Subject: Re: your mail

From: Dhanasekharan D <[email-masked]>
Date: Thu, 8 Oct 1998 18:35:17 +0530

>From [email-masked] Thu Oct  8 18:29:43 IST 1998 remote from sword
Date: Thu,  8 Oct 1998 07:47:55 CDT
Reply-To: [email-masked]
Sender: dhana
From: "WUSTL ListProc" <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Subject: No requests found

No requests were found or recognized in your message. It is possible
your message was intended for a person or a list, or none of its contents
were recognized by this automated system as requests.
If you need to talk to a person, please send mail to [email-masked].
To get general help on Listproc, please send the command:

				HELP

in the body of the message to [email-masked].
-------------------------------------------------------------------------------
From: Dhanasekharan D <[email-masked]>
Subject: Sublogins in anonymous ftp

Hello,

	With  wu-ftpd,  when  anonymous  users  ftp in  and  try a
	sublogin with the "user"  command, they get this  message:
	Can't change user from guest login.

	Is there a way to allow sublogins for anonymous ftp?

	Are there any  security  issues by allowing  sublogins  in
	anonymous ftp.

Thanks,
D.Dhana.

-------------------------------------------------------------------------------

          ///
         ///								
        ///                                                              
       /////////  ///////////							
      ///   ///  ///     ///                                           
     ///   ///  ///     ///
    ///   ///  ///     ///
	      ///////////
	     ///
	    ///

 D.Dhanasekaran.                     Email      : [email-masked]
 Hewlett Packard - ISO               Tel        : (91)(80)225-1554
 29, Cunningham Road,                Extn 	: 1424
 Bangalore 560052                    Telnet 	: 847 - 1424

--------------------------------------------------------------------------------

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 8 Oct 1998 10:42:31 -0400 (EDT)

On Thu, 8 Oct 1998, Dhanasekharan D wrote:

> With wu-ftpd, when anonymous users ftp in and try a sublogin with the
> "user"  command, they get this message: Can't change user from guest
> login.
> 

Not with wu-ftpd.  Once the user has logged in anonymously, the daemon has
chroot'd to the anonymous FTP area and the system password file(s) are no
longer available.

> Are there any security issues by allowing sublogins in anonymous ftp.

If the password file were available after anonymous login, script kiddies
could get it and run crackers and guessers against it.  You'd soon find
someone with both a valid user name and password, and your superuser
password telnet'd in and having a bit of fun.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Thu, 8 Oct 1998 16:45:06 +0200 (CEST)

> 	Is there a way to allow sublogins for anonymous ftp?

No, because an anonymous ftp login causes a chroot() call, which can not
be undone.
For what would you want to use them?

LLaP
bero

-- 
Windows 98 supports real multitasking - it can boot and crash simultaneously.
***
Anyone sending unwanted advertising e-mail to this address will be charged
$25 for network traffic and computing time. By extracting my address from
this message or its header, you agree to these terms.

---

From: Jim Bootz <[email-masked]>
Date: Fri, 09 Oct 1998 07:33:52 -0500

I think what you're looking for is probably handled by setting up a private group. Check out the man page for ftpaccess and see the part about "private <yes|no>".

Dhanasekharan D wrote:

>
> Received: from palrel3.hp.com (palrel3.hp.com [156.153.255.226])
> Received: from sword.india.hp.com (sword.india.hp.com [15.10.43.117])
> Message-Id: <[email-masked]>
> Received: by sword.india.hp.com
> X-Mailer: ELM [version 2.4 PL25]
> Mime-Version: 1.0
> Content-Type: text/plain; charset=US-ASCII
> Content-Transfer-Encoding: 7bit
>
> Hello,
>

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 9 Oct 1998 10:52:39 -0400 (EDT)

On Fri, 9 Oct 1998, Jim Bootz wrote:

> I think what you're looking for is probably handled by setting up a
> private group. Check out the man page for ftpaccess and see the part
> about "private <yes|no>".
> 
> Dhanasekharan D wrote:

That's a good first-reaction, but in my experience 99.99% of the people
asking for this are looking for 'guestgroup' ..

The location of the latest version of wu-ftpd can be found in the 
directory
 
      ftp://ftp.academ.com/pub/wu-ftpd/private/
 
You can't see the directory contents, so read the message informing you
of the actual filename to retrieve. It's there.
 
wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd FAQ:              http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

--