Subject: Re: Directory owner/group in upload

From: Alvaro Martinez Echevarria <[email-masked]>
Date: Sun, 2 Feb 1997 00:29:03 +0100 (MET)

On Fri, 31 Jan 1997, Mark Galbraith wrote:

> Alvaro> Actually the problem isn't that the chmod() could fail, but probably
> Alvaro> something more serious. Consider the following situation:
> Alvaro> [...]
> Alvaro>                             vi /etc/passwd
> 
> Of course, you could be using ~ftp/etc/passwd as an example, meaning
> that any file in the ftp area is vulnerable.  On this, I agree.  The

Of course, /etc/passwd was just an example. It could be any other file,
and not only on the ftp area, but in the whole filesystem where the ftp
is located, because the "evil user" could have done a hard link on the
file instead of a symlink on the directory:

ftpd            evil user
----            ---------
                mkdir foo1
                mkdir foo2
                ln /etc/passwd foo1/passwd
                ftp> mkdir foo2/passwd
mkdir(foo2/passwd)
                mv foo2 foo0
                mv foo1 foo2
chown(foo2/passwd,XXX)
                vi /etc/passwd

And this time it's the real /etc/passwd the one to get compromised.
As I told on my last email, I just can think of a couple of useless
examples, but there is a legion of "evil users" out there in the
internet who will be very happy with their new toy :-)

> moment you allow uploads of any kind, you have created a vulnerability.

I don't quite agree. If the program is well designed and written, and
the system is well configured, why should there be a vulnerability?

> The only questions now is how vulnerable do you want to allow your system
> to be?  And is there a way to reduce that vulnerability while still
> providing the functionality necessary?

My opinion is that security must be a first order concern in any system.
The worst "loss of functionality" happens when someone decides to remove
every single file in your disks just because you had forgot to fix "that
stupid security hole". I have seen that a couple of times, believe it or
not. And anyway, in this specific case, trying to write the code in a
more secure way does not cause any side problem (at least in the user, I
am not considering the headaches in the programmer). I mean, you can
still make your subdirectories, can't you?
Regards.

.------------------------------------------------------------------.
|   Alvaro Martínez Echevarría   |   LANDER SISTEMAS               |
|        [email-masked]        |   Pº Castellana, 121, 2ºC dcha  |
`--------------------------------|   28046 Madrid, SPAIN           |
                                 |   Tel: +34-1-5562883            |
                                 |   Fax: +34-1-5563001            |
                                 `---------------------------------'

---

From: Paradise Cowgirl <[email-masked]>
Date: Mon, 3 Feb 1997 10:51:04 -0800 (PST)

Hello, again,

(Yes, I've got dynamic ls working on Solaris, I will update everyone as
soon as I have everything I need working :-)

I would like to set up a directory tree (ie, /home/top) so that several
users (user1, user2, user3, etc) have guest access to it (they're all
chrooted to /home/top), are chdir'ed to the next level (ie, junk1, junk2,
junk3, etc) and then use ftpaccess in conjunction with Unix file/directory
permissions to restrict upload access where user1 is a member of group1,
user2 in group2 and user3 in group3.

The upload part of my ftpaccess file looks like:

upload	/home     *      no
upload  /home/top /junk1 yes     guest     group1  0775 dirs 
upload  /home/top /junk2 yes     guest     group2  0775 dirs 
upload  /home/top /junk3 yes     guest     group3  0775 dirs 

Yes, I want all files owned by yet another user that is not the original
user who uploaded the file, don't ask :-) I also want files/directories
group writable.

I have just applied Alvaro's patch to beta 11 and now have the following
behaviour:

Regardless of which user I am (user1, user2, or user3), directories
created are owned by guest/group3. The owner is correct, but the group is 
always group3. If I move the "junk1/group1" upload line to the last line of 
upload section, then all directories created are then owned by guest/group1.

Files uploaded however, show the expected behaviour, owned by guest and
the group as specified by the upload line...

Help? Should I be using beta-12 instead? :-)

Cheers,
Darci Chapman ([email-masked])
--
            "the days run away like horses over the hills"
	               To the motion be true.
          Everything is on its way to somewhere. Everything.

---

From: Paradise Cowgirl <[email-masked]>
Date: Mon, 3 Feb 1997 11:08:18 -0800 (PST)

Hello,

I just discovered I've made a wrong assumption (not unusual :-).

For things like the "rm" and "del" commands, wu-ftp is NOT adhering to
the Unix file permissions. For example, even when I exlicitly set files
and directories to be not group writable and not owned by that guestgroup
user, under wu-ftpd that guestgroup user can delete these files and
directories because they have explicit upload permissions from the ftpaccess 
file.

Is this observation correct? Is this desirable?

Cheers,

---

From: Alvaro Martinez Echevarria <[email-masked]>
Date: Tue, 4 Feb 1997 04:34:37 +0100 (MET)

On Mon, 3 Feb 1997, Paradise Cowgirl wrote:

> Date: Mon, 3 Feb 1997 10:51:04 -0800 (PST)
> From: Paradise Cowgirl <[email-masked]>
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: Directory owner/group in upload
> Resent-Date: Mon, 3 Feb 1997 22:51:50 +0100 (MET)
> Resent-From: Roberto Lumbreras Pastor <[email-masked]>
> Resent-To: Alvaro Martínez Echevarría <[email-masked]>
> 

Well, this is weird. I am using a very similar configuration in the server
I had to make the patch for. These are a few lines (I have a lot of upload
rules):

upload  /home/company  *             no
upload  /home/company  /main         yes     company   admin   0664   nodirs
upload  /home/company  /sport        no                               nodirs
upload  /home/company  /sport/ftp    yes     company   sport   0664   dirs
upload  /home/company  /sport/web    yes     company   sport   0664   dirs
upload  /home/company  /economy      no                               nodirs
upload  /home/company  /economy/ftp  yes     company   economy 0664   dirs
upload  /home/company  /economy/web  yes     company   economy 0664   dirs
upload  /home/company  /science      no                               nodirs
upload  /home/company  /science/ftp  yes     company   science 0664   dirs
upload  /home/company  /science/web  yes     company   science 0664   dirs

> the group as specified by the upload line...

That sounds terrible. I've been working with that configuration for
a lot of time with no problems at all (but the version of wu-ftpd I've
been using is rather old). I don't know, maybe the patch doesn't work
properly with a so newer version. I'll take a look at the sources to see
if I can find anything.
Regards.

---

From: Evan Champion <[email-masked]>
Date: Mon, 3 Feb 1997 23:08:17 -0500 (EST)

> I had to make the patch for. These are a few lines (I have a lot of upload

I modified my wu-ftpd to allow 2 new tags, :user: and :group: to be used 
in the place of the user and group name on an upload line.  These tags 
let you set the user and/or group for uploaded files to be the same as 
the directory they're being uploaded to.

That means 1 rule takes care of my entire ftp tree with a thousand or so 
incoming directories.  I force the upload permissions to 0600 for 
security reasons; that way no one can download files once uploaded, so it 
keeps the pirates away.

I sent in these patches around 2.4.2beta9 but they must have been lost in 
the shuffle.  If they are of general use I'll prepare diffs and send them 
in again.  The changes are really quite trivial.

Evan
--
Evan Champion            * Director, Network Operations
mailto:[email-masked] * Directeur, Exploitation du reseau
http://www.synapse.net/  * Synapse Internet

---

From: Mark Galbraith <[email-masked]>
Date: Tue, 4 Feb 1997 09:06:15 -0800 (PST)

>>>>> "Evan" == Evan Champion <[email-masked]> writes:

Evan> I modified my wu-ftpd to allow 2 new tags, :user: and :group: to
Evan> be used in the place of the user and group name on an upload line.
Evan> These tags let you set the user and/or group for uploaded files to
Evan> be the same as the directory they're being uploaded to.

I'd be interested in seeing the patch.  I'm still using 2.4, but would
be interested in the behavior you've created.

-- 
Mark Galbraith                   Member of The HTML Writers Guild
Engineer, Internet Services	              http://www.hwg.org/
Triad Systems Corporation
(PGP Fingerprint=1CB9 7481 AD5C 5709  690B AC09 7F65 D6F6)