Subject: C2 (enhanced) security on Ultrix 4.3a -- again

From: Craig A Summerhill <[email-masked]>
Date: Tue, 3 Mar 1998 18:49:37 -0500 (EST)

I asked this question about C2 security on Ultrix last Saturday.  I 
have not received any replies.  The pointer to additional documentation
on this in the WU-FTPD FAQ:

   <URL:http://sawyer.wustl.edu/du4-docs/Digital_UNIX_Bookshelf.html>

is no longer a valid URL, it appears.  The host in questions isn't 
responding to HTTP queries.

> I am running wu-ftpd-2.4.2-beta-16, and I *did* see a note in the
> wu-ftpd FAQ file from Andrew Sawyer regarding how to do this on
> Digital Unix.  It is not clear to me how hisfix applies to Ultrix...
> 
> I was forced to upgrade the security on one of our hosts to level C2.
> It is an Ultrix 4.3a installation.  The default (B1?) security is 
> level is SECLEVEL=BSD.  At the C2 level (SECLEVEL=ENHANCED), passwords 
> are encrypted and stored is a shadow file outside the /etc/passwd file 
> using an authentication dbm database.
> 
> Anyway, wu-ftpd worked fine on this system...  until I upgraded.
> 
> Now, anonymous logins work correctly, but all the login attempts for
> real users fail.  The syslog captures the attempts as failed logins:
> 
> Feb 28 18:21:10 localhost: 9271 ftpd: USER listmgr
> Feb 28 18:21:14 localhost: 9271 ftpd: PASS password
> Feb 28 18:21:15 localhost: 9271 ftpd: failed login from host.domain [IP], user
> 
> I suspect I need to change a flag or some definitions and recompile the
> daemon, but my quick glance through the code and installation documents
> didn't turn up anything.  Anybody have a quick answer?

Has nobody compiled wu-ftpd for Ultrix with C2 security?  I find that 
hard to believe...
-- 

   Craig A. Summerhill, Systems Coordinator and Program Officer
   Coalition for Networked Information
   21 Dupont Circle, N.W., Washington, D.C.   20036
   Internet: [email-masked]   AT&Tnet (202) 296-5098

---

From: "Randy A. Katz" <[email-masked]>
Date: Tue, 03 Mar 1998 16:44:36 -0800

Hello,

I
1. Installed FreeBSD through the net.
2. Did a pkg_add ftp://ftp.freebsd.org/pub/FreeBSD/CVSup/cvsupit.tgz
3. Did the update for source, ports, and docs.
4. Did a cd /usr/src; make buildworld; make installworld; reboot

Now for some reason the ftpd doesn't provide a login prompt, just hangs. I
reinstalled wu-ftpd and the later version 2.4.2-beta16 and it still does
the same thing. I then made a custom kernel, rebooted, and still the same
thing.

httpd works fine and sendmail and everything looks fine...just ftp doesn't
work...

Any comments would be most appreciated.

Thanx,
Randy Katz

---

From: "Randy A. Katz" <[email-masked]>
Date: Tue, 03 Mar 1998 16:55:46 -0800

Now, 

It eventually goes give a login but waits for a long time beforehand (like
3-4 minutes).

Any suggestions?

---

From: Michael Brennen <[email-masked]>
Date: Tue, 3 Mar 1998 19:09:36 -0600 (CST)

Could it be waiting on a reverse DNS lookup?  Are you sure your DNS
and resolver (/etc/resolv.conf) are working properly?

   -- Michael

---

From: "Randy A. Katz" <[email-masked]>
Date: Tue, 03 Mar 1998 17:13:41 -0800

DNS Lookups are working fine, and quickly.

---

From: Bret McDanel <[email-masked]>
Date: Tue, 3 Mar 1998 20:33:42 -0500

I know I am jumping in the middle of this, and I dont know what all was
going on, but ..

could it be a failing identd lookup, where the querry is silently dropped
by a packetfilter/firewall?  And it waits for connect() to time out prior
to giving you a login prompt..

---Reply on mail from Randy A. Katz about FreeBSD, wu-ftpd not working...just hanging.

>>> It eventually goes give a login but waits for a long time beforehand (like
---End reply
-- 
Bret McDanel                                    http://www.rehost.com
Realistic Technologies, Inc.                             973-514-1144

     These opinions are mine, and may not be the same as my employer