Subject: local# syslog facilities

From: Rocker UNIX/NT Support 991-2604 <[email-masked]>
Date: Tue, 3 Mar 1998 14:51:41 -0500 (EST)

Howdy yall. 

I would expect that this is covered in some FAQ somewhere, but I cant find it. How do I get wuftpd to log to local4 facility, and not daemon ?

Thanks in advance

"Life is like a box of chocolates"

_/_/_/_/_/_/_/_/_/_/_/_/_/_/
Rocke Robertson
UNIX Administartor
350 King Edward
(613) 991-2604
Ottawa, Ontario
[email-masked]
_/_/_/_/_/_/_/_/_/_/_/_/_/_/

---

From: Koos van den Hout _U nix and we all_ <[email-masked]>
Date: Tue, 3 Mar 1998 21:39:24 +0100 (MET)

Quoting Rocker UNIX/NT Support 991-2604, who wrote :

> I would expect that this is covered in some FAQ somewhere, but I cant
> find it. How do I get wuftpd to log to local4 facility, and not daemon

It's quite easy to find if you know what you're looking for..

I grepped the sources for FACILITY and...

$ grep FACILITY *.[ch]
config.h:#define FACILITY LOG_DAEMON

and config.h is copied from config/config.{archtype} (config.lnx
corresponds to build lnx for example).

So change this to LOG_LOCAL4 and rebuild.

> UNIX Administartor

Not a system mangler ?

                                               Koos

-- 
A Security Clearance level of Confidential is assumed on all email
correspondence. Please deal accordingly.

---

From: Louis Bertrand <[email-masked]>
Date: Tue, 3 Mar 1998 17:20:17 -0500 (EST)

Dear nice folks on the wu-ftpd list,

I read the FAQ and the ftpd server man page as well as the
CERT notices and don't see any mention of using a "blind"
FTP site, meaning the "ls" and "mget" commands don't work
(return a "sorry you can't do that" message instead). This
is a suggestion from our internal networking support group.
That way, users must know what they are getting and can't go
on "fishing trips". 

Because I don't see any mention of this practice, I wonder
if this is an effective security practice or just a
worthless annoyance for legitimate users? 

By the way, how do I make a drop-box "blind"? meaning the
"ls" and "mget" commands don't work (return a message
instead). Making the directory permissions -w--w---- seems
to work but users can still create directories.

Ciao!
 --Louis

Louis Bertrand, Senior Engineer
Toronto Design Centre, LMPS, Motorola Canada Ltd.
3900 Victoria Park Avenue, North York, Ontario, M2H 3H7, Canada
Email:  <[email-masked]> or <[email-masked]>
Telephone +1.416.756.5855  Fax +1.416.756.5643  Mailstop:  ONT1

---

From: Emil Isberg <[email-masked]>
Date: Wed, 4 Mar 1998 02:27:08 +0100 (MET)

>Dear nice folks on the wu-ftpd list,

Ohh. A person who knows how he should get what he wants. ;-)
Thanks.

>That way, users must know what they are getting and can't go

Hmm .. I got some wondering what you wanted to do ..
But the rows you want to change are:
NLST = ftpcmd.y:323, ftpcmd.y:329
LIST = ftpcmd.y:337-340,ftpcmd.y:346-349

You can change them to 'reply(202, "XXX command ignored")' or perhaps a
better error code. ;-)

Well .. That removes the ls stuff .. and I think that mget relies on that
function .. Hmm .. the code is up to the user .. :-)
Btw this removes the ls code for all users, real or anonymous!!
Perhaps you need an other way of doing it.

You should also watch out for SITE cmds .. and keep it configurated right.
:-)

>worthless annoyance for legitimate users? 

Well. I can not understand why you want to "blind" the ftpd ..
But I concentrate on not letting the wrong people into the service, so how
they get the filelist, from the ftp or from the telnet doesn't matter for
me.

>to work but users can still create directories.

Hmm .. funny permissions that one ..
You should make those ---x--x--x ..

Then the users can't modify the directory (and therefor can't create any
directory/file) .. but can access any files (that they know of) in the dir
.. They can't get the information out of the dir because it isn't
readable!!

Good luck with improving the security. Is a damn hard work.

And you wuftpd people: Is this the way to do it .. or is there
easier/better way to do it?

-- 
/Emil
On 2 Mar 1998, Anders Bornas wrote:
>Du har fel. Ge upp. *ligger på knän och bedjar*

---

From: Louis Bertrand <[email-masked]>
Date: Wed, 4 Mar 1998 18:12:53 -0500 (EST)

Thanks to all who replied to my request. I need to "grill"
our network security people to find out why they recommend
the "blind" FTP site, before I spend too much time
implementing it...

Ciao!
 --Louis