Subject: Guest accounts don't 'chroot'

From: David Kinney <[email-masked]>
Date: Thu, 29 Oct 1998 14:08:01 -0500 (EST)

Hi.

	I'm encountering a problem with the newest 'wu-ftpd'.  Guest accounts
	login OK, but don't do 'chroot'.  The 'ftp/anonymous' account does.

	I'm using the newest 'wu-ftpd-2.4.2-beta-18' that I just downloaded
	from 'ftp://ftp.academ.com/pub/wu-ftpd/private/'  I built it on a
	Digital UNIX 4.0B system, using 'build dec' and 'build install'.

	An earlier version of 'wu-ftpd' 2.4.2 that I build on Solaris 2.5
	worked fine.

	Any ideas ?

	Thanks in advance,

                David Kinney    [email-masked] 
                Sr. UNIX admin. Database America

	======================================================================

cat /etc/ftpaccess
class   all   real,guest,anonymous  *
 
guestgroup  nonpub

log commands  real,guest,anonymous
log transfers real,guest,anonymous  inbound,outbound

email [email-masked]

	======================================================================

	In '/etc/group'

nonpub::122:dba

	======================================================================

	In '/etc/passwd'

dba:XFiCkMz6NKNcQ:2069:122:David Kinney:/usr/pub/./user:/nosuchshell

	======================================================================

ls -l /etc/ftp*     
-rw-r--r--   1 root     system       185 Oct 29 12:15 /etc/ftpaccess
-rw-r--r--   1 root     system       455 Oct 29 12:14 /etc/ftpconversions
-r--r--r--   1 root     system        37 Oct 29 12:14 /etc/ftpgroups
-rw-r--r--   1 root     system       192 Oct 29 12:15 /etc/ftphosts
-rwxr-xr-x   1 bin      bin           78 Oct 29 12:14 /etc/ftpusers

bin/ckconfig
Checking _PATH_FTPUSERS :: /etc/ftpusers
ok.

Checking _PATH_FTPACCESS :: /etc/ftpaccess
ok.

Checking _PATH_PIDNAMES :: /var/run/ftp.pids-%s
ok.

Checking _PATH_CVT :: /etc/ftpconversions
ok.

Checking _PATH_XFERLOG :: /var/adm/xferlog
ok.

Checking _PATH_PRIVATE :: /etc/ftpgroups
ok.

Checking _PATH_FTPHOSTS :: /etc/ftphosts
ok

	======================================================================

	'/etc/ftpconversions' and '/etc/ftpgroups' are copies of the
	doc/examples' files.

	'/etc/ftpusers' is a copy of the doc/examples file, with the
	"root" login removed.

	======================================================================

	'/etc/ftphosts' is a commented out copy of the doc/examples file:

cat /etc/ftphosts
# Example host access file
#
# Everything after a '#' is treated as comment,
# empty lines are ignored

#    allow   bartm   somehost.domain
#    deny    fred    otherhost.domain 131.211.32.*

	======================================================================

	Note that '/usr' and '/usr/pub' are local, i.e. no NFS, no symbolic
	links to other dirs.

ls -lR /usr/pub
total 16
drwxr-xr-x   2 root     system      8192 Oct 29 10:59 bin
drwxr-xr-x   3 root     system      8192 Oct 29 10:59 etc

/usr/pub/bin:
total 416
-rwxr-xr-x   1 bin      bin       425984 May 23  1997 ls

/usr/pub/etc:
total 11
-rwxr-xr-x   1 bin      bin          651 Oct 29 13:25 group
-rw-r--r--   1 root     system      1614 Oct 29 10:58 passwd
drwxr-xr-x   2 root     system      8192 Aug 28 15:04 sia

/usr/pub/etc/sia:
total 18
-rw-r--r--   1 root     bin         2191 Nov 16  1996 .new..bsd_matrix.conf
-rw-r--r--   1 root     bin         2187 Nov 16  1996 .new..matrix.conf
-rw-r--r--   1 root     bin         2191 Nov 16  1996 .proto..bsd_matrix.conf
-rw-r--r--   1 root     bin         2187 Nov 16  1996 .proto..matrix.conf
-rw-r--r--   1 root     bin         2386 Nov 16  1996 OSFC2_matrix.conf
-rw-r--r--   1 root     bin         2191 Aug 28 15:04 bsd_matrix.conf
lrwxrwxrwx   1 root     system        15 Oct 29 10:59 matrix.conf -> bsd_matrix.conf
-rwx------   1 root     system         0 Aug 28 15:04 siainitgood

	======================================================================

	Among the files in '/var/adm':

-rwxr-xr-x   1 root     adm       100839 Oct 13 15:59 messages
-rw-r--r--   1 root     adm            0 Oct 24 04:40 wtmpx
drwxr-xr-x   2 root     system      8192 Oct 28 17:08 sendmail
-rw-r--r--   1 root     adm           57 Oct 29 01:29 mountdtab
drwxr-xr-x 206 root     adm         8192 Oct 29 04:40 syslog.dated
-rw-rw-r--   1 root     adm            0 Oct 29 11:02 xferlog
-rw-rw-r--   1 root     adm        28084 Oct 29 11:27 lastlog
-rwxr-xr-x   1 root     system      2340 Oct 29 11:27 utmp
-rwxr-xr-x   1 root     system      8580 Oct 29 13:24 wtmp

	======================================================================

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 29 Oct 1998 14:34:25 -0500 (EST)

> 	An earlier version of 'wu-ftpd' 2.4.2 that I build on Solaris 2.5

your config looks fine, so let's check a few silly things:

 - make sure inetd is running the corect executable for the daemon
 - kill -HUP inetd if you changed anything in /etc/inetd.conf
 - look at the command line in inetd.conf; are there more than 4 items
   after the program name?  Some Unix flavors (DEC, ISTR is one) have a
   limit on the number of parameters which can be there.  Some inted
   implementations need the program name to appear twice, too.
 - look in the system logs, any messages which might shed light?

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Brett Goldstock <[email-masked]>
Date: Thu, 29 Oct 1998 14:42:02 -0500

I just did an "ftpwho" under wu-ftpd 2.4.2 and I'm disturbed that one of
the entries (of 5 total) showed "root" being connected, but idle. The IP
addresses listed is not an internal one. (I'm investigating just where the
IP address is from. If it's from an expected site or not.) I absolutely
without a doubt have root in the "ftpusers" file and in fact I confirmed
that I can't connect to this machine via ftp as root, getting the expected
"user root access denied" when I give the correct root password.

So what gives? Should I trust the output of ftpwho? I'm a little worried here.

-Brett

|Brett M. Goldstock                               [email-masked]|
|Senior Technical Analyst/Sys Admin          http://www.tvdata.com|
|TVData                                               800/833-9581|
|                "We tell the world what's on TV."                |