Subject: Re: Dangers of WWW and FTP on same machine

From: Albert Lunde<[email-masked]>
Date: Wed, 31 Dec 1997 13:58:02 -0600

>I hate to intrude here, but the discussion going on here has absolutely
>nothing to do with an FTP server running with a WEB server...  They
>very well could be shell accounts doing these 'exploits' being mentioned.

Well then, you may take this as "risks of running an anonomous ftp upload
directory within a web server data tree". The wider concern is to look
for unexpected interaction between various subsystems.

For, example anonymous ftp archives are sometimes mirrored on the web by
pointing a web server at the same directory. There may be no intent to set
up an upload directory, but a simple mistake in permissions opens all these
holes described.

(My treatment for the risks of accidentally allowing uploads is not only to
lock stuff down as much as possible in the ftpaccess file, but also to run
a cron job that sets the desired permissions, and notifies me of changes in
permissions, or changes in disk usage.)

---
    Albert Lunde                      [email-masked]

---

From: Michael Douglass <[email-masked]>
Date: Wed, 31 Dec 1997 14:45:03 -0600

> for unexpected interaction between various subsystems.

Yes, now this is a very _real_ concern.  Anonymous ftp and a web directory
with unrestricted uploads could be very bad.

> permissions, or changes in disk usage.)

That and make _damned_ sure that your web browser is set to allow no overrides
for those directories, etc.  "don't parse files" in that directory, etc.

-- 
Michael Douglass
Texas Networking, Inc.

<tnet admin> anyway, I'm off, perl code is making me [a] crosseyed toady