Subject: RE: WU-FTPD virtual domains question

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 24 Sep 1998 16:12:13 -0400 (EDT)

On Thu, 24 Sep 1998, Fernandez, Elena wrote:

> ftp://myuserid:[email-masked]/data/home/virtual1/file.txt
> ftp://myuserid:[email-masked]/file.txt

The previous poster's comment was on the mark.  It's the way the browser
works.

I tested with IE4.01 on NT 4.0 Workstation.

A real user ftp URL had to include the entire directory path.
A guest user ftp URL had to include the entire path from the chroot-point

A guest user ftp URL chroot'd to the same point as a virtual host's root
worked as expected .. that is because it was already relative to the
chroot-point.

A normal ftp URL (no user:pass@) worked as expected  .. also was already
relative to the chroot-point.

This just points out the need for a security feature which will be in VR8:

 - real users will not be allowed to user virtual hosts

 - guest users whose chroot-point matches the virtual hosts' will be 
   allowed; all other guest users will be denied

VR8 patches will be out October 1.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195