Subject: Proposition for safer default-config

From: "T's Mailing Lists" <[email-masked]>
Date: Wed, 8 Oct 1997 12:56:03 +0000 (GMT)

Problem: if one switches from a Debian wu-ftpd to academ one might get an
         insecure server where download of f.ex. /etc/passwd becomes
         possible because users are not chrooted.

Version: from Debian wu-ftpd (maybe original wu-ftpd too, if anybody's
         interested, then please test it with the original) to academ
         (2.4.2.15 and a few lower ones)

Details: Original ftpaccess file (not relevant stuff left out!):
	 class   any   real,guest,anonymous *
	
	 Original /etc/passwd (dito):
	 a_user:x:99:class_B_users:I am a user:/home/a_user/./:/bin/true

         Here deb-wu-ftp will chroot to the users dir, where as academ
         doesn't. That means that if you do not test your setup with all
         possible groups, you might have missed one, and that one will
         have access to the whole file-sys.

	The academ doc/examples/ftpaccess does exactly the same thing:
	class   all   real,guest,anonymous  *

	that means that by default all users with a correct
	username/passwd will be able to see the whole fs, as the setting:
	private         yes
	seems to be the default.

	The other thing is that if a user is not in the "guestgroup", he's
        automatically private so he doesn't get chrooted.

Proposition: Either:
	a) change academs behaveour to >allways< chroot if a users homedir
	   contains /./
	b) change the default from "private yes" to "private no".
	c) enforce the use of "privategroup groups" with the effect that
           if someone's not in privategroup then he's at least in
           "guestgroup". Even better would be if not in privategroup and
           not in guestgroup then not allowed.
	d) change at least the doc/examples from

	   class all real,guest,anonymous *

	   to

	   class all real,guest,anonymous *
 	   private no
	   # guestgroup's empty
	   guestgroup
	  
Comment: Well this is my first post here, I hope you people take it easy.
         I think I'm pretty stupid but not an idiot and as such I have
         allready commited the above stated misstake, which happily enough
         nobody had time or was willing to exploit. Personaly I think
         implementing points a) to c) would be a good idea.
	 Hope this post is of use. Greets, and thanks to all the activists

*t

--------------------------------------------------------------------------------
                   Tomas Pospisek's mailing-lists mailbox   
           www.SPIN.ch - Internet Services in Graubuenden/Switzerland
--------------------------------------------------------------------------------
Tom: So far, der winter kommt, ich schaff mir glaub ich noch ein paar
Tom: Zyxel traffos an...
Roli: Aber genug davon nehmen. Wenn die Dinger kapput gehen werden sie 
Roli: nicht mehr warm.