Subject: Solaris 2.5.1 anonymous setup considerations

From: "Arnaud Ruch" <[email-masked]>
Date: Thu, 4 Dec 1997 12:01:27 +0100

Hi everybody,

I am setting up an anonymous  FTP server for solaris 2.5.1
(wu-ftpd-2.4.2-beta-15) and since different sources of information give
different and sometimes contradictory pieces of advice, I would like to ask
you a few questions :

- the server seems to work fine with only /dev/tcp, but I've read that
/dev/ticotsord, /dev/udp and /dev/zero are also required. Can someone tell
me what for ? Note that I'm using a statically linked ls, if that matters.
- should the device(s) have permissions 666 or 644 (they are owned by root)
?

- NO upload is allowed on this server. In this case, does the user "ftp"
have to own any file in the server directory tree ? (it seems to work fine
without).

- In this case (no anonymous upload), is it worth considering putting the
FTP server itself in a chrooted environment as it is suggested in the
Anonymous FTP FAQ ? What extra security would it provide ? Note that there
is no binary in the server directory tree apart from "ls".

Last question : would it make a difference on Solaris 2.6 ?

Thanks in advance,

Arnaud Ruch
[email-masked]

---

From: Wilhelm Mueller <[email-masked]>
Date: Fri, 5 Dec 1997 08:57:17 +0100 (MET)

On Thu, 1997-12-4 12:01:27 +0100, <[email-masked]>

 > - should the device(s) have permissions 666 or 644 (they are owned by root)

leaving out /dev/ticotsord crashes Solaris versions before 2.6 if a
chrooted program tries to obtain a lock on an nfs mounted file system.

You'll need /dev/udp for NFS if any server does not accept NFS
protocol vers 3 (or you configured the mount to use version 2), as
well as for NIS, if you need that.

 > have to own any file in the server directory tree ? (it seems to work fine

User ftp never needs to own any files, even in upload areas. It just
needs write access in the latter case, but it doesn't matter by what
rules (a+w, acls) it gets it.

 > is no binary in the server directory tree apart from "ls".

If you create a directory tree for ~ftp, you'll get the chrooted
environment automatically. If you set ~ftp to / (even then a
chroot("/") will be done, but you'll need spmething like lsof to
detect it), your whole directory tree will be visible, and I wouldn't
bet that wu-ftpd (or any other program) wouldn't contain some funny
bug somewhere.

 > Last question : would it make a difference on Solaris 2.6 ?

I haven't yet tried it, but at least wrt /dev/ticotsord there should
be one.

 > - are netconfig and nsswitch.conf required in etc with a static ls and no
 > use of NIS ?

netconfig: yes
nsswitch.conf: I'm not sure if wu-ftpd makes any gethostby...() calls
after the chroot(). If so, you'll need it just to enable dns lookups.
All other entries should just contain ``files''.

 > Thx
 > A. Ruch

--

Klein bottle for sale ... inquire within.

-- 

  ***************************************************
   Der Senator für Bau, Verkehr und Stadtentwicklung
   Referat 43            (Dienststelle Schlachte 32)
   Wilhelm Müller             Tel: +49-421-361-10629
   Ansgaritorstraße 2         Fax: +49-421-361-2295
   D-28195 Bremen, Germany

   Bits KeyID    Fingerprint
   2048 C2F0A2D1 B1452644 DEBB647F 94AA3DA9 01608E0A
   1024 9548B531 AE9AD94C 978ABC3F 4B25B52B 1E752137
    512 48B324ED 885C3131 DDF53740 DB7F9421 2A5431EE