Subject: Re: server using system passwd for cd ~user commands

From: Tom Lojewski <[email-masked]>
Date: Sun, 22 Dec 1996 00:12:33 -0800 (PST)

Alain Magloire writes:
> 
> The expand of "~" is done by wu-ftpd
> On my SunOS4 boxes the behaviour is right
> if you loggin anonymous and try to do 
> cd ~username
> and username is not defined in ~ftp/etc/passwd
> you'll get the "550 ..Unknow user.." error
> Eventhough username is a real user.
> 
> Now i didn't try this on Solaris.
> but If you find it to be a nuisance
> you can disable the behaviour by
> recompiling.
> 
> in ftpcmd.y, look for pathname:
> and get rid of the strncmp(..,"~")
> this will stop the globbing for ~

Thanks, I may try this.  Someone on the list suggested I try putting
the following line in my /etc/nscd.conf file:

enable-cache   passwd   no

I did this and it solved my problem.  Which is scary.  It means that
on Solaris, the system passwd file is cached even in a chrooted
environment.  This could possibly lead to other vulnerablities.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ Tom Lojewski  ([email-masked])   =+=     ProNet Consulting  Alameda, CA +
+                                   =+=                                    +
+ phone: (510)864-8633              =+=                  fax:(510)864-8637 +
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++