Subject: Further Diagnosis: ls problems

From: John-Paul Pagano <[email-masked]>
Date: Tue, 16 Feb 1999 14:37:26 -0500

Hi,

After a couple of days of research, and my previous post on the ls issue, I
have finally narrowed my diagnosis of the problem.  It seems that ls does
in fact work as before, in spite of the absence of a static ls binary in
each user's chrooted home directory.  The problem was that I was accessing
the web site through SOCKS, which encrypts the ftp traffic, and it seems
that there is a bug in SOCKS that disallows the proper functioning of ls
under certain conditions.  I have heard frequent reports of this, and we
are using a pretty old version of SOCKS, so it all makes sense now.

I was wondering if anyone knows of a server side config option in wu-ftpd
that will better enable encrypted client access to the server?

One final question, if there a server-side config option that will let me
enable the dir command?  So far, no ftp clients' dir commands seem to work
with it.

Thanks for all your help.

--
John-Paul Pagano
Unix Systems Administrator
Voice: (212) 208-0828
Fax: (212) 825-1040

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 16 Feb 1999 14:49:36 -0500 (EST)

On Tue, 16 Feb 1999, John-Paul Pagano wrote:

> After a couple of days of research, and my previous post on the ls
> issue, I have finally narrowed my diagnosis of the problem.  It seems
> that ls does in fact work as before, in spite of the absence of a
> static ls binary in each user's chrooted home directory.  The problem
> was that I was accessing the web site through SOCKS, which encrypts
> the ftp traffic, and it seems that there is a bug in SOCKS that
> disallows the proper functioning of ls under certain conditions.  I
> have heard frequent reports of this, and we are using a pretty old
> version of SOCKS, so it all makes sense now.
> 
> I was wondering if anyone knows of a server side config option in
> wu-ftpd that will better enable encrypted client access to the server?
> 
> One final question, if there a server-side config option that will let
> me enable the dir command?  So far, no ftp clients' dir commands seem
> to work with it.

dir works, ls doesn't.  one command is using LIST, the other NLST.  one
needs ~ftp/bin/ls, the other doesn't.  you're missing ~ftp/bin/ls

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Tue, 16 Feb 1999 21:07:15 +0100 (CET)

> that will better enable encrypted client access to the server?

If KRB5/GSSAPI is what you're looking for, get BeroFTPD
(ftp://beroftpd.unix.eu.org/pub/BeroFTPD/BeroFTPD-1.3.3.tar.gz)

> enable the dir command?

Should work without problems if you've set up a chroot system with
statically linked ls and such.
If you don't want to go through the trouble of putting ls in every user's
home directory, look at BeroFTPD which implements ls internally.

LLaP
bero

-- 
Windows 98 supports real multitasking - it can boot and crash simultaneously.
***
Anyone sending unwanted advertising e-mail to this address will be charged
$25 for network traffic and computing time. By extracting my address from
this message or its header, you agree to these terms.

---

From: John-Paul Pagano <[email-masked]>
Date: Tue, 16 Feb 1999 15:09:37 -0500

>home directory, look at BeroFTPD which implements ls internally.

Well, I don't think the problem is with wu-ftpd, although I was trying to
make sure by asking whether or not there was a server-side config option
that deals with encrypted ftp client access.  I believe there is a bug in
NEC SOCKS4, which is the implementation I am using, that screws up file
listings and other essential behaviors on the client side.  I don't know
how switching to BeroFTPD would address that problem, although it may have
native ls support.

Again, however, let me stress that Wu-FTPD is working fine without having a
statically built ls in every user's home directory.  I can't use ls -l,
which I would very much like to, and I have discovered this SOCKS issue,
but other than that it works fine without the static binary rigamarole.

---

From: "James B. Byrne" <[email-masked]>
Date: Tue, 16 Feb 1999 15:47:33 -0500

> (ftp://beroftpd.unix.eu.org/pub/BeroFTPD/BeroFTPD-1.3.3.tar.gz)

I get a dns error saying that there is no such host as 
beroftpd.unix.eu.org.  Is this correct?

Regards,
Jim
---
James B. Byrne                Harte & Lyne Limited
vox: +1 905 561 1241          9 Brockley Drive
fax: +1 905 561 0757          Hamilton, Ontario
mailto:[email-masked]  Canada L8E 3C3

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 16 Feb 1999 16:10:01 -0500 (EST)

> beroftpd.unix.eu.org.  Is this correct?

Not only are telco/ISP rates lousy in Europe, but sometimes things go
flaky.

I have a local copy in ftp://ftp.vr.net/ and so do my mirrors.
Bernard's mirrors are:

ftp://beroftpd.unix.eu.org/pub/BeroFTPD/
ftp://ftp.croftj.net/usr/bero/BeroFTPD/
ftp://ftp.sunet.se/pub/nir/ftp/servers/BeroFTPD/
ftp://sunsite.cnlab-switch.ch/mirror/BeroFTPD/

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "James B. Byrne" <[email-masked]>
Date: Tue, 16 Feb 1999 16:06:45 -0500

Thank You.

Regards,
Jim
---

---

From: John-Paul Pagano <[email-masked]>
Date: Tue, 16 Feb 1999 18:38:25 -0500

Hi,

I have finally found the following, seemingly viable method for enabling ls
-l under wu-ftpd.  

1.  Make the following subdirectories in your user's chrooted / :

	usr
	dev

2.  Copy the following files into ~user/usr :

	ld.so.1
	libc.so.1
	libdl.so.1

3.  Run ldd against the ~user/bin/ls to make sure that no libraries come up
that you haven't already copied to ~user/usr.

4.  ls -l your whatever /dev/zero is linked to on your machine.  E.g.

	bash# ls -l /dev/zero
	lrwxrwxrwx   1 root     root          27 Feb  2 13:14 /dev/zero ->
../devices/pseudo/mm@0:zero
	bash# ls -l "/devices/pseudo/mm@0:zero" 
	crw-rw-rw-   1 root     sys       13, 12 Feb  2 13:14
/devices/pseudo/mm@0:zero

Make note of the major and minor numbers (13,12).  Then create a device in
~user/usr based on those numbers, e.g. (if you are sitting in ~user):

	bash# mknod dev/zero c 13 12

This should create an identical /dev/zero device to the one actually
located in /dev/zero, for use in the user's chrooted environment.  At least
on Solaris 2.5.1, I have found that non-statically built ls will not
function without this device file.

5.  "Beta" test by executing the following command:

	bash# truss -f chroot ~user/bin/ls > /tmp/ls.log 2>> /tmp/ls.log

If everything is kosher, you won't see anything erroneous-looking in the
output.  You may find that "Err#2 ENOENT" comes up, but that's an innocuous
notification that (I think) merely has something to do with the process
trying to write to a pseudo terminal device.

6.  Finally, prune from or otherwise don't try to use the following
directives in your ftpaccess file:

	lslong <command> [<options>... ]
	lsshort <command> [<options>... ]
	lsreal <command> [<options>... ]
	lsplain <command> [<options>... ]

They don't seem to do squat, at least after hours of trying to get them to
work on my machine.  To be sure, I could just be doing something dumb, and
these directives work fine, but, the bottom line is that I am now able to
get ls -l and dir to work without interpolating these lines into my
ftpaccess file.  The only affect that these directives did have was
allowing ls -l but  breaking the dir command, before I commented them out
altogether.

---

From: Klaus-Peter Thronicke <[email-masked]>
Date: Wed, 17 Feb 1999 12:03:33 +0100

> 2.  Copy the following files into ~user/usr :

thank you John-Paul, good description...

although this shouldn't be to difficult....

At  Solaris, `man ftpd`  gives an excellent description AND a shell script to
do this....
I configured the ftp-user with this script, long before I installed wu-ftpd.
it worked fine with wu-ftpd too.
upto now I didn't come along problems.

for details see the attachment please.

--
Klaus-Peter Thronicke        System-Administration Unix
Fingerprint: 4877 14F7 944B 6F11  49DB D895 1B79 E6BD
Keyserver: http://wwwkeys.pgp.net

2B  ||  !2B

ftpd(1M)              Maintenance Commands               ftpd(1M)

NAME
     ftpd - file transfer protocol server

SYNOPSIS
     in.ftpd [ -dl ] [ -t_t_i_m_e_o_u_t ]

DESCRIPTION
     ftpd is the Internet File  Transfer  Protocol  (FTP)  server
     process.   The  server  is  invoked  by  the Internet daemon
     inetd(1M) each time a connection to  the  FTP  service  (see
     services(4)) is made.

OPTIONS
     -d           Debugging information is logged to  the  system
                 log daemon syslogd(1M).

     -l           Each FTP session is logged to  the  system  log
                 daemon syslogd(1M).

      - t_t_i_m_e_o_u_t    Set  the   inactivity   timeout   period   to
                 _t_i_m_e_o_u_tseconds.   The FTP server will timeout an
                 inactive session after 15 minutes.

  Requests
     The  FTP  server  currently  supports  the   following   FTP
     requests; case is not distinguished.

     ABOR        abort previous command

     ACCT        specify account (ignored)

     ALLO        allocate storage (vacuously)

     APPE        append to a file

     CDUP        change to parent of current working directory

     CWD         change working directory

     DELE        delete a file

     HELP        give help information

     LIST        give list files in a directory (ls -lg)

     MKD         make a directory

     MODE        specify data transfer _m_o_d_e

     NLST        give name list of files in directory (ls)

     NOOP        do nothing

Sun Microsystems    Last change: 10 Mar 1993                    1

ftpd(1M)              Maintenance Commands               ftpd(1M)

     PASS        specify password

     PASV        prepare for server-to-server transfer

     PORT        specify data connection port

     PWD         print the current working directory

     QUIT        terminate session

     RETR        retrieve a file

     RMD         remove a directory

     RNFR        specify rename-from file name

     RNTO        specify rename-to file name

     STOR        store a file

     STOU        store a file with a unique name

     STRU        specify data transfer _s_t_r_u_c_t_u_r_e

     TYPE        specify data transfer _t_y_p_e

     USER        specify user name

     XCUP        change to parent of current working directory

     XCWD        change working directory

     XMKD        make a directory

     XPWD        print the current working directory

     XRMD        remove a directory

     The remaining FTP requests specified in RFC 959  are  recog-
     nized, but not implemented.

     The FTP server will abort an active file transfer only  when
     the  ABOR  command is preceded by a Telnet Interrupt Process
     (IP) signal and a Telnet Synch signal in the command  Telnet
     stream, as described in RFC 959.

     ftpd interprets file names according to the globbing conven-
     tions used by sh(1).  This allows users to utilize the meta-
     characters:  _**** _???? _[[[[ _]]]] _{{{{ _}}}} _~~~~

     ftpd authenticates users according to four rules.

Sun Microsystems    Last change: 10 Mar 1993                    2

ftpd(1M)              Maintenance Commands               ftpd(1M)

           1)    The user name must be in the password data base,
                 /etc/passwd,  and  have  a  password that is not
                 null.  A password must always be provided by the
                 client  before  any  file operations may be per-
                 formed.

           2)    If  the  user   name   appears   in   the   file
                 /etc/ftpusers, ftp access is denied.

           3)    ftp access is denied if the user's  shell  (from
                 /etc/passwd)   is   not   listed   in  the  file
                 /etc/shells.  If the file /etc/shells  does  not
                 exist,  then the user's shell must be one of the
                 following:

                       /usr/bin/sh  /usr/bin/csh /usr/bin/ksh
                       /usr/bin/jsh /bin/sh      /bin/csh
                       /bin/ksh     /bin/jsh     /sbin/sh
                       /sbin/jsh

           4)    If the user name is  "anonymous"  or  "ftp",  an
                 entry  for  the user name _f_t_p must be present in
                 the password and shadow files.  The user is then
                 allowed  to  log in by specifying any password -
                 by convention this is given as the user's e-mail
                 address  (such  as  [email-masked]).   Do not
                 specify a valid shell in the password  entry  of
                 the  _f_t_p  user, and do not give it a valid pass-
                 word (use NP in the encrypted password field  of
                 the shadow file).

     For anonymous ftp users, ftpd takes special measures to res-
     trict the client's access privileges.  The server performs a
     chroot(2) command to the home directory of the ftp user.  In
     order  that  system  security  is not breached, it is recom-
     mended that the ftp subtree be constructed with  care;   the
     following rules are suggested.

     ~ftp        Make the home directory owned by ftp and unwrit-
                 able by anyone.  This directory should not be on
                 a file system mounted with the nosuid option.

     ~ftp/bin    Make this directory owned by the super-user  and
                 unwritable by anyone.  Make this a symbolic link
                 to  ~ftp/usr/bin  The  program  ls(1)  must   be
                 present to support the list commands.  This pro-
                 gram should have mode 111.

Sun Microsystems    Last change: 10 Mar 1993                    3

ftpd(1M)              Maintenance Commands               ftpd(1M)

     ~ftp/usr/lib
                 Make this directory owned by the super-user  and
                 unwritable by anyone.  Copy the following shared
                 libraries from /usr/lib into this directory.:

                 ld.so*
                 libc.so*
                 libdl.so*
                 libintl.so*
                 libw.so*
                 libnsl.so*
                 libsocket.so*
                 nss_nis.so*
                 nss_nisplus.so*
                 nss_dns.so*
                 nss_files.so*
                 straddr.so*

     ~ftp/etc    Make this directory owned by the super-user  and
                 unwritable  by  anyone.   Copies  of  the  files
                 passwd(4), group(4), and  netconfig(4)  must  be
                 present  for  the  ls  command to work properly.
                 These files should be mode 444.

     ~ftp/pub    Make this directory mode 777 and owned  by  ftp.
                 Users  should  then  place files which are to be
                 accessible via the  anonymous  account  in  this
                 directory.

     ~ftp/dev    Make this directory owned by the super-user  and
                 unwritable  by  anyone.  First perform ls -lL on
                 the device files listed below to determine their
                 major  and  minor  numbers,  then  use  mknod to
                 create them in this directory.

                 /dev/zero
                 /dev/tcp
                 /dev/udp
                 /dev/ticotsord

EXAMPLE
     To set up anonymous ftp, add  the  following  entry  to  the
     /etc/passwd file. In this case, /export/ftp was chosen to be
     the anonymous ftp area, and the shell  is  the  non-existant
     file  /nosuchshell.   This prevents users from logging in as
     the ftp user.
         ftp:x:30000:30000:Anonymous FTP:/export/ftp:/nosuchshell
     Add the following entry to /etc/shadow:
         ftp:NP:6445::::::

Sun Microsystems    Last change: 10 Mar 1993                    4

ftpd(1M)              Maintenance Commands               ftpd(1M)

     The following is  a  shell  script  that  will  set  up  the
     anonymous  ftp  area.   It  presumes that names are resolved
     using NIS.

     #!/bin/sh
     # script to setup SunOS 5.3 anonymous ftp area
     #

     # handle the optional command line argument
     case $# in

        # the default location for the anon ftp comes from the passwd file
        0) ftphome="`grep '^ftp:' /etc/passwd | cut -d: -f6`"
           ;;

        1) if [ "$1" = "start" ]; then
              ftphome="`grep '^ftp:' /etc/passwd | cut -d: -f6`"
           else
              ftphome=$1
           fi
           ;;

        *) echo "Usage: $0 [anon-ftp-root]"
           exit 1
           ;;
     esac

     if [ -z "${ftphome}" ]; then
        echo "$0: ftphome must be non-null"
        exit 2
     fi

     # This script assumes that ftphome is neither / nor /usr so ...
     if [ "${ftphome}" = "/" -o "${ftphome}" = "/usr" ]; then
        echo "$0: ftphome must not be / or /usr"
        exit 2
     fi

     # If ftphome does not exist but parent does, create ftphome
     if [ ! -d ${ftphome} ]; then
         # lack of -p below is intentional
         mkdir ${ftphome}
     fi

     echo Setting up anonymous ftp area ${ftphome} for SunOS 5.3

     # Ensure that the /usr/bin directory exists
     if [ ! -d ${ftphome}/usr/bin ]; then
         mkdir -p ${ftphome}/usr/bin
     fi

     cp /usr/bin/ls ${ftphome}/usr/bin

Sun Microsystems    Last change: 10 Mar 1993                    5

ftpd(1M)              Maintenance Commands               ftpd(1M)

     chmod 111 ${ftphome}/usr/bin/ls

     # Now set the ownership and modes to match the man page
     chown root ${ftphome}/usr/bin
     chmod 555 ${ftphome}/usr/bin

     # this may not be the right thing to do
     # but we need the bin -> usr/bin link
     if [ -r ${ftphome}/bin ]; then
         mv -f ${ftphome}/bin ${ftphome}/Obin
     fi
     ln -s usr/bin ${ftphome}

     # Ensure that the /usr/lib and /etc directories exist
     if [ ! -d ${ftphome}/usr/lib ]; then
         mkdir -p ${ftphome}/usr/lib
     fi
     if [ ! -d ${ftphome}/etc ]; then
         mkdir -p ${ftphome}/etc
     fi

     #Most of the following are needed for basic operation, except
     #for libnsl.so, nss_nis.so, libsocket.so, and straddr.so which are
     #needed to resolve NIS names.

     cp /usr/lib/ld.so /usr/lib/ld.so.1 ${ftphome}/usr/lib

     for lib in libc libdl libintl libw libnsl libsocket \
        nss_nis nss_nisplus nss_dns nss_files
     do
        cp /usr/lib/${lib}.so.1 ${ftphome}/usr/lib
        rm -f ${ftphome}/usr/lib/${lib}.so
        ln -s ./${lib}.so.1 ${ftphome}/usr/lib/${lib}.so
     done

     cp /usr/lib/straddr.so.2 ${ftphome}/usr/lib
     rm -f ${ftphome}/usr/lib/straddr.so
     ln -s ./straddr.so.2 ${ftphome}/usr/lib/straddr.so

     cp /etc/passwd /etc/group /etc/netconfig ${ftphome}/etc

     chmod 555 ${ftphome}/usr/lib/*
     chmod 444 ${ftphome}/etc/*

     # Now set the ownership and modes
     chown root ${ftphome}/usr/lib ${ftphome}/etc
     chmod 555 ${ftphome}/usr/lib ${ftphome}/etc

     # Ensure that the /dev directory exists
     if [ ! -d ${ftphome}/dev ]; then
         mkdir -p ${ftphome}/dev

Sun Microsystems    Last change: 10 Mar 1993                    6

ftpd(1M)              Maintenance Commands               ftpd(1M)

     fi

     # make device nodes. ticotsord and udp are necessary for
     # 'ls' to resolve NIS names.
     prefix="/devices/pseudo/mm@0:"

     for device in zero
     do
        line=`ls -l ${prefix}${device} | sed -e 's/,//'`
        major=`echo $line | awk '{print $5}'`
        minor=`echo $line | awk '{print $6}'`
        rm -f ${ftphome}/dev/${device}
        mknod ${ftphome}/dev/${device} c ${major} ${minor}
     done

     prefix="/devices/pseudo/clone@0:"

     for device in tcp udp ticotsord
     do
        line=`ls -l ${prefix}${device} | sed -e 's/,//'`
        major=`echo $line | awk '{print $5}'`
        minor=`echo $line | awk '{print $6}'`
        rm -f ${ftphome}/dev/${device}
        mknod ${ftphome}/dev/${device} c ${major} ${minor}
     done
     chmod 666 ${ftphome}/dev/*

     ## Now set the ownership and modes
     chown root ${ftphome}/dev
     chmod 555 ${ftphome}/dev

     if [ ! -d ${ftphome}/pub ]; then
        mkdir -p ${ftphome}/pub
     fi
     chown ftp ${ftphome}/pub
     chmod 777 ${ftphome}/pub

DIAGNOSTICS
     ftpd logs various errors to syslogd, with a facility code of
     daemon.

  Info Severity
     These messages are logged only if the -l flag is specified.

     FTPD: connection from _h_o_s_t at _t_i_m_e
                 A connection was made to ftpd from the host _h_o_s_t
                 at the date and time _t_i_m_e.

     FTPD: User _u_s_e_r timed out after _t_i_m_e_o_u_t seconds at _t_i_m_e
                 The user _u_s_e_r was logged out  because  they  had
                 not  entered any commands after _t_i_m_e_o_u_t seconds;
                 the logout occurred at the date and time _t_i_m_e.

Sun Microsystems    Last change: 10 Mar 1993                    7

ftpd(1M)              Maintenance Commands               ftpd(1M)

  Debug Severity
     These messages are logged only if the -d flag is specified.

     FTPD: command: _c_o_m_m_a_n_d
                 A command line containing _c_o_m_m_a_n_d was read  from
                 the FTP client.

     lost connection
                 The FTP client dropped the connection.

     <--- _r_e_p_l_y_c_o_d_e
     <--- _r_e_p_l_y_c_o_d_e-
                 A reply was sent to  the  FTP  client  with  the
                 reply  code  _r_e_p_l_y_c_o_d_e.  The next message logged
                 will include the  message  associated  with  the
                 reply.  If a - follows the reply code, the reply
                 is continued on later lines.

SEE ALSO
     ftp(1), ls(1), aset(1M), inetd(1M), mknod(1M),  syslogd(1M),
     chroot(2),  getsockopt(3N), group(4), inetd.conf(4), netcon-
     fig(4), netrc(4), passwd(4), services(4)

     Postel, Jon, and  Joyce  Reynolds,  _F_i_l_e  _T_r_a_n_s_f_e_r  _P_r_o_t_o_c_o_l
     (FTP),RFC  959,  Network  Information  Center,  SRI Interna-
     tional, Menlo Park, Calif., October 1985.

NOTES
     The anonymous account is inherently dangerous and should  be
     avoided when possible.

     The server must run as the super-user to create sockets with
     privileged  port numbers.  It maintains an effective user id
     of the logged in user, reverting to the super-user only when
     binding  addresses  to sockets.  The possible security holes
     have been extensively scrutinized, but are  possibly  incom-
     plete.

     /etc/ftpusers contains a list of users who cannot access the
     system; the format of the file is one user name per line.

Sun Microsystems    Last change: 10 Mar 1993                    8