Subject: Re: Anonymous FTP Abuses

From: [email-masked] (Andy Church)
Date: Tue, 19 Aug 1997 13:08:36 EDT

>       Yesterday, after 3 wonderful holiday weeks, I came back to my desk and 
> after few minutes I discovered that some bad boys (or girls) have used 
> my incoming directory to put some copyrighted software.
> 
>       Of course, I have removed them but I want a way to automatically 
> detect this kind of anonymous abuses (creation of hidden directories or 
> filenames like _ ...) and/or make an operation on them.

     Well, a much simpler solution is to prevent people from being able to
read what they upload:

upload  /home/ftp /incoming  yes  root ftpadmin 0660  nodirs

drwxrwx-wt   2 root     ftpadmin     2048 Aug 19 10:22 /home/ftp/incoming/
-rw-rw----   1 root     ftpadmin    32768 Aug 19 10:22 /home/ftp/incoming/file

     Granted, this isn't perfect (you have to be root to move the files,
not just group ftpadmin), but it does the job.

  --Andy Church                  | If Bell Atlantic really is the heart
    [email-masked]       | of communication, then it desperately
    www.dragonfire.net/~achurch/ | needs a quadruple bypass.

---

From: Jon Stevens <[email-masked]>
Date: Tue, 19 Aug 97 11:25:08 -0700

here is a little perl script that i wrote that runs from a crontab, it 
sends an email with a list of the changed files in the last 24 
hours....it is generic enough to also build a URL so that it is clickable 
in an email...i also set up wu-ftpd so that the privs are 000.

i hope this helps,

-jon

#!/usr/local/bin/perl
require 'find.pl';
require 'ctime.pl';

# 0 0 * * * /export/home/accts/admin/bin/checkincoming.pl
#
# This script sends email to someone when any files in
# the list of directories changes
# need final "/" on url
$url = "";
@emailAddress = ([email-masked]');

## Set this to be the directories that you want to check.
## It is fully recursive to go down in a tree.
## need file "/" on dir name
@checkDir = ('/serv/ftpsites/clearink/incoming/');
foreach $dirname ( @checkDir ) {
        &find ( "$dirname" );
        }

foreach $address ( @emailAddress ) {
        &mailChanged();
}

1;

sub wanted {
        local ($rightTime, $dev, $ino, $mode, $nlink, $uid, $gid, $rdev, 
$size,
        $atime, $mtime, $chtime, $blksize, $blocks);

        if ( !-d && (-M $name) <= 1 ) {
                ($dev, $ino, $mode, $nlink, $uid, $gid, $rdev, $size,
                $atime, $mtime, $chtime, $blksize, $blocks) = stat( $name 
);
                $rightTime = ctime($mtime);
                chop ( $rightTime );
                ## make the url the base directory
#               $name =~ s/$dirname/$url/;
                push ( @changedFiles, $rightTime  . " -> " . $name . "\n" 
);
        }
}

sub mailChanged {
        if ( scalar (@changedFiles) > 0 ) {
                open(MAIL, "|/usr/lib/sendmail -t " );
                print MAIL "From: Incoming Folder <Tesla.FtpSite>\n";
                print MAIL "To: $address\n";
                print MAIL "Subject: What's New @ Tesla Incoming\n\n";
                print MAIL "Total Changed Files in last 24 hours: " . 
scalar(@ch
angedFiles) . "\n\n";
                print MAIL " @changedFiles";
                print MAIL "\n.\n";
                close MAIL;
        }
}

---

From: Michael Brennen <[email-masked]>
Date: Tue, 19 Aug 1997 16:39:14 -0500 (CDT)

My permissions were for the 'incoming' directory itself; I *think* Andy's
060, group 'archive', permissions are for the uploaded files themselves,
but mabye I misunderstood.  This would mean they could not be read back
except by the 'archive' group (which should *not* include the ftp user!). 

   -- Michael

On Tue, 19 Aug 1997, Roger A. Hanke wrote:

> >> This sounds perfect but yes I am still a bit confused as to the actual 
> upload directory ownership and permissions and the upload command
> that you put into ftpaccess. Michael Brennan had posted the following
> recently and I was going to try it. But his permissions are very different
> from your 060 ones. I also had not followed up with him to confirm
> that his approach also prevented the end user from seeing files in the
> directory and from overwriting them. Is that why your permissions
> were different perhaps?

  I wrote:

> Chmod the chrooted directory to 1775 permissions -- that is, turn the
> sticky bit on.  Set all users with access to the account into an exclusive
> group.  Set the upload directive to make all uploads to that account are
> owned by the admin user, permissions 755.
> 
> With the directory set 1775, all members of the group can do uploads, but
> with the sticky bit set only the admin user will be able to delete files,
> since that account owns the files. Test this to make sure it works on your
> Unix.
> >> end