Subject: chroot confusion & other ftp daemons

From: Lev Lvovsky <[email-masked]>
Date: Wed, 24 Mar 1999 12:23:55 -0800 (PST)

hello,

I was recently on this list until school caused me to unscsubscribe...I'm
back on, packin' an ADSL connection :).

I've got some questions RE the complicated and confusing concept of
chroot'ing users...here's what I want to do:

I'm going to be running a non-anonymous FTP site, with users who may or
may not have regular accounts on my server (read: shell accounts).  What
I'd like to do is have the non-shell users pop into their own directory,
and not be able to peruse the rest of the server.  These users would then
be able to 'cd' into a directory where they can both UL and DL files (kind
of like an incoming, but with visible files).  The regular users would
have a similar link to this directory in their own dir, but also the
ability to peruse the rest of the server...I was able to do this with
win32 clients, but I'd like to learn how to do this with *nix (Debian
Linux in particular).

Also, does anyone have any comments RE ProFTPD?  Security etc...Please
e-mail me privately :)

thanks so much!!!
-lev

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 24 Mar 1999 15:51:08 -0500 (EST)

On Wed, 24 Mar 1999, Lev Lvovsky wrote:

> I'm going to be running a non-anonymous FTP site, with users who may
> or may not have regular accounts on my server (read: shell accounts).  
> What I'd like to do is have the non-shell users pop into their own
> directory, and not be able to peruse the rest of the server.  These
> users would then be able to 'cd' into a directory where they can both
> UL and DL files (kind of like an incoming, but with visible files).  
> The regular users would have a similar link to this directory in their
> own dir, but also the ability to peruse the rest of the server...I was
> able to do this with win32 clients, but I'd like to learn how to do
> this with *nix (Debian Linux in particular).

Sounds like a standard guest setup.  I'd recommend setting up the
owning-users as guests too .. examples of all this are in my site:

  ftp://ftp.vr.net/pub/wu-ftpd/examples/

and some discussion of the issues is in upload.configuration.HOWTO the
guest HOWTO and the FAQ

The location of the latest version of wu-ftpd can be found in the 
directory
 
      ftp://ftp.vr.net/pub/wu-ftpd/
 
wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd FAQ:              http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

If there's sufficient interest, I could be prevailed upon to write a
power-guest HOWTO showing how to guests, and guest-of-guests, on virtual
hosts.  With or without anonymous access on the virtual hosts; with or
without guest or guest-of-guest access on the default server; using all
the advanced features of the VR version.

> Also, does anyone have any comments RE ProFTPD?  Security etc...Please

Age before beauty.  ProFTPD may look sexy but where's the track record?  
No security advisories means just that: no advisories.  It doesn't mean no
security problems.  ITOH a history of advisories shows long-term use and
correction of problems.

Personally, I'm more comfortable with servers which HAVE had a few CERT
advisories (and been corrected) than I am with ones which have not.  I am
especially leary of any server maintainer who proudly points to a lack of
advisories, or makes claims of security with no appearent history to back
those claims.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Lev Lvovsky <[email-masked]>
Date: Wed, 24 Mar 1999 13:20:01 -0800 (PST)

this site is confusing...there are several of the same-named files in the
various directories...none of them very self explanatory ;)

thanks
-lev

---

From: Jan Simek <[email-masked]>
Date: Wed, 24 Mar 1999 16:23:31 -0500 (EST)

Hi,

on Solaris 7, compiling 2.4.2-vr16, all goes ok except ftpd.
Any suggestions?

Thanks,
--Jan

============================================================================
Making ftpd.
Makefile:71: warning: overriding commands for target `ftpcount'
Makefile:28: warning: ignoring old commands for target `ftpcount'
Makefile:74: warning: overriding commands for target `ftpshut'
Makefile:31: warning: ignoring old commands for target `ftpshut'
Makefile:77: warning: overriding commands for target `ftpd'
Makefile:37: warning: ignoring old commands for target `ftpd'
Makefile:80: warning: overriding commands for target `ckconfig'
Makefile:34: warning: ignoring old commands for target `ckconfig'
Makefile:87: warning: overriding commands for target `clean'
Makefile:46: warning: ignoring old commands for target `clean'
Makefile:93: warning: overriding commands for target `cleandir'
Makefile:50: warning: ignoring old commands for target `cleandir'
Makefile:96: warning: overriding commands for target `depend'
Makefile:53: warning: ignoring old commands for target `depend'
Makefile:99: warning: overriding commands for target `lint'
Makefile:56: warning: ignoring old commands for target `lint'
Makefile:102: warning: overriding commands for target `tags'
Makefile:59: warning: ignoring old commands for target `tags'
Makefile:149: warning: overriding commands for target `vers.c'
Makefile:43: warning: ignoring old commands for target `vers.c'
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c ftpd.c -o ftpd.o
yacc  ftpcmd.y 
mv -f y.tab.c ftpcmd.c
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c ftpcmd.c -o ftpcmd.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c glob.c -o glob.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c logwtmp.c -o logwtmp.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c popen.c -o popen.o
sh newvers.sh
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c vers.c -o vers.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c access.c -o access.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c extensions.c -o extensions.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c realpath.c -o realpath.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c acl.c -o acl.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c private.c -o private.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c authenticate.c -o authenticate.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c conversions.c -o conversions.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c hostacc.c -o hostacc.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c sigfix.c -o sigfix.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c routevector.c -o routevector.o
gcc -O -O2 -O3 -O4 -I.. -I../support -L../support -s -DDEBUG -DVIRTUAL
-c restrict.c -o restrict.o
gcc -L../support -s -o ftpd ftpd.o ftpcmd.o glob.o logwtmp.o popen.o
vers.o access.o extensions.o realpath.o acl.o private.o authenticate.o
conversions.o hostacc.o sigfix.o routevector.o restrict.o  
Undefined                       first referenced
 symbol                             in file
socket                              ftpd.o
getpeername                         ftpd.o
gethostbyname                       ftpd.o
accept                              ftpd.o
bind                                ftpd.o
setsockopt                          ftpd.o
getservbyname                       ftpd.o
gethostbyaddr                       ftpd.o
inet_addr                           routevector.o
inet_ntoa                           ftpd.o
strsep                              private.o
getsockname                         ftpd.o
strcasestr                          access.o
listen                              ftpd.o
connect                             ftpd.o
ld: fatal: Symbol referencing errors. No output written to ftpd
make: *** [ftpd] Error 1

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 24 Mar 1999 16:53:09 -0500 (EST)

On Wed, 24 Mar 1999, Lev Lvovsky wrote:

> this site is confusing...there are several of the same-named files in
> the various directories...none of them very self explanatory ;)

> >   ftp://ftp.vr.net/pub/wu-ftpd/examples/

you mean 'passwd' 'group' .. names like that?  I don't explain the files
because I expect any Unix admin will know what they are.

You want to chroot, you have to recreate enough of the filesystem to be
usable.  The files have to have the same name because the do the same
thing and the software wants to open by that name.

If you see a file '/home/users/etc/passwd' it's the '/etc/passwd' for
people who are chroot'd to '/home/users'.

If you don't know what '/etc/passwd' is, go back to Windows and tell your
boss to hire a Unix admin to take over your job.

--

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 24 Mar 1999 16:58:55 -0500 (EST)

> connect                             ftpd.o

strcasestr is provided in the support directory for systems which don't
have it (yours doesn't so it's buit for you).

The others are missing libraries.

First .. did you do a './build sol'?  If so, do './build clean' first,
then './build sol' and see if that helps.  If not, that's your problem.

If you did './build sol' and './build clean' doesn't fix you up your
system is missing several POSIX functions and you should try to find them.
Maybe they're moved.  Maybe they're still on the CD/tape.

--

---

From: Ted Keller <[email-masked]>
Date: Wed, 24 Mar 1999 17:01:28 -0500 (EST)

Jan,

I just built it on a solaris 2.7 (using gcc-2.8.1) and all built good.
Please verify that you have the /usr/lib/libc.a and /usr/lib/libc.so files
loaded on your system.  Many of the missing entries should be located
there.  These should be loaded if you selected the developer options
during the solaris install.

ted keller - bfg.com

---

From: Duncan Hill <[email-masked]>
Date: Wed, 24 Mar 1999 17:21:13 -0500 (EST)

I have beta 18 of wu up and running, but have noticed that chrooting
of a regular user doesn't seem to work.  The passwd entry has a /./ at
the end of their path, yet when they type pwd, they can see the entire
tree above them, and run around on the server.  So far, since its only
faculty, none of them have tried that (and the permissions allow read
only), but I still need to be able to lock them into their dir and
below.

Box is AIX 4.3 (and my linux box appears to exhibit this as well).
Would appreciate any help, preferrably off the list.

--

Duncan Hill			Sapere aude
One net to rule them all, One net to find them,
One net to bring them all, and using Unix bind them.

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 24 Mar 1999 17:35:30 -0500 (EST)

> Would appreciate any help, preferrably off the list.

This is usually because

 - not using ftpaccess at all, check that -a is on the command line
   check that ftpaccess is REALLY being used by changing something in it
   and seeing if the next connection sees that effect.

 - no 'guestgroup' in ftpaccess

 - the user in question is not EXPLICITLY listed as a member of the
   guestgroup in /etc/group

--

---

From: [email-masked]
Date: Wed, 24 Mar 1999 18:23:19 -0500 (EST)

> only), but I still need to be able to lock them into their dir and

Interesting. The symptoms you describe mirror the experience I had when
I replaced Beta 13 with Beta 18 on a Solaris 2.5.1 box:

* The server was invoked with the appropriate flag (-a)

* All the real user entries in /etc/passwd had the appropriate '/./'
  entries

* The real users were explicitly listed as members of the guestgroup

* The guestgroup was specifically named in /etc/ftpaccess

* All of the appropriate system directories necessary for chrooting under
  Solaris were in place.

* All of the accounts were being chrooted to their designated directories.

However, once either version of the Beta 18 server was installed (with no
other changes) users could suddenly roam freely around the system.

As soon as I dumped the version 18 servers, and replaced them with the
orginal version 13 server, it all worked properly again...

--Duncan

---

From: "Maurice Hollingsworth" <[email-masked]>
Date: Wed, 24 Mar 1999 16:29:19 -0700

I too am running beta 18 of wu and am having problems with chrooting
(Version wu-2.4.2-academ[BETA-18](1)). I have triple checked all three of
the recommendations below, but all are fine.

If I use the following in /etc/inetd.conf I can login but get no chrooting
(not a surprise according to the documentation):
        ftp stream tcp nowait root /usr/local/etc/in.ftpd  in.ftpd

However, if I use '-a' flag as in the following, I get a "530 user
myusername access denied" message and am unable to login using the same
username.
        ftp stream tcp nowait root /usr/local/etc/in.ftpd  in.ftpd -a

We are running Sparc Solaris 2.5.1. Any assistance is appreciated.

Maurice Hollingsworth

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 24 Mar 1999 22:48:54 -0500 (EST)

> orginal version 13 server, it all worked properly again...

All I can say to this is, "How odd."  I'm sure if there were a problem,
the man who built my Solaris binaries would be beating me regularly until
I fixed it.

I guess I should also point out that if you're still running 2.4.2-beta-13
you've got worse problems than letting users roam at will through your
filesystem would cause.  I'd suggest trying the prebuild 2.5.1 pkgs for
VR16 from my FTP site and if they don't work, I or one of the people
helping me will jump on the problem.

--

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 24 Mar 1999 22:51:20 -0500 (EST)

On Wed, 24 Mar 1999, Maurice Hollingsworth wrote:

> (Version wu-2.4.2-academ[BETA-18](1)). I have triple checked all three
> of the recommendations below, but all are fine.
> 
> If I use the following in /etc/inetd.conf I can login but get no
> chrooting (not a surprise according to the documentation):
> myusername access denied" message and am unable to login using the
> same username.

Is there, perhaps, a command you need to run?  (Gotta love these secret
handshakes, folks.)  On some systems, you have to give the daemon
permission to do things like diddle about with the passwd and group files.
Maybe yours is on of them?

--

---

From: "Auteria Wally Winzer Jr." <[email-masked]>
Date: Wed, 24 Mar 1999 20:27:20 -0800

Greg and fellow members of wu-ftpd mailing list;

Wally here.  For those who didn't know,  I'm the one Greg
refers to "My Solaris Builder".  I've read all the various threads
regarding problems with Solaris-2.5.1 - 2.6.  This is quite interesting,
to say the least.  I can't believe that other individuals are having
problems with chrooted directories, whether or not it is an anonymous
setup or regular user id's home directories.  Before I submit pkgs for
Greg I check out all aspects of any VR version (anonymous,
chrooted, and regular user setup, from text or browser).  If there's
any issues I'd beat Grep up big time until we solve the problem(s).
One thing I feel is happening is users (admins) aren't setting up
wu-ftpd properly.  Either a lib is missing, or permission problems,
chrooted configurations, compiling errors, and the like.  The
problem I see most often is not following the INSTALL instructions.
This is what I go through to make sure everything is in place
on a Solaris system:

1. Make absolutely sure you've installed all header, and libraries.
    Check to make sure that permissions are in place and that you
    apply all applicable patches (kernel, network, libraries and headers).
2. Double-check all FAQ's and information pertaining to your system
    architecture.  Greg does a wonderful job updating issues with most
    OS'es.  A lot of time users on the list ask questions that has been
    covered over and over again.  First point of reference: THE FAQ.
3. I normally install all GNU-BASED utilities, which is way better than
    the standard OS binaries (with the exception of Linux).  One day
    Greg may decide to use GNU's autoconf tool.  This may make things
    easier for users, since it'll automatically determine the system
architecture
    and look for various library/system calls, header and library files, etc.
    configure will determine everything necessary to build a proper binary
    for that OS architecture.
4. ftpaccess has changed dramatically between versions.  Reading the
    CHANGES file from within the source tree is a great place to
    determine whether or not the new changes are applicable to your OS.

It is definitely recommended to upgrade to the latest version of wu-ftpd.
People who run earlier versions stands a great chance of servers being
exposed to hackers who have nothing better else to do than to totally
destroy systems.  You're extremely lucky if you haven't been broken into,
but don't push your luck.

OF COURSE, THIS IS MY OPINION.  I DON'T EXPECT EVERYONE
TO AGREE, WHICH IS WHY A MAILING LIST IS A GREAT WAY
OF BOUNCING OFF IDEAS DEALING WITH ISSUES THAT IN
OTHER FORUMS WOULD NOT BE APPLICABLE.

Your mileage will vary.

Anyway, Greg, I'll build and test VR17 tonight.

Sincerely,
Auteria "Wally" Winzer Jr.
Sr. Systems/Network Administrator
WahLeeWHIRL Corporation

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 24 Mar 1999 23:49:05 -0500 (EST)

On Wed, 24 Mar 1999, Auteria Wally Winzer Jr. wrote:

> Wally here.  For those who didn't know, I'm the one Greg refers to "My
> Solaris Builder".

Well .. from now on, I can say "Wally" .. cool.

> It is definitely recommended to upgrade to the latest version of wu-ftpd.

If you're running 2.4.2 (final) from Academ, check your
src/config/config.<ostype>  If it doesn't #define realpath to realpath on
steroids, assume you're still vulnerable to the latest exploit.

> destroy systems.

#define GreatChance 100%

> You're extremely lucky if you haven't been broken into, but don't push
> your luck.

Statistically speaking, if you say, "I haven't had a breakin in over a
year."  What you mean is you didn't NOTICE the breakin.  Maybe it wasn't
via FTP, but who knows?

Remember: you're not paranoid if they really ARE out to get you!

> Anyway, Greg, I'll build and test VR17 tonight.

Thanks.

Anyone know where I left my Kevlar body armour?  (There's a major change
in the 'make install' makefiles just waiting to bite me this month.)

--