Subject: Re: HELP

From: "Dmitry Maximovich" <[email-masked]>
Date: Mon, 04 Aug 97 12:58:06 +0400

Hello!

I have the following problem with wu-ftpd (Version wu-2.4.2-academ[BETA-13]) on FreeBSD 2.2.2.
I want that anonymous users may access my ftp-server only some time
a day (SaSu|Any1800-0930) and "real" users may access ftp-server in any time a day.
I wrote following ftpaccess file:

#############################################
bash-2.00$ cat /usr/local/etc/ftpaccess                            
class   friends   real            *                                
class   visitors  guest,anonymous *                                
                                                                   
limit   friends    5   Any                        /etc/toomany.msg 
limit   visitors   5   SaSu|Any1800-0930          /etc/toomany.msg 
limit   visitors   0   Any                        /etc/toomany.msg 
                                                                   
readme  README*    login                                           
readme  README*    cwd=*                                           
                                                                   
message /etc/welcome.msg            login                          
message .message                    cwd=*                          
                                                                   
compress        yes             local remote                       
tar             yes             local remote                       
                                                                   
noretrieve /etc/passwd core                                        
                                                                   
deny !nameserved  /etc/nodns.msg                                   
                                                                   
log commands  real                                                 
log transfers anonymous,real inbound,outbound                      
                                                                   
shutdown /etc/ftpshut.msg                                          
                                                                   
email [email-masked]                                                 
#############################################

After it all looks fine:

bash-2.00$ ftpwho               
Service class friends:          
   -   0 users (  5 maximum)    
                                
Service class visitors:         
   -   0 users (  0 maximum)    
                                
But something strange happens: anonymous users still _can_ access
to ftp-server in this time. It looks like this:

bash-2.00$ ftpwho                                                            
Service class friends:                                                       
   -   0 users (  5 maximum)                                                 
                                                                             
Service class visitors:                                                      
10427  ??  Ss     0:00.19 ftpd: shine.pabl.ru: anonymous/[email-masked]: IDLE 
   -   1 users (  0 maximum)                                                 
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ??????????????????????

1 users (0 maximum) (!!!!!!!!!!) I don't know what's wrong in my configuration.
                                                                             
Regards,

Dmitriy N. Maximovich
Senior Programmer.
PABL Investment Co.
Email: [email-masked]
phone: +7-(812)-325-8772

---

From: tonym <[email-masked]>
Date: Mon, 4 Aug 1997 10:53:37 +0100 (BST)

I have recently noticed that "ls" behaves strangely under ncftp for anonymous
users. I have copied the passwd and group files to <ftpdroot>/etc, and 
eventhough the group is displayed correctly, the username isn'n. The 
following is what I get for anonymous users.

ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
total 12
drwxr-xr-x  2 0    wheel   512 Jul  9 04:12 bin
drwxr-xr-x  3 0    wheel   512 Jul  9 04:19 etc
drwxr-xr-x  7 301  nobody  512 Jul 28 20:04 pub
226 Transfer complete.  

Any ideas ?

Tony Michalakopoulos
--
Lizard Internet

---

From: Minsung Kim <[email-masked]>
Date: Mon, 04 Aug 1997 14:22:51 +0000

> drwxr-xr-x  7 301  nobody  512 Jul 28 20:04 pub

If your system has seperate DB files on which the contents of passwd file is
stored, then ls (or any other passwd-accessing programs) doesn't look at it,
instead of /etc/passwd.

Copy /etc/master.passwd, /etc/spwd.db, and /etc/pwd.db into ~ftp/etc, if there
is any of these at all.

I hope this helped.

Regards,
-- 
Stair

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Minsung Kim (Stair in Cyberland)                     <mailto:[email-masked]>

---

From: [email-masked]
Date: 4 Aug 1997 16:24:41 GMT

Pink elephants with an attitude inspired Minsung Kim <[email-masked]> to tell garfield.mail.wu-ftpd:
: If your system has seperate DB files on which the contents of passwd file is
: stored, then ls (or any other passwd-accessing programs) doesn't look at it,
: instead of /etc/passwd.

: Copy /etc/master.passwd, /etc/spwd.db, and /etc/pwd.db into ~ftp/etc, if there
: is any of these at all.

Considering that these files store encrypted passwords most of the time this
doesn't sound like very good advice? Joe R. Hacker could get those files,
run crack on them at her leisure and presto.. gone is your system.

Normally you limit the info in the ~ftp/etc files to a minimum and
definitely do not store anything with real passwords there.

noretrieve passwd group in ftpaccess is also a precaution though not very
effective if you use and don't include stuff like shadow, master.passwd etc.
(but you shouldn't have those files in ~ftp/etc anyway)

-- 
Perry Rovers ([email-masked])

---

From: tonym <[email-masked]>
Date: Tue, 5 Aug 1997 01:29:11 +0100 (BST)

> (but you shouldn't have those files in ~ftp/etc anyway)

If you copy those files to ~ftp/etc, isn't "noretrieve (all above files)"
suficient to protect your machine from Joe Hacker ?

Is there any way for anonymous users to get "noretrieve" files ?

PS I've fould that only pwd.db is required underFreeBSD. Is it save to 
   copy that to ~ftp/etc ?
--
Tony Michalakopoulos
Lizard Internet

---

From: [email-masked]
Date: 5 Aug 1997 08:01:35 GMT

Pink elephants with an attitude inspired tonym <[email-masked]> to tell garfield.mail.wu-ftpd:
: If you copy those files to ~ftp/etc, isn't "noretrieve (all above files)"
: suficient to protect your machine from Joe Hacker ?
Maybe..

: Is there any way for anonymous users to get "noretrieve" files ?
I don't intend to find out by having my system hacked. I've tried this a
couple of times here and it didn't work.. but I'm not a dedicated hacker.

: PS I've fould that only pwd.db is required underFreeBSD. Is it save to 
:    copy that to ~ftp/etc ?
As long as you make sure there are no encrypted passwords in there it may be
ok. You still give out a list of users to outsiders which can only help
them in hacking but the risk is 'somewhat' less than having your passwd file
up for grabs.