Subject: Re: [Fwd: ftp> quote site exec <program>]

From: Gregory A Lundberg <[email-masked]>
Date: Sat, 23 Jan 1999 18:00:31 -0500 (EST)

On Sat, 23 Jan 1999, Malika Roy wrote:

> I've installed wu-ftpd2.4.2-beta-18.
> But "quote site exec <program>" still does not work.
> The program is a simple shell program that echoes "Hello".

The program will need to follow *all* the rules for running in a chroot'd
environment.  That means all devices, libraries, etc., will need to be
available to it.  Putting Perl or a shell in the chroot'd environment is a
severe security risk.  Use compiled C programs instead.

SITE CHMOD does not use any external programs.  It is implemented by the
daemon itself.  SITE EXEC, on the other hand is more list NLST .. it runs
an external program.  The daemon won't run just any program.  Normally, it
will only run programs from ~ftp/bin and then only those it knows about
such as ls (for LIST and NLST).  It will run tar, gzip/gunzip,
compress/uncompress, etc., because it's been told about those program via
the /etc/ftpconversions configuration file.  SITE EXEC, on the other hand,
is a wild-card.  To prevent abuse, the daemon will only run programs
installed in the approved location .. on most systems that location is
~ftp/bin/ftp-bin although the name is defined at compile-time and can be
moved.  The '~ftp/' portion does not mean only anonymous users can SITE
EXEC, I'm using it as a shorthand for the current root location which will
probably be different for guest and users.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Malika Roy <[email-masked]>
Date: Sat, 23 Jan 1999 16:24:54 -0500

In continuation of the previous email request:

I can send "quote site chmod nnn <program>". This command
gets executed just fine. It's "site exec" that does not run.

This gets returned:
tp> quote site exec test
200-test
200  (end of 'test')
ftp>

Whereas running the program in the directory returns:
# ./test
Hello

Any further insight will be greatly appreciated.

Thanks.

Malika

Subject: Re: ftp> quote site exec <program>
From: Gregory A Lundberg <[email-masked]>
To: Malika Roy <[email-masked]>
Cc: [email-masked]
Date: Fri, 22 Jan 1999 16:58:26 -0500 (EST)

On Fri, 22 Jan 1999, Malika Roy wrote:

> I recently installed wu-ftpd version 2.4.

First, scrog that ancient version and install the current version: 2.4.2
(beta 18).

> I can't seem to get "quote site exec <program_name>" to work.
> 
> Can you make some suggestions to what I should look for in terms of
> configuration, etc.?

Start with the FAQ.

The location of the latest version of wu-ftpd can be found in the 
directory
 
      ftp://ftp.academ.com/pub/wu-ftpd/private/
 
You can't see the directory contents, so read the message informing you
of the actual filename to retrieve. It's there.
 
wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd FAQ:              http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

Briefly: SITE EXEC requires the program to be in the directory of allowed
programs.  On most systems, this is ~ftp/bin/ftp-bin.  Playing with SITE
EXEC is playing with fire; be very careful what you allow and who you
allow to do it.

--

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Sun, 24 Jan 1999 00:03:46 +0100 (CET)

> The program is a simple shell program that echoes "Hello".

You can't run a shell script in a chrooted environment unless you copy a
shell there, which I'd strongly recommend against for security reasons.

LLaP
bero