Subject: Re: WU-FTPD won't chroot!

From: "Jason Kantz" <[email-masked]>
Date: Tue, 29 Sep 1998 11:18:49 PDT

No success.  I wrote a wrapper script to add the -a option.
The ftpaccess file *is* being read: the pathfilter works, and guests 
cannot issue the "user" command.  

However the welcome.msg does not display and the chroot still does not 
work.

This is my ftpaccess file:

class   gs   guest  *
class   rl   real  *
limit   gs   10   Any /etc/msgs/msg.dead

message /welcome.msg login gs

path-filter gs /etc/msgs/pathmsg ^[-A-Za-z0-9_\.]*$  ^\.  ^-
path-filter rl /etc/msgs/pathmsg ^[-A-Za-z0-9_\.]*$  ^\.  ^-
email [email-masked]

passwd-check rfc822 enforce
guestgroup ftponly
~

>From [email-masked] Mon Sep 28 08:55:21 1998
>Received: from localhost (lundberg@localhost)
>	by mail.vr.net (8.9.1a/8.9.1) with ESMTP id LAA14372;
>	Mon, 28 Sep 1998 11:55:12 -0400
>Date: Mon, 28 Sep 1998 11:55:12 -0400 (EDT)
>From: Gregory A Lundberg <[email-masked]>
>To: Jason Kantz <[email-masked]>
>cc: [email-masked]
>Subject: Re: WU-FTPD won't chroot!
>In-Reply-To: <[email-masked]>
>Message-ID: <[email-masked]>
>MIME-Version: 1.0
>Content-Type: TEXT/PLAIN; charset=US-ASCII
>
>On Mon, 28 Sep 1998, Jason Kantz wrote:
>
>> Strangely enough, the anonymous FTP account will chroot, but guest
>> accounts won't.
>
>> Is it hopeless?  Does this simply not work?  I am running wu-ftpd on 
a
>> Digital Unix 4.0d platform with C2 security.  Any help is greatly
>> appreciated.
>
>It's know to work just fine.  I just went through this with another 
user
>on DEC Unix 4.0 (no C2 for him, but that's not the problem).
>
>First .. DU4 has a limit on the number of parameters on the line for
>inetd.conf .. so what you'll need to do is make a small wrapper script:
>
>#!/bin/sh
>exec /usr/sbin/wu-ftpd -a
>
>Where '/usr/sbin/wu-ftpd' is the complete pathname for your deamon's
>executable.  Add additional options to the end, *BUT* be sure you have 
the
>'-a' option otherwise the /etc/ftpaccess file won't be used at all!
>
>Put the wrapper in /usr/sbin or someplace whereinetd.conf can get to it
>and mark it with permissions 0550 (ug=rx,o=)
>
>-- 
>
>Gregory A Lundberg		Senior Partner, VRnet Company
>1441 Elmdale Drive              [email-masked]
>Kettering, OH 45409-1615 USA    1-800-809-2195
>
>

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 29 Sep 1998 14:35:51 -0400 (EDT)

> However the welcome.msg does not display and the chroot still does not 

[snipping]

> limit   gs   10   Any /etc/msgs/msg.dead

No class for anonymous, so anonymous FTP won't be allowed.

> path-filter gs /etc/msgs/pathmsg ^[-A-Za-z0-9_\.]*$  ^\.  ^-

I'll assume the following directory structure:

-r--r--r--  root  system  /etc/msgs/msg.dead
drwxr-xr-x  root  system  /home/users
-r--r--r--  root  system  /home/users/welcome.msg
d--x--x--x  root  system  /home/users/bin
---x--x--x  root  system  /home/users/bin/ls
d--x--x--x  root  system  /home/users/etc
-r--r--r--  root  system  /home/users/etc/passwd
-r--r--r--  root  system  /home/users/etc/group
d--x--x--x  root  system  /home/users/etc/msgs
-r--r--r--  root  system  /home/users/etc/msgs/pathmsg
drwxr-s--t  sam   sam     /home/users/sam

In /etc/passwd:
sam:xxx:1001:1001:Sam I Am:/home/users/./sam:/bin/sh

In /etc/group:
sam::1001:sam
ftponly::99:sam

In /home/users/etc/passwd:
root:*:0:0::/:
sam:*:1001:1001::/sam:

In /home/users/etc/group:
system::0:
sam::1001:

--