Subject: Re: User still capable to cruise around

From: "Stig Isaksson" <[email-masked]>
Date: Thu, 26 Feb 1998 17:00:59 GMT+200

Hi Jouni,

I don't know if I can be of much help here, but since it's not very 
long since I built our own wu-ftp, I seem to remember something 
similar among the many initial problems I had.

First: Isn't there a typo in your ftpaccess file, i.e. in the 
following line?:

class   ftpquest   guest,anonymous  *

It should read ... ftpguest ..., shouldn't it? (But this could hardly 
have caused your chroot problem.)

2. What with your passwd line for a guest user,
userxx:*:403:400::/var/ftp/./:/etc/ftponly,
I'm not shure, but I think the asterisk in the dummy password 
position should be an x instead. It is an x in my file, but it may be
system dependent. Easy to determine though - simply see what the 
otherentries in /etc/passwd look like. The lines for users in my 
/etc/passwd file read something like the following:

user:x:1002:101:Explanatory comment:/xdir/ydir:/bin/sh 

and the line for the anonymous user something like:

ftp:x:30000:30000:Anonymous FTP:/dir1/dir2/dir3/ftp:/nosuchshell

where /dir1/dir2/dir3/ftp represents the ftp-root for anonymous.

You must have both, I think, i.e. one line for each guest user and one 
for anonymous.

3. My guestgroup line in ftpaccess is according to the formula:

guestgroup guestgroupx guestgroupy guestgroupz ... etc.

where guestgroupx corresponds to a group declaration in the 
/etc/group file, i.e. something like:

guestgroupx::101:

Hope this may be of some help. I got my chrooted logins to work 
eventually, but am not sure I remember all of the details I had to 
correct on my way there.

Good luck!
Stig
      
>      Well, still my user can access every directory, when he logs in comes:
>       
>      > pwd
>       "/var/ftp" is current directory.
>      >
>      
>      and not for example
>      
>      ftp> pwd
>      257 "/" is current directory.
>      ftp>
>      
>      I have tried following:
>      
>      >Are you sure you didn't forget something like "guestgroup <name of 
>      >group>"
>      >in the ftpaccess file ????
>      
>      YES, my ftpaccess - file is here:
>      
>      class   ftpquest   guest,anonymous  *
>      class   ftponly    real
>      
>      guestgroup ftponly
>      limit   ftponly     10    Any
>      loginfails    2
>      private no
>      email  [email-masked]
>      
>      
>      #readme  README*    login
>      #readme  README*    cwd=*
>      log commands quest,real,anonymous
>      log transfers quest,real,anonymous
>      
>      #message /welcome.msg            login
>      #message .message                cwd=*
>      
>      compress       no 
>      tar           no 
>      chmod  no  quest,real,anonymous
>      umask  no  quest,real,anonymous
>      
>      path-filter quest /etc/ms.path ^[-A-Za-z0-9._]*$ ^\. ^-
>      path-filter anonymous /etc/ms.path ^[-A-Za-z0-9._]*$ ^\ ^-
>      
>      
>      
>      >exists the homedir with all rights for this user ?
>      
>      YES 
>      
>      drwxr-xr-x      6 ftpuser       ftponly 1024 Feb 13 12:30 ftp
>      
>      OR should it be owned by root ?
>      
>      HELP, Please......
>      
>      BR,  Jouni
> 
> 

------------------------------------------------------------
Stig Isaksson
Dialekt- och ortnamnsarkivet
Helgonabacken 14
S-223 62 LUND
S W E D E N
tel.: +46 46 222 74 68   fax: +46 46 15 23 81
e-mail: [email-masked]
http://www.dal.lu.se/

<Forstaor MIME    Understands MIME>
------------------------------------------------------------

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 26 Feb 1998 11:28:08 -0500 (EST)

> have caused your chroot problem.)

Actually, it probably is the cause.

> position should be an x instead. It is an x in my file, but it may be

This is wrong.  The passwd field doesn't matter.  Put whatver you want in
there.  Most of us remove the passwords just to make it a tad harder for
someone to grab 'em and crack 'em offline.

> /etc/group file, i.e. something like:

What he's trying to say here is the guest groups must be real unix groups
appearing the the _real_ /etc/group file.  In addition, the user must be a
real unix user and a member of the real unix group.  Your typo made it
not-a-unix-group and therefore wu-ftpd ignored it since it couldn't figure
out what you meant.

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              email: [email-masked] [205.133.13.8]
Kettering, OH 45409-1615 USA    voice: +1 (937) 299-7653