Subject: Re: minor problem with guestgroup

From: "Oliver Stoll" <[email-masked]>
Date: Wed, 12 Nov 1997 17:35:02 +0100

>Agreed on both points.  However, I would ask that any 'fix' would ensure
>that 'cd ~' would alway interpret based on the real /etc/passwd (store
>the right-hand-side); and `cd ~username` use the chrooted etc/passwd.
>Make sense to anyone else?
>

I don't really like the idea of cd ~ftp and cd ~ (as ftp) going into two
different
directories, if the chrooted etc/passwd differs from /etc/passwd. The
interpretation
which makes the most sense to me would be both cd ~ cd ~username for the
_logged in user_ to be read from /etc/passwd and overridden by the chrooted
etc/passwd.

However, I would not want any "cd ~username" to be a detector for the user
who is logged in to find out if a certain user exists on the system. So if the
userid of the name in cd~username differs from the current user, only the
chrooted /etc/passwd should be consulted and nothing else.

Oliver

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 12 Nov 1997 11:48:48 -0500 (EST)

On Wed, 12 Nov 1997, Oliver Stoll wrote:

> different directories, if the chrooted etc/passwd differs from
> /etc/passwd. The interpretation which makes the most sense to me would
> be both cd ~ cd ~username for the _logged in user_ to be read from
> /etc/passwd and overridden by the chrooted etc/passwd. 
> 
> However, I would not want any "cd ~username" to be a detector for the
> user who is logged in to find out if a certain user exists on the
> system. So if the userid of the name in cd~username differs from the
> current user, only the chrooted /etc/passwd should be consulted and
> nothing else.

Maybe what's needed is an option in ftpaccess to disallow the ~ form in
the CWD command.  Something like:

  cdtilde <yes|no> <typelist>

which works like chmod/delete/overwrite/rename/umask then you could

  cdtilde no anonymous

and still allow real and guest users to use cd ~[<user>] based upon the
chroot'd etc/passwd ...

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 12 Nov 1997 13:17:17 -0500 (EST)

On Wed, 12 Nov 1997, Gregory A Lundberg wrote:

> Date: Wed, 12 Nov 1997 11:48:48 -0500 (EST)
> From: Gregory A Lundberg <[email-masked]>
> To: Oliver Stoll <[email-masked]>
> Cc: [email-masked], WU-FTP discussion <[email-masked]>
> Subject: Re: minor problem with guestgroup
> 

Looking at the code for beta-15 I see:

1) 'CWD' (no parameters) uses pw->pw_dir which is the home directory for
   the currently logged in user, relative to the real environment not
   the chroot'd environment.  This is passed to a function named cwd() in
   ftpd.c. From earlier email's I'm stating this is not the Right Thing to
   Do (tm).  Worse yet, it was *STOMPED* on by the guestgroup code so we
   can consider it garbage.  CWD without parameters is therefore very
   unreliable. 

2) 'CWD pathname' simply passes 'pathname' to the same internal function
   cwd().  No problem here.

3) The function cwd() starts off by calling the system function chdir().
   How chdir() responds to a tilde-path is unknown (by the man pages from
   my RHL CD and on my HP/UX 10 system) and I'd not want to bet it's the
   same from one system to the next.  This is where we're seeing the
   differing results, but in all cases the results seem incorrect.

Further thought on the problems, considering filenames, etc., leads me to
the following:

   wu-ftpd does not currently support ~[<user>] when referencing
   directories or files.  when they work, if they even do, is entirely
   platform dependent and results of their use are unpredictable. 

and

   wu-ftpd, with guestgroups in use, does not properly handle CWD when
   no parameters are present.  This is (now) a known problem and will be
   fixed in a future release.

The easiest patch I can see is to check for tilde in the directory/file
name supplied and report an error.  This is, at best, simply expediant.  I
consider it a poor long-term solution.

A patch correcting the use of tilde would appear to touch far too many
points in the driver and should be left for the next version (presuming an
end to these interminable 'beta' releases is ever reached). 

The patch to at least get CWD passing a non-stomped-upon copy of pw-pw_dir
to cwd() should be fairly straightforward .. maybe we can get it in beta
16, or 17, or 18 ...

I love that scene where the Pope calls up to Michelaneglo, "When will you
make an end?"

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              email: [email-masked] [205.133.13.8]
Kettering, OH 45409-1615 USA    voice: +1 (937) 299-7653

---

From: [email-masked]
Date: 14 Nov 1997 13:45:50 GMT

Pink elephants with an attitude inspired Gregory A Lundberg <[email-masked]> to tell garfield.mail.wu-ftpd:

: A patch correcting the use of tilde would appear to touch far too many
: points in the driver and should be left for the next version (presuming an
: end to these interminable 'beta' releases is ever reached). 

You know.. this whole thread could drive a man to drink..

I already reported the ~ behaviour to the list and to Stan Barber on
Wed, 18 Jun 1997. It was filed as ticket [ACADEM-SW-SUPPORT #373]
And I received an answer on Sun, 10 Aug 1997 containing:

> Yes, the "cd ~" with the response you have noted is considered normal.
> What you have suggested is a feature enhancement and will be considered
> when we get to doing enhancements in release 2.5.

Can this thread end now? Please.

-- 
Perry Rovers ([email-masked])

---

From: Michael Douglass <[email-masked]>
Date: Fri, 14 Nov 1997 19:03:10 -0600

> > when we get to doing enhancements in release 2.5.

Let me just say that the cd ~ behavior that is noted is __NOT__ normal...
Where in the heck is cd ~ failing considered normal????  I'M CONFUSED!

> Can this thread end now? Please.

Guess not...

-- 
Michael Douglass
Texas Networking, Inc.

 "The past is a foreign country; they do things differently there."
      L. P. Hartley, British author. The Go-Between, Prologue (1953).

---

From: [email-masked]
Date: 15 Nov 1997 09:49:45 GMT

Pink elephants with an attitude inspired Michael Douglass <[email-masked]> to tell garfield.mail.wu-ftpd:
: On Fri, Nov 14, 1997 at 01:45:50PM +0000, [email-masked] said:

: > > Yes, the "cd ~" with the response you have noted is considered normal.
: > > What you have suggested is a feature enhancement and will be considered
: > > when we get to doing enhancements in release 2.5.

: Let me just say that the cd ~ behavior that is noted is __NOT__ normal...
: Where in the heck is cd ~ failing considered normal????  I'M CONFUSED!

I didn't say it was normal (else I wouldn't have mentioned it to Stan), but
what I am saying is: the problem is known and is being considered for 2.5
(and I sure as hell hope it's going to be in there because I consider it a
security problem. No one needs to know that he's actually in some other
directory than he thinks he is. It confuses the users too :)

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 17 Nov 1997 09:10:34 -0500 (EST)

> > Can this thread end now? Please.

This patch to BETA 15 should fix things for 'cd ~' ...

--- ftpd.c.orig	Fri Sep 12 11:42:46 1997
+++ ftpd.c	Mon Nov 17 08:59:30 1997
@@ -1593,6 +1593,10 @@
 	  if (chroot(pw->pw_dir) < 0 || chdir(++sp) < 0) {
 	    reply(550, "Can't set guest privileges.");
 	    goto bad;
+          } else {
+            char *pp;
+            pp = pw->pw_dir;
+            do *pp++ = *sp; while (*sp++ != '\0');
 	  }
         }
     }

----

---

From: Michael Douglass <[email-masked]>
Date: Mon, 17 Nov 1997 16:04:16 -0600

> +++ ftpd.c	Mon Nov 17 08:59:30 1997

I just published such a patch to the list yesterday. :)  And I question
your use of 'else' here after an 'if' clause that will clearly never
return...  But that's just me. :)

-- 
Michael Douglass
Texas Networking, Inc.