Subject: Secondary groups

From: "Scott Parmenter" <[email-masked]>
Date: Thu, 17 Sep 1998 10:51:45 -0700

Hello, all

Does WUFTP support secondary groups?  I did a quick scan for "getgroups"
which turned up a reference in ftpcmd.c in print_groups().  I have a
user who can telnet in and the group scheme I've set up works, but not
for ftp.

Thanks,
Scott

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 17 Sep 1998 14:23:00 -0400 (EDT)

On Thu, 17 Sep 1998, Scott Parmenter wrote:

> Does WUFTP support secondary groups?  I did a quick scan for
> "getgroups" which turned up a reference in ftpcmd.c in print_groups().  
> I have a user who can telnet in and the group scheme I've set up
> works, but not for ftp.

Depends on what you're asking for.

wu-ftpd has 'autogroup' which handles group permissions for _anonymous_
ftp users.  This probably isn't what you want.

It has 'guestgroup' which handles restricting users to a portion of the
files system.  This probably _is_ what you want.

And it has 'private' which handles allowing an ftp user (guest or
anonymous) and, by use of SITE GROUP and SITE GPASS commands, allows the
remote user the change group membership.  This almost certainly will do
what you want, but isn't the way to do it since guestgroup usually fits
the bill and is transparent to the users.

Personally, I'd say that if you have a group-membership scheme which won't
work with FTP, it's not very secure and you should take another look at
it.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Scott Parmenter" <[email-masked]>
Date: Thu, 17 Sep 1998 14:55:57 -0700

> work with FTP, it's not very secure and you should take another look at

You're right, it wasn't very good.  I was over complicating it for no reason.
After I cleaned it up, it works as intended.

On another point, I'm not sure if I've set something improperly in the OS or
if it's a standard ftp feature.  When a user ftps a file to a directory that
he/she only has group access to, who should be the owner of the resulting
file, the owner of the directory or the sender?  If the latter, is there a way
to force the recipient to own the file?

Scott

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 17 Sep 1998 19:54:19 -0400 (EDT)

On Thu, 17 Sep 1998, Scott Parmenter wrote:

> On another point, I'm not sure if I've set something improperly in the
> OS or if it's a standard ftp feature.  When a user ftps a file to a
> directory that he/she only has group access to, who should be the
> owner of the resulting file, the owner of the directory or the sender?  
> If the latter, is there a way to force the recipient to own the file?

man ftpaccess

Read the 'upload' clause.  It should do what you want.

Personally, I think the base beta-18 upload clause is broken and make the
fixes I think it needed in my VR patches.

--

---

From: "Scott Parmenter" <[email-masked]>
Date: Thu, 17 Sep 1998 17:20:29 -0700

> fixes I think it needed in my VR patches.

What don't you like about it?  In the future, I may be allowed to add the
patches if I can demonstrate that there are improved features available.

Scott

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 17 Sep 1998 22:40:09 -0400 (EDT)

> patches if I can demonstrate that there are improved features available.

This'll help.

VR1 and VR2 applied against BETA-17.  Features/fixes which were not rolled
into BETA-18 appear in VR3, along with new features and fixes

VR3 - released July 15, 1998
----------------------------

BUGFIX   BETA 18 fixes the CD ~ problem, but the fix is disabled by
         default.  It should be enabled.  Discovered in testing.

SECURITY Prevent NOOP resetting idle timer.  From a patch submitted to the
         mailing list by [email-masked] on Feb 4, 1998.

FEATURE  Add -X command-line option and syslog option to log statement in
         ftpaccess.  These options eliminate xferlog output and direct
         transfer logs to syslog instead. From a patch posted to the
         mailing list by [email-masked] on Mar 12, 1998.
         Corrected and cleaned up during testing.

BUGFIX   Somewhere along the way the upload statement was broken.  This
FEATURE  fix adds a new parameter to upload so admins can determine the
         permissions for any new directories permitted.  New features are
         documented in ftpaccess manpage.  From patches submitted to the
         mailing list on April 29, 1998 by [email-masked] and
         [email-masked].  Subsequent investigation shows this problem existed
         as far back as 1994 and the new features have been requested for
         almost as long.

FEATURE  Move Linux to use POSIX regex included with the system instead of
         the routines included with wu-ftpd.  This allows us to define
         path-filter statements which allow spaces in the pathnames.  For
         example:
           path-filter anonymous /etc/pathmsg ^[-A-Za-z0-9_.[:space:]]*$ ^\. ^-
         From a patch sent to the mailing list by
         [email-masked] on Apr 30, 1998.  Although only
         enabled for Linux, this should work for any machine using the GNU
         regular expression library librx.  If you're brave and try it,
         and it works, let me know.

FEATURE  Added 'hostname' configuration statement.  Normally the server
         determines its host name from the system.  This allows the admin
         to specify the name on machines with several names (multihomed)
         where the default name is not the desired name.  Manpage updated.  
         Discovered in testing.  Subsequent searches through the mailing
         list archives shows this was first proposed by
         [email-masked] on Sept 27, 1994.

BUGFIX   Shutdown warnings were not given to normal (non-anonymous) users
         on login.  Discovered in testing.

BUGFIX   Makefile.lnx presumes Bison is installed; it isn't always.
         Discovered in testing, beta 17 was OK.  Dunno why it changed.
         YMMV on this patch.

BUGFIX   Makefile.lnx links the daemon and support programs statically.
         The wisdom of this is debatable at best.  Discovered in testing.

BUGFIX   The fixes for the CD ~ problem (ALTERNATE_CD option for beta 18)
         break a few things.  Most notably, xferlog doesn't include the
         full name of the file and the upload command doesn't work
         properly. In addition, I believe noretrieve should be based on
         the real file system rather than the chroot'd environment.  The
         man page says '/' means the name is an 'absolute path
         specification' which I take to mean from the real file system.  
         Discovered during testing; I had the same problem with my CD ~
         fix in beta 17 so I was expecting this.

SECURITY On the upload clause, 'no' should imply 'nodirs'.  Good grief,
         how long has this bug been lurking about?  Discovered in testing.

BUGFIX   The perl script xferstats incorrectly identifies internet
         addresses whose host name begins with "inf" or which are only 2
         components wide (e.g., "bix.com") as unresolved.  I could not
         verify the "inf" problem, but the 2 component problem has been
         verified to exist in the current version.  From a patch submitted
         to the mailing list by [email-masked] on June 29 1994.

BUGFIX   The util/xferstats that comes with wu-ftpd 2.4 always produces a
         count of zero for "Systems Using Archives", because the array
         whose size is printed ("$systemfiles") never gets anything stored
         in it.  Verified to exist in the current version.  From a patch
         submitted to the mailing list by [email-masked] on July 4,
         1994.

SECURITY The noretrieve clause is extended to mark entire directories
         un-gettable.  From a patch submitted to the mailing list by
         [email-masked] on July 12, 1995.  Cleaned up and man page
         updated.

FEATURE  The upload clause is extended to allow '*' for <owner> and
         <group> so a single upload clause can work for all users.  For
         example:
           upload /home/ftp /private/*/imcoming* yes * * 640 nodirs
         can be used to create private upload areas for every user.  From
         a patch submitted to the mailing list by [email-masked] on Nov 6,
         1994.  Cleaned up and man page updated.

FEATURE  New ftpaccess clause 'nice' to adjust process priorities based
         upon the class.  From a patch submitted to the mailing list on
         Sept 4, 1995 by [email-masked].  Patch included man
         page update.

DOCUMENT While researching 'nice' came across an undocumented ftpaccess
         clause 'guestserver'.  Man page updated.

DOCUMENT Noticing 'guestserver' made me look.  There are two other
         undocumented ftpaccess clauses: 'lslong' and 'lsshort'.  Man page
         updated.

FEATURE  Added -w and -W to enable (default, -w) or disable (-W) recording
         user login and logout for ftp sessions in wtmp.  From a patch
         submitted to the mailing list by [email-masked] on Feb 12, 1996.
         Cleaned up and updated documentation.

VR4 - released July 30, 1998
----------------------------

BUGFIX   The mod to realpath for VR3 wasn't complete.  This was mainly
         visible when logging a deletion message.  Discovered in testing.

FEATURE  Added new command-line option to run in standalone daemon mode.
         From a patch by [email-masked] announced on the mailing list
         on May 30, 1996.  Cleaned up and updated manpage.  The original
         patch has problems with syslog messages, which are fixed here.
         Also added setproctitle to the standalone mode.  This is a win
         for busy sites but not the big win it could be if it pre-loaded
         the ftpaccess file into memory.  Also, at this point, the
         standalone mode loses the tcpwrappers functionality which is
         available when running from inetd.

SECURITY Added syslog messages for more stuff.  MKD, RMD, CHMOD and RNTO
         now log as DELE has.  Discovered in testing; this has always
         sorta bothered me.

FEATURE  Added MAPPING_CHDIR config option to support CWD working like cd
         command in most Unix shells; the PWD shown is the logical path
         rather than the physical path.  This is a Frequently Requested
         Feature.  From a patch by [email-masked] announced on the
         mailing list on May 30, 1996.

BUGFIX   HELP PORT indicated only 5 bytes were needed.  Six are.  Noticed
         when looking for something else so I fixed it.

SECURITY The following problems were noted during testing:
          - Issuing PORT prior to login changes the state of the daemon
          - Issuing PASV after PORT does not change the mode reported by
            STAT
          - Illegal PORT commands change the state of the daemon
         This turned out to be two problems: PASV mode was being reset by
         rejected PORT commands, and PASV mode wasn't reseting the state
         completely after setting up a data connection.
       
FEATURE  Allow numeric UID and GID values.  On systems with large numbers
         of users and a large number of upload clauses, the daemon can
         take a significant period to process the ftpaccess, passwd and
         group files.  From a patch off the mailing list from
         [email-masked] on July 29, 1997.  Extended the patch to
         effect all places user or group names would be allowed: the
         ftpgroup file used with the private clause and the upload,
         guestgroup and autogroup clauses.

BUGFIX   While I was working on numeric GID values for the ftpgroup file,
         I added the ability to specifiy groups which have no password.
         You'll still need to SITE GPASS, but just send no password.  
         Also fixed possible bugs if the ftpgroup file is malformed.

SECURITY Added 'defumask' to specify umask values by class in ftpaccess.
         From a feature request from [email-masked] posted to the
         mailing list on Oct 10, 1994.  Man page updated.

VR5 - released August 15, 1998
------------------------------

BUGFIX   The original idea for realpath when it was included in the source
         kit was that it would provide missing functionality on systems
         where it was missing or replace existing functionality on systems
         where it was already present. The VR patches presume the daemon
         will always use the included realpath function.  This patch does
         that.  Discovered in testing.

SECURITY Limit PASV port ranges.  From a patch submitted to the mailing
         list by [email-masked] on Feb 4, 1997.  A great deal of work
         making this more general was done by [email-masked]
         in July 1998.  The original patch , as well as leighfield's used
         random() to select the port, which is probably a good idea, but
         didn't check for infinite loops when none of the ports were
         available. I punted and used a linear search to avoid infinite
         loops, but this can slow down the daemon a bit.  Open to
         suggestions for faster selection without infinite loops.

SECURITY Provide address remapping for PASV mode to allow daemon to run
         behind IP-address translating firewalls.  From a private
         discussion with [email-masked] throughout July 1998.
         If you use this with virtual hosts, let me know how it goes; I
         think it works, but let me know if it needs extensions for
         virtual hosts.

FEATURE  Add magic cookies so systems using quotas can show them to users
         via ftp message files.  From a patch submitted to the mailing
         list by [email-masked] on May 6, 1997.  This closes
         Stan's TODO item 15. Added support for Linux.  This patch is
         experimental and only available for the following systems: aix
         bdi dec lnx s41 sgi If you try it and it works, let me know.  If
         you add support for other systems, let me know. Updated man page
         for ftpaccess to document these cookies.

FEATURE  Add 'tcpwindow' to configure TCP window size for performance
         tweaking. From a patch submitted to the mailing list by
         [email-masked] on Sep 16, 1997.

FEATURE  Restrict throughput for network load management.  From a patch
         sent to the mailing list by [email-masked] on Jan 31, 1998.

FEATURE  Add message to show total traffic counts.  From a patch sent to
         the mailing list by [email-masked] on Jan 31, 1998.  Added
         file counts, corrected missed bytes, added counts to STAT
         command. This closes Stan's TODO item 17.  Added deail counters
         and ftpaccess commands to limit the user's ability to
         upload/download files based on these.  See 'file-limit' and
         'data-limit' in update ftpaccess man page.  This closes Stan's
         TODO item 13.

BUGFIX   Clean up some unneeded blank lines sent in responses.  From a
         patch sent to the mailing list by [email-masked] on Jan 31,
         1998.

VR6 - released August 26, 1998
------------------------------

BUGFIX   Add '-VR6' to version string in newsvers.sh.  This will be
         updated with all future patches.

BUGFIX   The patch for standalone daemon (in VR4) missed including a
         header. Discovered in testing.

BUGFIX   The FIXES file for VR4 had a typo; the option is -s and -S (the
         -D was how the original patch worked, it was change to avoid -d,
         debug mode).  The ftpd man page is unclear on the use of -s and
         -S.  Discovered in testing.

BUGFIX   Some systems, notable Solaris, have problems with the code the
         standalone daemon mode used to attempt to detach from the
         terminal session.  This was in the original patch.  Upon thinking
         about the problem, I see no reason to keep the code arround.  If
         you need this feature, use 'nohup' to run the daemon.  
         Discovered in testing.

SECURITY Change the defaults to deny upload, and other site-modification
         things, for anonymous users.  From a suggestion on the mailing
         list on August 20, 1998, from [email-masked].  Well lookidat, fixed
         a silly bug in the "rename" clause while I was there.

BUGFIX   Somehow I missed a spot where "*" should be matched for the
         <root-dir> in an upload clause.  Spotted while code-reading for
         the next patch.

SECURITY Add 'anonymous-root' to select chroot directory based on class of
         anonymous user.  From a proposal on the mailing list by
         [email-masked] on Sep 9, 1997.  Also, added
         'guest-root' to select directory based upon guest UID.  Man pages
         updated.

SECURITY Disallow UIDs and GIDs by numeric range.  From the Apache Group's
         suEXEC module.  This can obviate the need for /etc/ftpusers.

SECURITY Add ability to force all UID/GID in a range to be treated as
         guests.  From a patch submitted to the mailing list by
         [email-masked] on Nov 7, 1996.  The original patch used
         compiled-in limits.  Added ftpaccess clause to allow
         configuration.  Updated man page.  The original patch included a
         hard requirement to chroot to the user's home directory; use
         guest-root instead.  This closes Stan's TODO item 16.

BUGFIX   Fix a bug with realpath.  If chroot'd to '/' the xferlog shows
         '//' at the start of the filename.  Noted in testing.  Thought I
         fixed this already but missed a condition.

BUGFIX   The upload clause should use realpath on the home directory to be
         sure it matches.  Otherwise, real users with /./ in their path
         will need their upload clause to lexically match the home
         directory entry in /etc/passwd. Noted in testing.  This was not a
         big issue until I added realuser.

SECURITY The daemon responds differently in some cases when it's denying
         access. This could be used by attackers to determine the validity
         of some user names on the target system.  Noted on the mailing
         list by [email-masked] on May 30, 1997.  NOTE: the 331
         response for some systems, notably BSD S/Key or other
         challenge/response systems, may differ from the 331 response
         given. I don't have access to those systems to check out the
         differences. If you do, and work out how to hide the access
         refusal until after the password challenge, please forward it to
         me.

BUGFIX   Fix handling for the message clause so login and cwd= work as
         expected. From a request submitted to the mailing list by
         [email-masked] on October 23, 1994.  Patch submitted to the
         mailing list on August 30, 1996, by [email-masked].

VR7 - released September 15, 1998
---------------------------------

BUGFIX   defumask caused a data alignment problem on HP-UX 10.

BUGFIX   routevector.c uses ulong instead of u_long.  ulong doesn't exist
         on many systems.

BUGFIX   main() is declared void; that's not ANSI, it's just stupid.
         Reported by [email-masked] when building for
         Solaris/Sparc.

BUGFIX   DAEMON always includes <sys/termio.h>, it was needed until VR6
         removed the attempt to detach from the controlling terminal.

BUGFIX   Missing <grp.h>.  Gotta love Linux's grab-one-get-it-all method
         for defining system headers, don't ya?  Grrr.

BUGFIX   The 'daemon' variable conflicts with a 'daemon()' function in
         some runtimes.

BUGFIX   Traffic counters weren't protected by TRANSFER_COUNT in some
         cases.

BUGFIX   Typo in the manpage (what, just one?  Come on!)

SECURITY There's a bug in popen which can cause segmentation faults.  
         It's unknown if this is exploitable (it doesn't look like it is
         to me). Reported to the mailing list by
         [email-masked] on May 27, 1997.  I believe he
         reported this quite a bit earlier as well so it's been a problem
         for a long time.

SECURITY Extended logging for rejected and failed login attempts.  From a
         request to the mailing list from [email-masked] on Jun 18,
         1997.

SECURITY Added PARANOID check to deny login if a real user's home
         directory is bad.  Something's bunged up in /etc/passwd, why
         trust it?  Noticed while code-reading for the next patch.

SECURITY Don't respond to *ANY* commands except USER, PASS and QUIT until
         the remote user logs in successfully.  Noticed while testing.

FEATURE  Extended upload and noretrieve to have an optional parameter
         which specifies whether the named file/directory is interpreted
         as an absolute name or relative to the current chroot'd
         environment.  From a suggestion by [email-masked] on
         September 2, 1998.

BUGFIX   The HELP_CRACKERS patch was too agressive and, if message files
         were defined for 'deny' and 'limit' could tickle bugs in ftp
         clients.  The patch is backed off to drop the connection
         immedeately if it violates 'deny' or 'limit'.  Reported by
         [email-masked] on September 3, 1998.

BUGFIX   The include for 'mntent.h' isn't needed unless QUOTE_DEVICE is
         defined. This caused problems on BSDI.  Moving the include to
         only appear for systems which use QUOTE_DEVICE.  Reported by
         [email-masked] on September 3, 1998.

BUGFIX   My label 'slimy_hack:' appearing just before a '}' causes some
         compilers to belch.  I guess some are more ANSI/ISO than others.
         Here's a quick fix which ought to make them shut up until I can
         rewrite pass() to make the label go away.  Reported by
         [email-masked] on September 3, 1998.

PORTING  The QUOTA logic for BSDI doesn't match what's provided by the
         system. Fixed.  Reported by [email-masked] on September 3, 1998.

SECURITY Extended logging for rejected or denied functions such as delete,
         rename. From a request submitted to the mailing list by
         [email-masked] on February 6, 1996.  Patch taken from
         BeroFTPD-1.0.12 with permission. Added several new log messages
         missed in BeroFTPD for this feature.

BUGFIX   Transfer limits tesed the wrong values for files uploaded to the
         server. Noticed while proof-reading the previous patch.

VR8 - work to date, will release October 1, 1998
------------------------------------------------

FEATURE  Add 'SITE CHECKMETHOD' and 'SITE CHECKSUM'.  Closes Stan's TODO
         item 8.

    SITE CHECKMETHOD [CRC|POSIX|MD5|RFC1321]

    Sets or displays the current check method.  If no parameter is given,
    displays the current method; otherwise the method is set to the given
    algorithm.  CRC and POSIX are equivalent and are the output of the
    GNU cksum(1) utility.  MD5 and RFC1321 are equivalent and are the
    output of the GNU md5sum(1) utility.  The default check method is
    RFC1321 (MD5).

    SITE CHECKSUM [<file>]

    Calculates the checksum for the named file.  If no file is given, the
    last file transferred (uploaded or download) is used.  If no file has
    yet been transferred, reports an error.  The current CHECKMETHOD is
    used to calculate the checksum.

    New ftpconversions: .crc and .md5

    Two new file conversions were added to the example ftpconversion which
    allow using GET to retrieve the CRC or MD5 checksums for files.

    NOTE: SITE CHECKSUM requires the installation of two additional
    programs in the ~ftp/bin directory.   These programs have the same
    requirements as the external ls(1) program also normally required in
    that directory.  For systems without these programs, or which require
    building new copies, the GNU textutils package should be used.  This
    package is available at ftp://ftp.gnu.org/pub/gnu/ the current version
    at the time of this writing is textutils-1.22.tar.gz

BUGFIX   Add IGNORE_NOOP as a new compile-time option.  Make it the
         default. From a request sent to me from [email-masked] on
         September 14, 1998.

FEATURE  Add site-exec-max-lines ftpaccess clause.  This clause makes the
         limit on output lines from SITE EXEC configurable.  The default
         is a 20-line limit, which was the old compiled-in limit.  From a
         request sent to me from [email-masked] on September 14,
         1998.

BUGFIX   Moved 'retrieve_is_data' to be always compiled into the code
         since it was needed for SITE CHECKSUM.

PORTING  Modify the password cryptography for C2 Digital Unix.  From a
         patch sent to me from [email-masked] on September 16, 1998.  

BUGFIX   Fix a bug in the parsing of ftpconversions which I found when I
         put in the new conversions for checksums.  Turns out this was the
         same as the bug I fixed in VR4 parsing the ftpgroups file.

SECURITY Disallow certain email addresses as passwords for anonymous ftp.
         From patches submitted to the mailing list by
         [email-masked] on Feb 14, 1997 and
         [email-masked] on Jun 9, 1998.  Actual patches taken from
         BeroFTPD with permission.  Corrected a bug where deny-email had
         to follow passwd-check in the ftpaccess file.

SECURITY Limit total connect time.  From a patch submitted to the mailing
         list by [email-masked] on Sep 27, 1997.  This closes Stan's TODO
         item 14.  Phil lost his original patch, so the actual patch was
         taken from BeroFTPD with permission.

DOCUMENT Phil Schwan's xferstats program implements Stan's TODO item 6.
         Marking it closed.  Download Phil's xferstats separately.  Trust
         me, it's far better that the Perl script included in the package.

DOCUMENT Kent Landfield's privatepw program implements Stan's TODO item 2.
         Marking it closed.  Download Kent's privatepw separately.

DOCUMENT Bernard Rosenkraenzer's BeroFTPD is now tracking my VR patches.
         With the inclusion of NEWVIRT in BeroFTPD, Stan's TODO item 24 is
         complete.  Marking it closed.  Download BeroFTPD if you use
         virtual hosting.

FEATURE  Add 'hostname' option for the 'virtual' clause so we may set the
         name of our multi-homed ftp sites as we can with our default
         site.  Discovered in testing.

SECURITY If a guest logs in on the virtual server deny the login unless
         their chroot point is the virtual server's root.  This restricts
         guest logins to the site admin and anonymous users.  From a patch
         submitted to the mailing list on December 11, 1996 by
         [email-masked].  Added the restriction that no real
         users may log in on the virtual server.

FEATURE  Add 'email' option for the 'virtual' clause so we may set this as
         well. Discovered in testing.  This takes virtual hosts as far as
         I need them.  If you need more control, use BeroFTPD or newvirt.

SECURITY Add 'greeting' clause to control the amount of information the
         server gives out on the greeting.  Personal preference.

--

---

From: Ayamura Kikuchi <[email-masked]>
Date: 18 Sep 1998 14:13:31 +0900

>          to follow passwd-check in the ftpaccess file.

I strongly recommend the patch 'pck' written by [email-masked]
as email addresses checks.  The 'pck' refuses anonymous ftp if the
email addresses has an unresolvable domain and validates those using
regular expressions like sendmail.8.9.x's anti-spam features.

	ftp://ftp.eos.hokudai.ac.jp/pub/wu-ftpd/pck/
# Documents in English are also enclosed.

-- Ayamura Kikuchi (Japan)

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 18 Sep 1998 08:25:03 -0400 (EDT)

> regular expressions like sendmail.8.9.x's anti-spam features.

I've only had a chance to read the document you sent me, Kikuchi.  It made
reference to a license included in the package, which I've not yet read.
depending on what that license says, it could be a problem (I doubt it,
but you never know).

In principle, I agree with Kikuchi and intend to take a long look at what
is actually in that patch since it adds several features I'd like to see
(regex for one).

--