Subject: Re: Problem with "upload" and Virtual Servers

From: [email-masked] (Andy Church)
Date: Sat, 25 Apr 1998 02:39:17 EDT

>I have the following parameter in my "ftpaccess" file, which should prevent
>uploads by "anonymous":
>
>upload  /data10/ftp     *               no
>
>And, for my non-virtual main FTP server, it does ... however, if a user
>logs into a virtual server as anonymous, and the directory they hit has
>permissions improperly set to allow FTP to write to it (and with 200+
>customers, it happens), then they can still upload the file.
[...]
>My guess is that the following quote from the "ftpaccess" manpage may
>explain things?
>
>  "The upload keyword only applies to users who have a home directory (the
>argument to the chroot() ) of <root-dir>."

     That's right; you can fix that by applying my include-virtual patch,
which considers "*" to match any home directory (and also adds an "include"
keyword to ftpaccess parsing and _compatibly_ extends the "virtual"
keyword).  The patch is at:

ftp://achurch.dragonfire.net/wu-ftpd/include-virtual.patch

Or you can patch the source yourself--the code you want is in extensions.c
somewhere after line 1000 (search for: "!strcmp(ARG0, pw->pw_dir)").

  --Andy Church                  | If Bell Atlantic really is the heart
    [email-masked]       | of communication, then it desperately
    www.dragonfire.net/~achurch/ | needs a quadruple bypass.

---

From: Geoff Baysinger <[email-masked]>
Date: Sat, 25 Apr 1998 12:51:03 -0500 (CDT)

I tried editing the beta15 code as suggested and had no luck (compiled
fine, but had the same problems), but after applying the "b16plus.patch",
which contained the patch Andy mentioned as well as his other patches I
can now run beta16, and no longer have the upload problem.

Thanks a bunch!
/Geoff