Subject: RE: FTP server started without ftpaccess file

From: Magdalena Hewryk <[email-masked]>
Date: Fri, 27 Aug 1999 17:53:53 -0400

I don't have ckconfig file anymore because originally installed directory
was deleted, so I use # strings /usr/local/etc/wuftpd | grep ftpaccess
command, as you suggested.

--Question1
How many group I can set up under ftpaccess file under guestgroup?
Is there a limit?  If yes, what is the limit? How many ftpgroup99999 I can
add to ftpaccess file?

# specify which group of users will be treated as "guests".
guestgroup ftpusers ftpgroup1 ftpgroup2 ftpgroup3 ftpgroup4

---Question2
What these errors mean?  Any hints?
How can I debug them and fix them?
Server still starts without ftpaccess file but guestgroup rules are applied.
I re-start  /usr/sbin/inetd -s but without the result.

# strings /usr/sbin/in.ftpd | grep ftpaccess
FTP server started without ftpaccess file
Too many args (>%d) in ftpaccess: %s %s %s %s %s ...
ERROR ftpaccess port entry<%s> too large
ERROR ftpaccess port entry<%s> invalid
ERROR ftpaccess passive entry <%s> to large
ERROR ftpaccess vector entry<%s> to large
ERROR ftpaccess vector entry<%s> invalid
ERROR ftpaccess vector entry<%s> invalid
/usr/local/etc/ftpaccess
 
ls -ld /usr/local/etc/ftpaccess
-rw-------   1 root     other       2053 Aug 24 15:21
/usr/local/etc/ftpaccess
 
THIS IS FTPACCESS FILE:
# vi ftpaccess
"ftpaccess" 69 lines, 2053 characters 
# File: ftpaccess
# Date: March 23, 1997
#
# Details: This file is parsed by the ftp daemon on startup
#          for access settings
#

# Kick them off on two failed logins...
loginfails 2

# The group classes...
class   local   real,guest,anonymous *.domain 0.0.0.0
class   remote  real,guest,anonymous *

# User limits...
limit   local   25  Any                 /etc/msgs/msg.toomany
limit   remote  25  Any                 /etc/msgs/msg.toomany

# For directory READMEs
readme  README*    login
readme  README*    cwd=*

# Banners
message /welcome.msg            login
message .message                cwd=*

compress        yes             local remote
tar             yes             local remote

# allow use of private file for SITE GROUP and SITE GPASS?
private         yes

# passwd-check  <none|trivial|rfc822>  [<enforce|warn>]
passwd-check    rfc822  enforce

log commands  anonymous,guest,real inbound,outbound
log transfers anonymous,guest,real inbound,outbound

shutdown /etc/shutmsg

# all the following default to "yes" for everybody
delete          yes      guest,anonymous         # delete permission?
overwrite       yes      guest,anonymous         # overwrite permission?
rename          yes      guest,anonymous                # rename permission?
chmod           no      guest,anonymous         # chmod permission?
umask           no      guest,anonymous         # umask permission?

# specify the upload directory information
upload  /var/ftp  *             no
upload  /var/ftp  /incoming     yes     root    daemon  0600 dirs
upload  /var/ftp  /bin          no
upload  /var/ftp  /etc          no

# directory aliases...  [note, the ":" is not required]
alias   inc:    /incoming

# cdpath
cdpath  /incoming
cdpath  /pub
cdpath  /

# path-filter...
path-filter  anonymous  /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-

# specify which group of users will be treated as "guests".
guestgroup ftpusers ftpgroup1 ftpgroup2 ftpgroup3 ftpgroup4

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 27 Aug 1999 22:18:49 -0400

> Is there a limit?  If yes, what is the limit? How many ftpgroup99999 I can

Unlimited.  Well, limited by physical memory.

> class   local   real,guest,anonymous *.domain 0.0.0.0

Edit this.  *.domain and 0.0.0.0 should be replaced; or just remove the
entire line and and 'class local' stuff like the limit below.

> # allow use of private file for SITE GROUP and SITE GPASS?

You probably don't use this.  Omit it or say 'private no'

> umask           no      guest,anonymous         # umask permission?

Do you really want anonymous overwrite, delete and rename?  It's VERY
dangerous.

> upload  /var/ftp  /incoming     yes     root    daemon  0600 dirs

These only apply to users whose home directory is '/var/ftp', probably the
anonymous user.  Guest are, therefore, 'upload * * yes dirs'

> # directory aliases...  [note, the ":" is not required]

Do you really use this?

> cdpath  /

Or these?

> guestgroup ftpusers ftpgroup1 ftpgroup2 ftpgroup3 ftpgroup4

I keep coming back to inetd not passing the parameters to the daemon.
That's the only reason I can see for it not using ftpaccess.  No -a switch
and no use ftpaccess.

Here's how I'd test for ftpaccess being used:

Check the manpage, do you have 'hostname' or 'greeting'?  If so, use one of
these and see if the greeting when you connect to the server changes:

hostname it.worked
greeting brief

If so, take them out.  Your ftpaccess file is being users.

If you don't have these features (an academ version), comment out all
'class' statements.  You shouldn't be allowed in: no class.

The problem is almost always inetd.conf if the ftpaccess file isn't being
used.

-- 

Gregory A Lundberg              WU-FTPD Development Group
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195