Subject: upload problem for anonymous users

From: [email-masked] (Bob Hardy)
Date: Mon, 7 Apr 97 16:03:36 PDT

Howdy, folks!  I could use some help.

I've got a wu-ftpd server that's been in service for years, and
recently went to wu-2.4.2-academ[BETA-13].  I don't think my problem
is particularly related to the upgrade, but I suppose it could be.
This server is running SunOS 4.1.3.

Suddenly today, anonymous users cannot upload anything.  They can try,
and the file is opened, but then:

   ftp> cd incoming
   250 CWD command successful.
   ftp> bin
   200 Type set to I.
   ftp> put dorothy.jpg
   200 PORT command successful.
   550 fchown: Not owner.

...and what's left is a zero-byte file, with what appears to be the
correct user and group ownership.  I've looked at my passwd and group
files, as well as my ftpaccess, etc., and cannot find the problem, or
even anything that has changed recently enough to be a likely cause
for this problem.  I've checked the NIS passwd and group maps, and
didn't find anything wrong there, although that is where I thought I
might, since the maps change often, and might cause a rather sudden
problem like this.  I DON'T want to tear the server down and start
from scratch, if it can be helped!

Ideas and suggestions are solicited.  I've looked at the FAQ yet
again, but it's *always* possible that I've missed something...

Thanks!

                                -- Bob

---

From: Alain Magloire <[email-masked]>
Date: Mon, 7 Apr 1997 20:39:16 -0400 (EDT)

Salut A Vous, O Grand Manitou Bob Hardy !!

>    200 PORT command successful.

without much thoughts, I see two reasons

1-
  Your server is not running as root

check inetd.conf

2-
  uid and gid specify in ftpaccess are wrong

Are you loggin anonymous ?

> again, but it's *always* possible that I've missed something...

give a bit more info
.i.e type of OS and the upload line in ftpaccess

good night

-- 
au revoir, alain
----
Aussi haut que l'on soit assis, on est toujours assis que sur son cul !!!

---

From: [email-masked] (Bob Hardy)
Date: Mon, 7 Apr 97 17:57:54 PDT

> From: Alain Magloire <[email-masked]>
> Date: Mon, 7 Apr 1997 20:39:16 -0400 (EDT)

> Salut A Vous, O Grand Manitou Bob Hardy !!

And Salut A Vous, Alain!  (You wild and crazy guy!)

> check inetd.conf

It says:

   ftp     stream  tcp     nowait  root    /usr/local/etc/ftpd     ftpd -a

That hasn't changed recently, by the way.

>   uid and gid specify in ftpaccess are wrong

I've changed them several times today because of this problem, but
currently, they are:

   upload /u/ftp /incoming yes ftp guest

> Are you loggin anonymous ?

Am I... you mean, now?  No, but I can do it at any time for testing
purposes!  What would you like me to try?

> .i.e type of OS

I said it was SunOS 4.1.3.

 and the upload line in ftpaccess

Please see above.

Bon soir!

                                -- Bob

---

From: Alain Magloire <[email-masked]>
Date: Mon, 7 Apr 1997 22:55:29 -0400 (EDT)

> And Salut A Vous, Alain!  (You wild and crazy guy!)

B-D, it sounds about rigth

> > >    200 PORT command successful.

Ha ! za mystery ! lets investigate

We assume the server runs as root and
it's compile with UPLOAD enable

The only place ftpd is doing
and fchown() is here. when storing('put' command for the client)

..
        oldid = geteuid();
 ....
        (void) seteuid((uid_t) 0);
        if ((fchown(fdout, uid, gid)) < 0) {
            (void) seteuid(oldid);
            enable_signaling(); /* we can allow signals once again: kinch */
            perror_reply(550, "fchown");
            return;
        }
        (void) seteuid(oldid);
...
#endif /* UPLOAD */

> > >    550 fchown: Not owner.

Looking at the <sys/errno.h>:
#define EPERM           1               /* Not owner */

man fchown 
...
    EPERM               The user ID specified by  owner  is  not
                        the current owner ID of the file

                        The group ID specified by group  is  not
                        the  current group ID of the file and is
                        not in the process' supplementary  group
                        IDs,  and  the  effective user ID is not
                        the super-user.

so conclusions:
1-
        (void) seteuid((uid_t) 0);
failed !!!

2-
        fchown(fdout, uid, gid)
failed !!

3-
  ??? someone else ???

is pub/incoming exported(nfs/afs/rfs) ?
maybe it's how you import/export pub/incoming

One way to confirm this theory is to trace the server

loggin as anonymous (ftp -d localhost)
find the pid of the ftpd server(ps -auxww|grep ftpd)
trace the system calls (trace -p ftp.pid)
on the client:
ftp> cd incoming
ftp> put juliette.romeo

see if the seteuid() or fchown() failed(return -1)

later, goodnight
-- 
au revoir,(The master Detective) alain