Subject: user account cracking status

From: "Roger A. Hanke" <[email-masked]>
Date: Fri, 6 Jun 1997 16:31:31 -0400

Dear WUFTPD'ers,

 First new piece of info, is try the same exercise on your native FTP server.
On IRIX 6.2 I was prompted for password as expected.
On Solaris 2.5.1 I got the same result as with my WUFTPD B13 version:

220 hdpst01 FTP server (UNIX(r) System V Release 4.0) ready.
Name (hdpst01:rah): garbage
530 User garbage access denied.
Login failed. 

 Next new piece of info was the one other person that reproduced the same
problem with B13 now claims her version is working fine. Everyone else
that responded (yes 100% for you lurkers out there) was completely secure
(well, at least in this area ;-)

 Final piece of info was by putting a real class into my ftpaccess file the 
problem goes away, as long as the ftp client meets the access restriction
on that real line. I did not have a real class on purpose since this is a public
download server that anyone can bang against. If they broke in I at least 
wanted them chrooted someplace to protect the core server files. 
Anyway you can test this easily by commenting out your real class line
(if anyone does this and still gets prompted for password on a garbage
username please let me know!). Also you can make your real class line
too restrictive, so that your test ftp client does not have access and again
you should see the access denied after username before password prompt.

 So I do not want to add a real class line, nor do I feel I should have to just
to ensure I always get a password prompt. I realize I could list every real
account in ftpusers to deny them access but this introduces maintenance
issues and can get out of sync. I would classify this problem as a bug in
WUFTPD. I believe it should always prompt you for username and password
before any errors, including access denied are issued. 

 Does anyone with more familiarity with the code have any guesses on how
difficult a patch this might be? I am also open for suggestions on any
workarounds besides putting in "class everybody real *" in my ftpaccess file.

 Thanx for your patience if you made it this far ;-)
	Roger Hanke

------------------------------------------------------------------------------------
 Roger A. Hanke              AT&T Web Site Services
 (908)949-4091                   [email-masked] or
 FAX (908)949-7171                    [email-masked]
 HO 6C-111                         http://lynxhub.ho.att.com/~rah/	
------------------------------------------------------------------------------------

---

From: Alain Magloire <[email-masked]>
Date: Fri, 6 Jun 1997 18:03:37 -0400 (EDT)

Bonjour Roger

> 530 User garbage access denied.

...

> difficult a patch this might be?

A patch should not be hard to do. In ftpd.c, the fucntion user() 
calls access_ok() which will return 0 because they're is no class
directive in the ftpaccess file and logs you out with :

"530 User .."

ftpd.c ----
user(char *name)
..
{
...
    if (access_ok(530) < 1) {
        reply(530, "User %s access denied....", name);
        syslog(LOG_NOTICE, "FTP LOGIN REFUSED (access denied) FROM %s [%s], %s",
               remotehost, remoteaddr, name);
        return;
...
}

access.c----
access_ok(int msgcode)
...
    /* if user is not in any class, deny access */
    if (!acl_getclass(class)) {
        syslog(LOG_NOTICE, "ACCESS DENIED (not in any class) TO %s [%s]",
               remotehost, remoteaddr);
        return (0);
....

> I am also open for suggestions on any

when compiling set use_accessfile to 0, so you  won't have to use
the ftpaccess file.

>  Thanx for your patience if you made it this far ;-)

Sure :-), this mail was forward to me by a coworker. I did not see any
previous posting, but I think you came up with some valuable info.

please CC me on any followups, many thanks

-- 
au revoir, alain
----
Aussi haut que l'on soit assis, on est toujours assis que sur son cul !!!