Subject: RE: no-retrieve/allow-retrieve problems

From: Yusef Badri <[email-masked]>
Date: Mon, 14 Jun 1999 19:33:22 +0100

Hello,
It is indeed the case that it always treats me as being of class 'admin',
but the question is how could that happen, when my source IP address doesn't
match those specified in the "class admin" directive.
Is there something subtle about the order of these directives ?

I also have an ftphosts file restricting each user to a particular set of IP
addresses. Could there be any strange interactions between that and
ftpaccess ?

I have considered making each user a chroot guest, but I was looking for an
easier alternative to creating one chroot paritition per user.

Thinking about it, what would be really nice for situations like mine, would
be a directive which told wuftpd to disallow any access to a pathname whose
prefix didn't match the current user's home directory (using realpath() at
all times, to avoid any problems with links).

Thanks
Yusef

> -----Original Message-----
> From: Gregory A Lundberg [mailto:[email-masked]]
> Sent: Wednesday, June 09, 1999 9:45 PM
> To: Yusef Badri
> Cc: [email-masked]'
> Subject: Re: no-retrieve/allow-retrieve problems
> 
> 
> On Wed, 9 Jun 1999, Yusef Badri wrote:
> 
> > class admin real localhost admin1-host admin2-host
> > class webstats real stats-host 192.168.68.0/23
> > class cust1 real cust1-host
> > class cust2 real cust2-host
> > 
> > noretrieve / core
> > allow-retrieve class=admin / core
> > allow-retrieve class=cust1 /disk2/wwwroots/cust1/htdocs
> > allow-retrieve class=cust2 /disk2/wwwroots/cust2/htdocs
> > allow-retrieve class=webstats /disk2/wwwroots
> > 
> > The intention is that no customer can retrieve any files, unless
> > explicitly allowed by an allow-retrieve command. When I log in from
> > 192.168.68.0/23 (ie. as class=webstats), I am always able 
> to retrieve
> > files in /etc, despite the noretrieve command. If I comment out the
> > "allow-retrieve class=admin / core" entry, then the server 
> does refuse
> > to fetch /etc/passwd, but it also refuses to fetch valid files, eg.
> > /disk2/wwwroots/cust1/htdocs/index.htm It's as if I'm always treated
> > as class=admin.
> 
> Take out the 
>   allow-retrieve class=admin / core
> And see what happens.  If that fixes it, you were _not_ 'webstats' but
> wre, in fact, 'admin'.
> 
> > Can anybody spot what I'm doing wrong ?
> 
> Frankly, no.  But the class= stuff is too simplistic and could be the
> cause of your problem.
> 
> Looking at what you're trying to do I'd suggest it's be more secure to
> make your users guest rather than classify them based upon IP 
> number.  I'd
> also suggest 'admin' has no place on a server connected to 
> the Internet.
> 
> > Also, what is the meaning of the undocumented, optional "-" field in
> > the allow-retrieve directive (comes before the filename list).
> 
> Hmm.  I thought iswas documented.  anyway, the idea is to 
> stop the parse
> for parameters (class=) and start looking for filenames.  
> that way you can
> mark a file named 'class=cs-101' (non-)retrievable.
> 
> -- 
> 
> Gregory A Lundberg              Senior Partner, VRnet Company
> 1441 Elmdale Drive              [email-masked]
> Kettering, OH 45409-1615 USA    1-800-809-2195
>

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 14 Jun 1999 14:56:57 -0400 (EDT)

On Mon, 14 Jun 1999, Yusef Badri wrote:

> It is indeed the case that it always treats me as being of class
> 'admin', but the question is how could that happen, when my source IP
> address doesn't match those specified in the "class admin" directive.

The class directives are first-matched.  I think the problem is you're not
using one of the addresses listed in the 'admin' class line, so the daemon
is falling through to a later class.

> I also have an ftphosts file restricting each user to a particular set
> of IP addresses. Could there be any strange interactions between that
> and ftpaccess ?

No.

> I have considered making each user a chroot guest, but I was looking
> for an easier alternative to creating one chroot paritition per user.

That is most secure.

> Thinking about it, what would be really nice for situations like mine,
> would be a directive which told wuftpd to disallow any access to a
> pathname whose prefix didn't match the current user's home directory
> (using realpath() at all times, to avoid any problems with links).

Thining more about it, what is really needed is for users to RTFM.

Try installing the updated manapges.  Then read the ftpaccess manpage.
Search for 'restricted'.

--