Subject: Guest root using browsers

From: Jim Wallace <[email-masked]>
Date: Mon, 1 Jun 1998 17:25:46 -0500

I am running 2.4.2b15 on an Intel Linux box (rh5.0).  I have disabled 
anonymous and setup a couple of guest accounts that seem to work great 
using a command-line ftp client.  My problem is that when the guest 
FTP accounts are accessed via a WEB browser (ie 3.0), the initial 
directory presented is the system root, with at least read access to 
many sensitive directories.  An example passwd entry for a guest 
account is:

willy:xxxxxx:502:504::/home/ftp/guest-ftp:/usr/local/bin/ftponly

My ftpaccess file is:

class   all   real,guest  *

email root@localhost

loginfails 2

readme  README*    login
readme  README*    cwd=*

message /welcome.msg            login
message .message                cwd=*

compress        yes             all
tar             yes             all
chmod           no              guest
delete          yes             guest
overwrite       no              guest
rename          yes             guest

log transfers real,guest inbound,outbound

guestgroup ftpguest

shutdown /etc/shutmsg

passwd-check rfc822 warn

What do I need to do to prevent access to the system root via browser? 
 I didn't see anything in the FAQ/HowTo or a scan of some of the mail 
archive.  Am I missing something obvious?

Jim Wallace

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 1 Jun 1998 18:51:53 -0400 (EDT)

> willy:xxxxxx:502:504::/home/ftp/guest-ftp:/usr/local/bin/ftponly
[snip]
> archive.  Am I missing something obvious?

You're missing the chroot() point.  Put /./ somewhere in the home
directory. (ie., /home/ftp/guest-ftp/./ )  Check out the guestgroup howto
for more details.

The location of the latest version of wu-ftpd can be found in the 
directory
 
      ftp://ftp.academ.com/pub/wu-ftpd/private/
 
You can't see the directory contents, so read the message informing you
of the actual filename to retrieve. It's there.
 
wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd FAQ:              http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195