Subject: A few thoughts

From: Allen Hebenthal <[email-masked]>
Date: Sat, 14 Feb 1998 13:43:43 -0500

Is anyone working on incorporating 'ls' directly into wu-ftpd? That way,
admins wouldn't have to worry about system libs and permissions (or
recompiling statically) for each anon or guest user (I've seen quite a few
posts about this on the archives), and save disk space. Plus, it could
speed up performance and increase security. (No need to spawn an external
system call to '/bin/ls'). As for security, for instance, say that some
'just got Linux, going to run an FTP site' admin out there sets the
permissions of ~ftp/bin/ls to 777. Now anyone could replace it with a
trojan horse or virus (as long as it spits back the dir list, nobody would
notice).

 I've been playing around with it for a few hours. Unfortunately, C itself
(as far as I know) has no standard directory functions (just file I/O). For
instance, on Linux there's a scandir() function - but this is nonstandard.
Probably the most portable way is to opendir(), loop with readdir()
(calling stat() on each file), then closedir() and return the file list the
same way 'ls' does. Of course, adding some argument parsing for wildcards,
etc. I'm not sure which OS's support these functions, though. Any C hackers
out there have any suggestions?

 Also, what about adding a 'virtual user' feature into wu-ftpd. Not the
guest user we have now, but one that doesn't really exist on the system. It
could be a ftpaccess option - either by pulling from a separate passwd file
(ala .htaccess in Apache) or having the username and password directly in
the ftpaccess. Maybe I'll take a shot at this when I get the time :)

 Maybe some of the developers should take a look at the code from ProFtpd
(http://www.proftpd.org). It's new and not as stable as wu-ftpd, but it has
more configuration options and features.

 If anyone out there has any comments, please let me know.

Thanks,

Allen
[email-masked]

P.S. Is there a separate developers mailing list?

---

From: Pete Holsberg <[email-masked]>
Date: Sat, 14 Feb 1998 14:41:31 -0500 (EST)

What's the trick to get failed ftp logins to be logged
somewhere (Solaris 2.6)? We've tried all the known
syslog.conf tricks but nothing works.

Thanks,
Pete

---

From: Dave Wreski <[email-masked]>
Date: Sat, 14 Feb 1998 14:53:50 -0500 (EST)

> syslog.conf tricks but nothing works.

Use -v on your inetd.conf command-line as well as:

*.info                                  /var/log/info.log
*.notice                                /var/log/notice.log
*.err                                   /var/log/err.log

in syslog.conf.  Be sure to note that there are tabs between the two
columns.

Dave

---

From: Jon Lewis <[email-masked]>
Date: Sun, 15 Feb 1998 00:00:48 -0500 (EST)

> same way 'ls' does. Of course, adding some argument parsing for wildcards,

The terribly easy way out would probably be to yank as much source as
possible from the ls in the GNU fileutils, thus basically compiling ls
into ftpd...replacing the exec with function calls.

------------------------------------------------------------------
 Jon Lewis <[email-masked]>  |  Unsolicited commercial e-mail will
 Network Administrator       |  be proof-read for $199/message.
 Florida Digital Turnpike    |  
______http://inorganic5.fdt.net/~jlewis/pgp for PGP public key____

---

From: Ben Mehlman <[email-masked]>
Date: Sun, 15 Feb 1998 10:54:15 -0500 (EST)

> into ftpd...replacing the exec with function calls.

That's exactly what I did.  I got the source to GNU ls, renamed main() to
ls_main(), changed the makefiles around a little, and just linked it in.  I
had to changed the options passed to it by wu-ftpd so that it would not look
for /etc/passwd (In my system, I also do away with /etc/passwd because I
have way too many users).

-Ben

----------------------------------------------------------------------------
Ben Mehlman             "It doesn't matter", I say, and I start to pick up
Prodigy Services Corp   the broken glass shards.  "I knew it would happen."
[email-masked]   "Then why you don't stop it?" asks my mother.
                        And it's such a simple question.  -Amy Tan

---

From: Jon Lewis <[email-masked]>
Date: Sun, 15 Feb 1998 11:46:37 -0500 (EST)

> have way too many users).

So will you be sending in the patches, or is this proprietary to Prodigy?

Next we'll have people linking in GNU tar and GNU zip. :)

---

From: Koos van den Hout _U nix and we all_ <[email-masked]>
Date: Sun, 15 Feb 1998 18:33:30 +0100 (MET)

> So will you be sending in the patches, or is this proprietary to Prodigy?

Some of the things for performance under heavy load can be propietary. But
I am interested (for the Faq) what people do for *big* servers to make
them work.

> Next we'll have people linking in GNU tar and GNU zip. :)

It could limit the possibility of abusing tar ..

                                         Koos

-- 
A Security Clearance level of Confidential is assumed on all email
correspondence. Please deal accordingly.

---

From: [email-masked] (Lee McLoughlin)
Date: Sun, 15 Feb 1998 19:24:43 +0000

On Feb 15,  6:33pm, Koos van den Hout _U nix and we all_ wrote:
} Subject: Re: A few thoughts
} 
} Quoting Jon Lewis, who wrote :
} 
} > So will you be sending in the patches, or is this proprietary to Prodigy?
} 
} Some of the things for performance under heavy load can be propietary. But
} I am interested (for the Faq) what people do for *big* servers to make
} them work.

In sunsite.doc.ic.ac.uk packages/mirror/experimental/wu-2.4.2-upd13.shar
there are a bunch of patches that I did to improve the performance of wuftpd
here on SunSITE. 

Here are the notes on the two performance related patches:

DAEMON
If ftpd called with -D then run as a standalone daemon listing on the
ftp port.   This can speed up ftpd response as all ftpd then needs to
do is fork off a copy to handle an incoming request.  Under inetd 
a new copy has to be opened and exec'd.

FILEWHAT
If SETPROCTITLE doesn't work or if you have so many users that ps
takes a long time then FILEWHAT keeps the info in a file so that
ftpcount can just print it.

-- 
--
Lee McLoughlin.                         Phone: +44 171 594 8388
IC-Parc, Imperial College,              Fax:   +44 171 594 8432
South Kensington, London. SW7 2AZ. UK.  Email: [email-masked]

---

From: Ben Mehlman <[email-masked]>
Date: Sun, 15 Feb 1998 22:49:23 -0500 (EST)

> Next we'll have people linking in GNU tar and GNU zip. :)

Jon-

It's not practical for me to submit patches, because linking in
the ls was a real hack the way I did it, and would have to be worked
into the makefiles in a much better way to be really useful.  The rest of it
is very much glued to proprietary Prodigy Internet libraries and databases
that wouldn't be useful to anyone else.  Basically, what I did was make a
server that can run with NOTHING in the chrooted file system, that gets the
user information from a relational database with no need for unix user ids
or unix quotas (I added a routine to check quota against the database).
So I can handle a -lot- of users.

One day it would be nice to have a simple API where all the user stuff plugs
in, so that it would be possible to swap in different user databases
(/etc/passwd would be standard).

But anyway, if anyone wanted to do any of this I would be glad to help.  But
I can't give out my code.

---

From: "Javier Puche. CSIC RedIRIS" <[email-masked]>
Date: Mon, 16 Feb 1998 10:01:35 +0100

Hi,

> It could limit the possibility of abusing tar ..

 Here at our ftp site we were having problems because the machine went
to really poor performance when a few people were doing tar's and
gzip's (some funny people like doing things like 'get redhat.tar.gz').

 Situation got better making tar and gzip be executed with a nice value
(I also did it for ls -R). The easy trick is:

cd ~ftp/usr/bin
mv tar nicetar
gcc nicetar.c -o tar

and nicetar.c is:

#include <unistd.h>

int main (int argc, char *argv[], char *envp[]) {
 nice(16);
 execve("/usr/bin/nicetar",argv,envp);
 exit(1);
}

 Let's hope some people find better ways of limiting resources :-)

Regards,

Javier Puche.