Subject: Problem with passwords starting with '-'

From: Srinivasan Narasimhan <[email-masked]>
Date: Tue, 19 Jan 1999 19:42:23 +0530

Hi,

The problem is that ftpd looks at the password the user has passed it
and checks to see if the 1st char is a '-'.  If it is a '-' then ftpd
assumes that the user is requesting to disable lreply().  It sets the
flag to disable the lreply (dolreplies = 0) and then increments the
string ptr to the next character.  When the "new" password is checked
against the real password they don't match and the user is unable to
login.

It appears that this was done intentionally to workaround problems with
PC clients that are unable to handle continuation messages.Here is the
offending code from ftpd.c (pass() function):
...

/* Disable lreply() if the first character of the password is '-' since
* some hosts don't understand continuation messages and hang... */

    if (*passwd == '-')
        dolreplies = 0;
    else
        dolreplies = 1;
/* ******** REGULAR/GUEST USER PASSWORD PROCESSING ********** */
    if (!anonymous) {    /* "ftp" is only account allowed no password */
        if (*passwd == '-')
            passwd++;

...

Have anyone else reported this problem earlier? If so has it been fixed
in any of the latest releases? Please do reply.

-- 
Cheers,

Cheenu.

Srinivasan Narasimhan,	   	Phone: +91-080-2203381. Ext 1424.  
Hewlett Packard IS0 Ltd.,   	E-mail: [email-masked]        
30-C Cunningham Road,                                             
Bangalore - 560 052.

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 19 Jan 1999 09:43:01 -0500 (EST)

So what's the problem?

> against the real password they don't match and the user is unable to

Correct.

> It appears that this was done intentionally to workaround problems
> with PC clients that are unable to handle continuation messages.Here
> is the offending code from ftpd.c (pass() function): ...

Actually, it was done for a number of platforms, not just PCs. Personally,
I use the feature all the time to avoid having to wade through long
message files at every turn on some sites I visit often.

> Have anyone else reported this problem earlier? If so has it been
> fixed in any of the latest releases? Please do reply.

The problem you're referring to was that clients would hang when
connecting with sites using extended responses.  It was reported many
(over 5) years ago and the fix you quoted seeing was added .. I'm not sure
but it seems to be that was back in version 2.1 or 2.2 days.  Maybe
someone else on the list has been arround long enough to remember for
sure?

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Jon Lewis <[email-masked]>
Date: Tue, 19 Jan 1999 10:15:43 -0500 (EST)

> So what's the problem?

The problem (I've run into this before...very frustrating for customers) 
is that if their password actually does begin with a -, say it's -mypass,
then they have to use --mypass to get in.  wu-ftpd probably ought to check
the password, and if the crypted passwd matches crypted -mypass, then the
- behavior should be turned off.  If they don't match, it should inc the
passwd pointer, turn on - behavior, and try crypting again.

----don't waste your cpu, crack rc5...www.distributed.net team enzo---
 Jon Lewis <[email-masked]>  |  Spammers will be winnuked or 
 Network Administrator       |  nestea'd...whatever it takes
 Florida Digital Turnpike    |  to get the job done.
______http://inorganic5.fdt.net/~jlewis/pgp for PGP public key________

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 19 Jan 1999 11:32:47 -0500 (EST)

On Tue, 19 Jan 1999, Jon Lewis wrote:

> The problem (I've run into this before...very frustrating for
> customers)  is that if their password actually does begin with a -,
> say it's -mypass, then they have to use --mypass to get in.  wu-ftpd
> probably ought to check the password, and if the crypted passwd
> matches crypted -mypass, then the - behavior should be turned off.  
> If they don't match, it should inc the passwd pointer, turn on -
> behavior, and try crypting again.

That rule only works for systems with static passwords.  If the target
platform is using a system (say, a one-time pad) where the password,
username and password challenge must all come together to authenticate the
user, the failed first attempt will invalidate the password guantenteeing
failure on the second attempt.

There are at least three much easier solutions:

 - Assist your users to properly use FTP.

 - Do not allow '-' as the first character of a password.  This can be
   done as a stated policy or enforced with a check in the password-
   setting modules (passwd command, PAM, whatever).

 - By default, disable extended replies in the daemon.  In ftpd.c change
   the initialization for dolreplies from 1 to 0 and removing the '-'
   check in pass().  By doing this, the daemon will no longer offer some
   features such as message and readme files.  There will be a number of
   more subtle side effects of doing this which the average user will not 
   notice.

Personally, if it's a problem at your site, I'd recommend a quick change
to the passwd command to disallow a leading '-'.  It's easy, probably
easier than fixing WU-FTPD, and it corrects the problems for your customer
with *ALL* FTP servers, not just WU-FTPD.

The issue is not simply with WU-FTPD, btw.  Many FTP servers now provide
extended replies and use the leading '-' to suppress them.  Also, the
failure of clients to properly handle extended replies (which have been
specified in the RFC 959 since October, 1985) continues today.  To quote
from RFC 1635, "How to Use Anonymous FTP" (May 1994):

Friendly Servers

   These days, many sites are using a form of FTP that allows them to
   display several lines of explanatory text that help direct users
   through their archive.  The listing of alternative services on
   naic.nasa.gov is an example.  If these effusive servers confuse the
   client you are using, try typing a hyphen ( - ) before your password
   when you log in.  That should disable the verbose mode of the server.

--