (EST)

> Just what do people do to make wu-ftp as secure as possible?  Are there

I have a script to go through the /etc/passwd file, strip all passwords
and information from the entries (get it down to username, uid, gid ...)
and throw that into the /etc directory off of the ftp server...  I've
since stopped using it since it gives outsiders a list of users on my
system.  Now the password file on the ftp server has all the normal UNIX
users listed (all passwords are '*'), and then a fake user as the UID/GID
that adds things to the public FTP section.

If a user logs in, they're not chroot'ed, so the ftp server uses the
system-wide password/group files, so nothing's affected whether you come
in through anonymous or user mode...

Just my two cents worth. 8)

--
-----------------------------------------------------------------------------
Theo Van Dinter				 www: http://www.kluge.net/~felicity/
Vice-President WPI Lens and Lights	       Active Member in SocComm Films
Member of WPI ACM			       AME for the Masque B-Term Show

                   A man should live forever, or die trying.
-----------------------------------------------------------------------------

---

From: "Misja van Wijhe" <[email-masked]>
Date: Fri, 6 Dec 1996 09:24:21 +0100

On Dec 6, 12:34am, Mike Richman wrote:
> Subject: Security issues
> TIA,
> Mike Richman
> U. Oklahoma
> [email-masked]

I added in the ftpaccess file the following:
noretrieve /etc/passwd /etc/group /etc/nsswitch.conf /etc/netconfig core

This makes the designated files non-downloadable , so any files you do not
want to be downloaded should be given a noretrieve entry.

Misja van Wijhe			email: [email-masked]
Junior Unix System Manager
Alcatel Telecom Netherlands

---

From: Chuck Davis <[email-masked]>
Date: Fri, 06 Dec 1996 10:47:10 EST

> should be taken to keep the person who obtained real user names from

The only thing I keep in my ~ftp/etc/passwd file is:

ftp:*:500:1::/var/tmp:/usr/bin/false

I don't understand why it's necessary to have other accounts in the ftp
passwd file(?).  I have ftp-only users but these are of the chrooted
variety (shell = /bin/false, login dir = /ftphome/./user) and their entries
are in the regular passwd file.  I haven't had any trouble w/ this config
*yet*.  ~Please~ don't try.  :)

As for hacking the system, monitor the logs.  In the case of using real
accounts, 'lastb -R' is handy.  (On the system here the -R shows where the
login failure originated.)  I check these on a daily basis.  There are many
other checks to you can make.

Take a look at ftp.win.tue.nl/pub/security.  Last time I looked there was
an excellent document about improving your security by breaking into to it.
Plus there are numerous tools.  There are also quite a few books (check
O'Reilly books at www.ora.com) on the subject.  Or do a web search on
computer/security...

Regards,

Chuck Davis

---

From: Mike Richman <[email-masked]>
Date: Fri, 6 Dec 1996 00:34:56 -0600 (CST)

TIA,

Mike Richman
U. Oklahoma
[email-masked]