Subject: ~ftp ?

From: [email-masked]
Date: Fri, 9 Oct 1998 08:12:17 +0300

Hi,

If nobody can write in ~ftp what for must I create .rhosts and .forward
files in ~ftp directory?
Where can I find an information about it?

Thanks a lot.

Sincerely,
Alexander Velichko

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 9 Oct 1998 10:49:42 -0400 (EDT)

On Fri, 9 Oct 1998 [email-masked] wrote:

> If nobody can write in ~ftp what for must I create .rhosts and 
> .forward files in ~ftp directory? Where can I find an information
> about it?
  
.rhosts prevents/allows Sun RPC-style logins (rsh, rexec, etc) on the
account.  If it's not present, no restrictions are placed on where someone 
may log in from.  Create it as a 0-byte file, or link it to /dev/null, and
nobody can log in on the account using Sun RPC protocols.  Write access   
isn't required unless you want the PREVENT such logins.

.forward sends all mail for the user 'ftp' someplace else.  You could do  
that with a sendmail alias (or the equivalent on your system), but that's
separate from the ftp area and it's easy to forget.  If mail to 'ftp' is  
not forwarded,it's unlikely anyone will ever read it and clear it out.  A
malicious user could take advantage of this to send a large number of 
large emails until the filesystem containing the mail spool is filled.    
Trust me, that's not pretty.  In fact, if you're using a default install  
of for example, RedHat Linux (please, no flames, all Unix systems         
suffer from this, I name RedHat because it's so popular) the mail spool is
probably on your root filesystem.  Filling that is *bad* .. it will not   
only crash your machine, you won't be able to boot it back up.

A number of ftp admins may say, "I don't run those services, so I don't
need to worry."  Experience says you're wrong.  You may not run them
today, but you don't know what might be running tomorrow.  Will you
remember all these little things in unrelated areas if you suddenly find
you must run rexec or sendmail on the machine?  Probably not.  Create the
files now, while you're thinking about it and save yourself the headaches
later.

WARNING: there was a note on bugtraq yesterday to the effect that linking
these files to /dev/zero is *bad* .. don't do that.  .rhosts shoud be an
real file or linked to /dev/null.  .forward should be a real file
containing a real email address or, if your system supports it, piping the
email to /dev/null

While we're on the subject of files you should create, there's another:
  
.notar
  
When present in a directory, '.notar' informs the WU-FTPD daemon that it  
is not to allow execution of the TAR ftpconversions naming this as the    
_base_ directory for the tarball.  Tar can be used to bypass other
restrictions placed upon the server (for instance, noretrieve).  So, if
you don't want people to be able to download your passwd and group files
(for instance), you need to create two '.notar' files: one in the root
directory and one in etc;

  touch ~ftp/.notar
  touch ~ftp/etc/.notar

These files should be read-only or no-access (chmod 0 ~ftp/.notar) since
the daemon only checks for the file's existance and never actually
accesses it.

I recommend libral use of .notar; put one in every directory except those
you specifically WANT to allow to be tar'd.  Remember that tar'ing a
directory implies tar'ing the subdirectorie so marking a sub-directory
.notar without marking the parent also allows users to bypass the
restriction.

--

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195