Subject: Re: [[email-masked]: wu-ftpd beta 13 \ Upload Ownership/Permissions Bug]

From: Jim Dennis <[email-masked]>
Date: Fri, 20 Jun 1997 19:17:13 -0700

> There is a potentially serious bug in ftpd.c in wu-ftpd beta 13.  I have
> no idea if it exists in previous betas.  I don't think this was a problem
> in beta 11, but I've not kept any older source.  If you are not running
> beta 13, check this against your source.
> 
> During anonymous login, the /./ is not clipped off the struct passwd
> pw->pw_dir field that is saved as the chroot directory in ftpd.c.
> 
> Because the /./ is still on the end of the pw->pw_dir field, upl_check()
> 'upload' directive processing will fail in extensions.c because the file
> name paths will not compare.  It is highly unlikely that the upload
> directive root path would also have the /./ on the end.

	I don't think that the beta 12 has this problem.
	(I've used the upload directive to set ownership and
	permissions on incoming directories with beta 12 -- and
	tested it.  They seemed to be doing what I wanted.

	I'm curious about the behavior of the 'guestgroup' and
	'autogroup' directives, though.

	It seems that 'autogroup' (set effective group rights
	based on class) is only checked for the anonymous user --
	and not for users in 'guestgroups'.  I say it seems that
	way because I'm willing to beleive that I just don't 
	understand the docs and that my test cases were all wrong.

	Some time ago I sent a message to ask about this and 
	submit it as an enhancement request.  I never heard back.

	I'm also curious if any work is being done on a PAM
	(pluggable authentication modules) version of wu-ftpd.

	It seems that a PAM version would allow sites to use
	S/Key (OPIE -- one-time passwords), shadow, MD5 (or 
	even some as yet unwritten SHA-1), pwdb, or other 
	(possibly future) password and account management 
	technologies without requiring further changes to the 
	ftpd code.

	That would be a great boon to sys admins everywhere -- 
	particularly to maintainers of corporate FTP sites that
	are under increasing pressure to provide reasonably secure
	non-anonymous access points to allow internal employees and
	contractors to exchange files with external contractors and
	consultants (and other business associates).

	It's been one of the things recently that's made be wish I 
	could take a couple months off and learn more C programming.

	Finally, I'm curious about the references to ACL support 
	that I've been seeing in the WU-ftpd betas.  How is that 
	coming?  Where is it documented (or when will it be)?

	So, how is the project going?  Is there any place I can
	get a "wishlist" or some sort of prospectus?  What sorts of
	help do you need (from non-programmers)?

--
Jim Dennis,                                [email-masked]
Proprietor,                          [email-masked]
Starshine Technical Services              http://www.starshine.org

        PGP  1024/2ABF03B1 Jim Dennis <[email-masked]>
        Key fingerprint =  2524E3FEF0922A84  A27BDEDB38EBB95A