Subject: wu-2.4.2-academ[BETA-18-VR13] & Digital C2 security

From: Tony Warner <[email-masked]>
Date: Thu, 18 Feb 1999 16:56:13 -0800

I've posted a similar question here before and was told to upgrade to a
more current version of wu-ftpd.
Ok, so now I'm running wuftpd 2.4.2 beta 18 VR13. 
This is on a Alpha personal workstation 433 with Digital Unix 4.0D.
I am also running Enhanced Security.

I modified some files per the FAQ to account for the added security:

Make these changes to ./src/config/config.osf : 

        #define SecureWare
        #include <sys/secdefines.h>
        #include <sys/types.h>
        #include <sys/security.h>
        #include <sys/audit.h>
        #include <prot.h>

and add the following to ./src/makefiles/Makefile.osf 

        LIBES = -lsupport -lsecurity -laud

I compiled with "build du4".  there were a few warnings during the
compilation, but
everything seemed to build ok.

If I start up ftpd in the inetd file normally, everything works great.
However, if I add the -a at the end to enable the extended features,  no
logins are
accepted.  The server allows access by real and anonymous users, but the login
attempt fails with a "Login incorrect" message.

my inetd.conf line looks like this:

ftp	stream	tcp	nowait	root	/usr/sbin/ftpd	ftpd -a

What am I missing?

Tony Warner

*********************************************************************
Tony Warner						[email-masked]
General Atomics					(619) 455-4285

*********************************************************************

---

From: Ted Keller <[email-masked]>
Date: Thu, 18 Feb 1999 20:10:08 -0500 (EST)

Tony,

Just a couple of things to check....

Make sure that the version of the ftpd is the wu one - and not the digital
one.  Just verify that your running what you think you are.  Second, make
sure you have the file /etc/shells populated with the shells - as
specified in your /etc/passwd file.

Wonder through your syslog - and see if anything is complaining there.
Also check out the last accessed times on ftpaccess - and verify that it
is being read and checked.

Sorry if I can't be more helpful.

ted keller - bfg.com

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 18 Feb 1999 20:23:28 -0500 (EST)

On Thu, 18 Feb 1999, Tony Warner wrote:

> However, if I add the -a at the end to enable the extended features,
> no logins are accepted.  The server allows access by real and
> anonymous users, but the login attempt fails with a "Login incorrect"
> message.
> 

First, check that you're running the VR version.  The greeting will assure
you of that.  If it's not the VR version, kill -HUP inetd and check again.
If it's still not, the /usr/sbin/ftpd program is the wrong one.

Next, check that the access file is being used.  Add the following line at
the top:

greeting brief

and log into FTP again.  The greeting you see should be much reduced.  If
it's not, run ckconfig and see if it complains about anything;
specifically about not being able to find ftpaccess.

Finally, watch the system logs when you attempt to login to ftp.  If you
don't see anything, check your /etc/syslog.conf (or equivalent) to ensure
you're sending everything _somewhere_.

If the daemon isn't dying with a signal, all login failures are logged to
the system log with the specific reason.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Tony Warner <[email-masked]>
Date: Fri, 19 Feb 1999 08:15:55 -0800

Ok, I finally got this thing working.  Thanks for the help!
It turns out that ftpd was looking in a different place for the 
ftpaccess file.  I had placed it in /usr/local/etc/ftpaccess, 
and it was looking in /usr/local/lib/ftpd/ftpaccess.
I thought I had placed it in the default location (according to
some documentation I had read).  Where does one configure
this path?

Anyway, thanks again.

Tony Warner

---

From: [email-masked] (Albert Lunde)
Date: Fri, 19 Feb 1999 10:33:02 CST

> some documentation I had read).  Where does one configure

The paths can be configured by defining and undefining symbols
in src/config/config.xxx (where xxx is your architecture code).

In more extreme cases (as when I wanted to use totally different
cases for testing) on can edit src/pathnames.h directly
(which is where the conditional options for various commonly
used path locations are defined.)

For what it's worth, this is my favorite idiom for checking
for file paths in a binary:
= =
% strings /local-adm/bin/ftpd | egrep '/[a-z]+/' | sort -u
/bin/cksum
/bin/csh
/bin/ftp-exec
/bin/ls
/bin/ls -la
/bin/md5sum
/bin/sh
/dev/null
/etc/shells
/usr/bin/sh
/usr/lib/dld.sl
/usr/local/lib/ftpd/ftpaccess
/usr/local/lib/ftpd/ftpconversions
/usr/local/lib/ftpd/ftpgroups
/usr/local/lib/ftpd/ftphosts
/usr/local/lib/ftpd/ftpusers
/var/adm/wtmp
/var/adm/xferlog
/var/pid/ftp.pids-%s
/var/pid/ftpd.pid
FTP LOGIN REFUSED (ftp not in /etc/passwd) FROM %s, %s
= =

--
    Albert Lunde                      [email-masked]