Subject: Security "feature"

From: Ismael Sanchez Fernandez <[email-masked]>
Date: Thu, 20 Aug 1998 09:20:48 +0200

I think that to prevent misconfigurations and strong security in future wuftp 
	versions, the class anonymous would have the Upload feature deny by default, 
	although the unix permisions let him upload files. You would have to explicit
tell
	wuftpd in ftpaccess to permit upload in a subdirectory.

	Any comment?

-- 
Un Saludo,
					Ismael Sanchez Fernandez
					mailto:[email-masked]
					Telefonica I+D

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 20 Aug 1998 07:37:45 -0400 (EDT)

On Thu, 20 Aug 1998, Ismael Sanchez Fernandez wrote:

> I think that to prevent misconfigurations and strong security in future
> wuftp versions, the class anonymous would have the Upload feature deny
> by default, although the unix permisions let him upload files. You would
> have to explicit tell wuftpd in ftpaccess to permit upload in a
> subdirectory. 
> 
> Any comment?

I would think an experienced Unix admin would say, "Gak!  You set up a
world writable area then let just anyone use it?"  But, yeah, you're right
the daemon _should_ prevent newbies from their own stupidity.

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: joe turbulencia <[email-masked]>
Date: Thu, 20 Aug 1998 12:05:05 -0400 (EDT)

On Thu, 20 Aug 1998, Ismael Sanchez Fernandez wrote:

> I think that to prevent misconfigurations and strong security 
> in future wuftp versions, the class anonymous would have the 
> Upload feature deny by default,  although the unix permisions 
> let him upload files. You would have to explicit tell wuftpd 
> in ftpaccess to permit upload in a subdirectory.
> 
> Any comment?

	i agree.