Subject: How to prevent "cd .." ?

From: Dave Kochan <[email-masked]>
Date: Thu, 6 Feb 1997 12:09:40 -0700 (MST)

I am new to wu-ftpd and have what is probably
a rather simple question.

I have just built, installed, and (partly) configured wu-ftpd-2.4
under Solaris 2.5.  The machine on which it is running is our
virtual web server, and my intention is to have customers be
able to modify their own pages strictly by ftp, i.e., this
machine will have only ftp access.

How can I prevent users from changing out of their home
directory tree?

Thanks much,

Dave Kochan
System and Network Administrator
NetONE - Logan, UT

---

From: [email-masked]
Date: Thu, 6 Feb 1997 14:38:57 -0500 (EST)

> How can I prevent users from changing out of their home

I've got a rather lengthy (and undocumented...) set of patches to the Academ
Consulting wu-ftpd 2.4-beta 11 that implements what I call "realms" so that
I don't have to duplicate the guest/anonymous file structure everywhere. 
The patches basically allow me to "give away" access to a designated real
user to a "fake" FTP account.  The home directory cannot be changed out of,
nor can any operations be performed that will access files outside of the
user's realm.  The user can perform the normal set of file system
operations, as if the realm was a chrooted directory.

I had thought about letting this code out, but with all of the security
implications surrounding it, I decided to let someone else come up with
a better system.  I'm not really keen on seeing my name in email messages as
the originator of another glaring security hole in wu-ftpd.  The work is
also owned by the company I work for; they probably aren't interested in
giving it away.  The work was performed under contract to a client.

Jon Yarden, System Admin, Internet Tool & Die

---

From: Michael Brennen <[email-masked]>
Date: Thu, 6 Feb 1997 13:43:04 -0600 (CST)

guest FTP.  See the howto below.

   -- Michael

> How can I prevent users from changing out of their home

This is the location for the latest wu-ftpd.  You can't see the
directory contents, but get the file anyway.  It's there.

ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-12.tar.Z

wu-ftpd FAQ:  http://www.hvu.nl/~koos/wu-ftpd-faq.html
              OR
              send mail to [email-masked]
              with a subject line: send faq

guest howto:  ftp://ftp.fni.com/pub/wu-ftpd/guest-howto
              OR
              send mail to "[email-masked]"
              (immediate autoresponder; subject does not matter)

There are additional security references in the above docs.