Subject: Directory Permissions

From: "Rick Flood" <[email-masked]>
Date: Tue, 2 Feb 1999 07:41:01 -0500

I am running Beta-18 on Solaris 2.6...
When a user creates a subdirectory, off their root,  what determines the
permissions on that directory?  These new subdirectories have 'rwx r_x r_x',
the user needs to do a chmod in order for other users, within the group, to
be able to write.  Is this working as designed?

Rick Flood

---

From: Gil Arumi <[email-masked]>
Date: Tue, 02 Feb 1999 13:54:54 +0000

I think you need "in.ftpd -u002 " in /etc/inetd.conf  (umask 002 instead
of 022)

--gil

-- 
Gil Arumi                 [email-masked]
IP Division             Tel: 0171-562-3321
NTT Europe Ltd.         Fax: 0171-256-7997
http://www.ntte.co.uk

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 2 Feb 1999 09:05:23 -0500 (EST)

On Tue, 2 Feb 1999, Rick Flood wrote:

> I am running Beta-18 on Solaris 2.6... When a user creates a
> subdirectory, off their root, what determines the permissions on that
> directory?  These new subdirectories have 'rwx r_x r_x', the user
> needs to do a chmod in order for other users, within the group, to be
> able to write.  Is this working as designed?

With the base, beta-18 release, the umask (man ftpd, -u option) determines
the permissions on the directory.  Ownership will either be the user/group
the daemon is running as at the time, or it will be the user/group given
on the upload clause.

This can be a security problem.  With the base release 'nodirs' should be
used unless you have tested the behavior and found it correct for your
security model.

The VR series, and BeroFTPD, include an old patch off the mailing list
which allows you to specify the permissions to use when creating a
directory.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Rick Flood" <[email-masked]>
Date: Tue, 2 Feb 1999 10:04:03 -0500

I just upgraded from Beta-16, 16 must have handled the umask differently?

I think need to use the -u002, my users aren't too happy about having to do
the chmod.  You imply that this could be a security problem.  Could you
briefly let me know how this could be a security issue?

One additional stupid question...
What are the VR series and BeroFTPD, I think I have a couple clues, but if
you could sum it up in a few words (or tell me where to find more info) it
would be appreciated.

Thanks

> -----Original Message-----
> From: Gregory A Lundberg [mailto:[email-masked]]
> Sent: Tuesday, February 02, 1999 9:05 AM
> To: Rick Flood
> Cc: WU-FTP List
> Subject: Re: Directory Permissions
>
>

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 2 Feb 1999 11:27:53 -0500 (EST)

On Tue, 2 Feb 1999, Rick Flood wrote:

> I think need to use the -u002, my users aren't too happy about having
> to do the chmod.  You imply that this could be a security problem.  
> Could you briefly let me know how this could be a security issue?

Run the daemon umask 0.

> you could sum it up in a few words (or tell me where to find more info) it

My goal with the VR series is to roll in the patches, bugfixes and feature
requests from the mailing list which Stan's been ignoring/putting off for
years now.  I'm also working through what of Stan's TODO list I can.  I'm
trying to do it without a major change in the daemon. The VR series should
be a drop-in for your current daemon, although some of the security fixes
may appear to break your site (if it was broken before but you didn't
notice, it may be *really* broken now and won't work at all).

Bernard's taking a more libral approach.  He's switched to GNU autoconf
and rolled in even more such as NEWVIRT, FTPSEC extensions, and is working
with the FTP-WG on proof-of-concept for some next-generation FTP features.

The most major difference between VR/Bero and the base Academ versions is
that, well, people are actually working on the code with VR/Bero and those
people actually participate on the mailing list.  Did you know that, since
Kent started the mailing list archive, Stan's only posted 161 times, and
most off those were in the beginning?  And as I recall he didn't post much
at all prior to the start of the mailing list archives.  Most recently,
his posts have been the all-to-rare announcement of an update and defense
of his position as the (sic) 'maintainer'

--