Subject: An ftp directory checklist

From: Kent Landfield <[email-masked]>
Date: Thu, 15 May 1997 17:00:10 -0500 (CDT)

Things are progressing... Another version of ftpck should be available
this weekend.  I am now expanding my checking to the actual ftp directory.
I'd like to put together a sane list of checks that need to be made.

Here is my current list.  Some of these are policy decisions.  ftpck
allows sites to be able to setup which checks they wish to run by default 
and the ability to specify certain values.

I need some help expanding this list.  Ideas not listed below ? Please post
them.

----------
1. Check ownership/links/permissions/size/md5 of all ftpd root directory 
   required files and directories (~ftp, ~ftp/bin, ~ftp/etc ...)

2. Assure root (or all root equivalents) are in ftpusers file.

3. Check for "shells" file and see if the list of shells found in the 
   passwd file are in the shells file.

4. Home directory for ftp should exist, and not be /

5. The ~ftp/etc/{passwd|group} should not be the same as the real ones.

6. Check ftp directory passwd and group files do not have real info in them.

7. If user ftp exists in the system password file.
    - Assure a valid password is not specified in the password file for
      the ftp user.
    - Assure a valid shell is not specified in the password file for 
      the ftp user.

8. Check for .rhosts files.

9. Find all files and directories that are world-writable under the ftp 
   data directories

10. Find files and directories that are suid.

11. If NFS mounted, check and assure nosuid option used.

12. check the gnu tar version in the ftp area does not allow arbitrary commands.

13. Check to see if site exec disabled.

14. Check for PASV problems.

15. List binaries in _PATH_EXEC.

16. List version of ftpd being run.

17. List files in public incoming data directory.

18. Assure space used in ftp incoming directory does not exceed 
    some site specified amount

19. Check inetd.conf file for wu-ftpd and -a usage.
---------

This last one should cut down some of the traffic on the list... ;-)

-- 
Kent Landfield                        Phone: 1-817-545-2502             
The Landfield Group                   FAX:   1-817-545-7650             
Email: [email-masked]             http://www.landfield.com/
Please send comp.sources.misc related mail to [email-masked].
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/

---

From: Jason Spears <[email-masked]>
Date: Thu, 15 May 1997 18:26:56 -0400 (EDT)

> I need some help expanding this list.  Ideas not listed below ? Please post

We may also want to make sure that certain shells are _not_ listed, i.e.
/bin/false, /bin/true, /bin/noftp, etc.

Jason Spears

---

From: Bob Luckin <[email-masked]>
Date: Thu, 15 May 97 18:13:07 CDT

'Lo Kent !

> I need some help expanding this list.  Ideas not listed below ? Please post

Attaboy !  Keep up the good work !

Here's a couple more suggestions to give you somthing to do over the weekend :-

a) For guest groups etc., check that usr/bin, usr/lib etc.  directories are
   visible from each user's chrooted home directory, and that they contain
   the same files as those under the ~ftp equivalents.  (You'd need to make
   this check in case the directories haven't been hard linked.)

b) This may be going a bit far, but you _could_ add in some OS-specific checks,
   such as :
      the required timezone files/directories are in place (varies by OS)
      ~ftp/dev/tcp set to 666 otherwise passive connections fail (Solaris 2)
   etc...  If you want to go to this level of detail, I'm sure others who
   have suffered problems specific to their OS's will chip in more suggestions.

:-)

Cheers, Bob

---

From: Kent Landfield <[email-masked]>
Date: Thu, 15 May 1997 18:18:02 -0500 (CDT)

# 
# On Thu, 15 May 1997, Kent Landfield wrote:
# 
# > I need some help expanding this list.  Ideas not listed below ? Please post
# > them.
# > 
# > ----------
# > 3. Check for "shells" file and see if the list of shells found in the 
# >    passwd file are in the shells file.
# 
# We may also want to make sure that certain shells are _not_ listed, i.e.
# /bin/false, /bin/true, /bin/noftp, etc.
# 

Good idea.  Thanks Jason.

---

From: Perry Rovers <[email-masked]>
Date: 15 May 1997 23:29:45 GMT

Pink elephants with an attitude inspired Kent Landfield <[email-masked]> to tell garfield.mail.wu-ftpd:

: 2. Assure root (or all root equivalents) are in ftpusers file.
You'll probably want some more in there as well. Things like uucp etc.

: 7. If user ftp exists in the system password file.
:     - Assure a valid password is not specified in the password file for
:       the ftp user.
:     - Assure a valid shell is not specified in the password file for 
:       the ftp user.
I seem to remember there's a problem if you set the shell to something
like /bin/date which was|is the default on some systems (notably some
FreeBSD versions). /dev/null is perhaps a better one.

: 8. Check for .rhosts files.
And their permissions?

: 15. List binaries in _PATH_EXEC.
And if they're static ones or if they're missing libs perhaps?

-- 
Perry Rovers ([email-masked])

---

From: [email-masked]
Date: Fri, 16 May 97 18:00:23 +0200

Yo People,

Thanks for your response, I still have one problem but all is now
working reasonably well! What was wrong... a few things...

I wasn't used in the -a option!

One of the file in /ftp/dev was incorrectly linked and they were not
read/writeable by the world!

The guest directory needs to be just one level up from the ftp, so my
password entry looks like this... else ftp cannot find files!!

guest:x:268:21:FTP named user:/ftp/./guest:/bin/false

And now it works! well almost I still garbage when I do a simple ls,
but everything else works! is the ls issue a known bug under solaris
2.5 I get it on anonymous, guest accounts and standard logins (using
ftp). If I use truss it conplains about a missing file.

/usr/platform/SUNW,SPARCstation-5/lib/libc_psr.so.1

But this isn't there and doesn't seem to upset anyone else...

Mark

---

From: Kent Landfield <[email-masked]>
Date: Fri, 16 May 1997 13:31:54 -0500 (CDT)

# Pink elephants with an attitude inspired Kent Landfield <[email-masked]> 
# to tell garfield.mail.wu-ftpd:

Pink elephants ? :)

# : 2. Assure root (or all root equivalents) are in ftpusers file.
# You'll probably want some more in there as well. Things like uucp etc.

What if it checked for all users below a certain level ?  In the past, it
was customary to have system accounts below a certain uid (in my case
100) and users @ or above that point.  Would it make sense to check all 
accounts below a certain level for inclusion in the ftpusers file ?

# : 8. Check for .rhosts files.
# And their permissions?

I normally consider it an error to have one there at all.  Do people really 
use the 'r' commands to put things into their ftp archives ? Am I missing
something ? (Sure wouldn't be the first time.)  If that's the case I might
want to check for .shosts files used by ssh...

# : 15. List binaries in _PATH_EXEC.
# And if they're static ones or if they're missing libs perhaps?

Since library use is extremely application and operating system specific 
I'll provide a function that admins can add this information to if they 
need to for testing.  You'll see what I mean in the next version. 

Thanks Perry.

---

From: Kent Landfield <[email-masked]>
Date: Fri, 16 May 1997 14:29:09 -0500 (CDT)

# # : 2. Assure root (or all root equivalents) are in ftpusers file.
# # You'll probably want some more in there as well. Things like uucp etc.
# 
# What if it checked for all users below a certain level ?  In the past, it
# was customary to have system accounts below a certain uid (in my case
# 100) and users @ or above that point.  Would it make sense to check all 
# accounts below a certain level for inclusion in the ftpusers file ?

Well, I'll answer my own question... ;) Simply checking every account
under a certain level works nicely as long as 'ftp' and guestuser accounts
are not in that range. ;-) Sticking them in the ftpusers file disables 
your anonymous ftp and guest accounts very nicely... :)

---

From: Bob Luckin <[email-masked]>
Date: Fri, 16 May 97 16:20:58 CDT

> your anonymous ftp and guest accounts very nicely... :)

Yes, you probably want an option to warn people about the accounts below
a certain level rather than sticking them into ftpusers automatically...

Nice one !  :-)

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "No stab - mock combat's off !"

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Fri, 16 May 1997 23:23:31 +0200 (MET DST)

> Pink elephants ? :)

Yeah. Don't you run into those ?

> want to check for .shosts files used by ssh...

As an extra line of defense you can have :

----------   1 ftpadmin root            0 Aug  4  1994 .forward
----------   1 ftpadmin root            0 Aug  4  1994 .rhosts

This makes sure an attempt to create a .forward and/or .rhosts will fail.

I think this should go under 'optional'.

										   Grtx KH

-- 
  Koos van den Hout,     Internetter, Unix freak, ISFJ and BBS SysOp at large
  [email-masked] (Work)  <-- finger -l for PGPkey      Fax: +31-30-2586290
  [email-masked] (Home)                      Workphone: +31-30-2586287
  http://www.cetis.hvu.nl/~koos/   Looking for a license plate with "RFC 822"
  Microsoft thinks "open systems" means they can leave out security.

---

From: Perry Rovers <[email-masked]>
Date: 17 May 1997 10:33:28 GMT

Pink elephants with an attitude inspired Kent Landfield <[email-masked]> to tell garfield.mail.wu-ftpd:
: # Pink elephants with an attitude inspired Kent Landfield <[email-masked]> 
: # to tell garfield.mail.wu-ftpd:

: Pink elephants ? :)
The other option is a flock of rogue penguins.. what's your choice? :)

: # : 2. Assure root (or all root equivalents) are in ftpusers file.
: # You'll probably want some more in there as well. Things like uucp etc.

: What if it checked for all users below a certain level ?  In the past, it
: was customary to have system accounts below a certain uid (in my case
: 100) and users @ or above that point.  Would it make sense to check all 
: accounts below a certain level for inclusion in the ftpusers file ?
Well, you already answered this :) I think you should include a check
for the 'logical' candidates and 'normal' (if you can use that term) Unix
administrative accounts (ehm.. is wu-ftpd running on non-Unix platforms
anyway?). Checking for a range of uids might be ok for some sites, but not
enough for others. It's an optional thing mostly, apart from the root
and ftp accounts.

: # : 8. Check for .rhosts files.
: # And their permissions?

: I normally consider it an error to have one there at all.  Do people really 
: use the 'r' commands to put things into their ftp archives ? Am I missing
: something ? (Sure wouldn't be the first time.)  If that's the case I might
: want to check for .shosts files used by ssh...
Yep. And as Koos pointed out, you could check for:
- existence
- permissions (should be 0600 or 0400)
- size (if it's not 0, you might want to echo something)

: # : 15. List binaries in _PATH_EXEC.
: # And if they're static ones or if they're missing libs perhaps?

: Since library use is extremely application and operating system specific 
: I'll provide a function that admins can add this information to if they 
: need to for testing.  You'll see what I mean in the next version. 
Uh-huh.. I'll be watching that very closely now you know ;-)
As a default you could run something like ldd on the files of course.

: Thanks Perry.
You're welcome. Now back to my faqbook mailbox :)

---

From: Mick Sheppard <[email-masked]>
Date: Sun, 18 May 1997 02:46:00 +0100 (BST)

This is an auto-generated reply.

I am no longer working at PSINet.

If this was a PSINet UK query please resend to [email-masked]'.
If it was a Nominet related query please resend to [email-masked]'.
If it was a personal message please resend to [email-masked]'.

Regards,

Mick Sheppard