Re: Wheezy: substitute for wu-ftpd - recommendations?

[Camaleón]

On Mon, 17 Sep 2012 23:11:14 +0200, Hartwig Atrops wrote:

> I am looking for an ftp server for Wheezy. Usually, I install wu-ftpd,
> but it's missing in Wheezy.

Is not there? Let's see the reason...

http://packages.qa.debian.org/w/wu-ftpd.html

Bug#595500: Removed package(s) from unstable

--- Reason ---
ROM; dead upstream, orphaned, doesn't support IPv6, alternatives exist
--

Time for a replacement, yes :-)

> debian.org, Software Packages in "wheezy", Subsection net lists lots of
> ftp servers, but I do not want to test them all :-)
> 
> I need a simple server for my private network, but with support for
> anonymous file upload (my backup scripts work that way).
> 
> Any recommendations?

I would definetly look at wzdftpd and vsftpd (I specially like the 
latter) and Pure-FTFd or ProFTPD (good for large deployments, virtual 
hosting...).

Greetings,

-- 
Camaleón


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/k3a077$thl$1...@ger.gmane.org

Re: Wheezy: substitute for wu-ftpd - recommendations?

[Henrique de Moraes Holschuh]

On Mon, 17 Sep 2012, Hartwig Atrops wrote:
> I need a simple server for my private network, but with support for anonymous 
> file upload (my backup scripts work that way). 

vsftpd.  You will need to configure it to enable anonymous file upload,
though.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20120917213055.ga15...@khazad-dum.debian.net

Wheezy: substitute for wu-ftpd - recommendations?

[Hartwig Atrops]

Hi.

I am looking for an ftp server for Wheezy. Usually, I install wu-ftpd, but 
it's missing in Wheezy.

debian.org, Software Packages in "wheezy", Subsection net lists lots of ftp 
servers, but I do not want to test them all :-)

I need a simple server for my private network, but with support for anonymous 
file upload (my backup scripts work that way). 

Any recommendations?

Thanks,

   Hartwig


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/201209172311.14726.hartwig.atr...@arcor.de

Re: Wu-ftpd problem

[Frank Lin PIAT]

Hi,

[No top posting please, http://en.wikipedia.org/wiki/TOFU#Top-posting ]

On Wed, 2009-05-20 at 21:57 +0800, Jerry wrote:
> "Frank Lin PIAT" said 
> >
> > On Wed, 2009-05-20 at 00:11 +0800, Jerry wrote:
> >> Dear all,
> >>
> >> I have installed the Wu-ftpd in Etch.  It works properly after
> >> configuration.  One thing strange is that it cannot display the files or
> >> folder by using the browser like the following link
> >> ftp://ftp.comp.hkbu.edu.hk
> >>
> >> When using the browser to access my own ftp, it shows the similar page as
> >> the above link but without the similar content inside (just a blank white
> >> page with the heading)
> >
> > I don't understand what's wrong.
> >
> > Do you login anonymously, or with your user account?
   ^
You did not answer my questions above.

> Thank you for your reply.  Referring to the link provide:
> ftp://ftp.comp.hkbu.edu.hk
> 
> If you browse this link by your browser, you can read the following:
> 05/07/2008 12:00AM  9 class
> 05/20/2009 09:12PM  ¥Ø¿ý pub
> My problem is that my ftp cannot display these information, do you know the 
> problem.RegardsJerry


You should have a look at some other FTP servers which are either
simpler, or which have better documentation.

For a simple FTP server, "ftpd" might be a good choice.
For a complex FTP server, proftpd is one.

Since you seems new to FTP, I recommend the simple one (which is very
very likely to do what you want).

Franklin


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Re: Wu-ftpd problem

[Jerry]

Dear Frank,

Thank you for your reply.  Referring to the link provide: 
ftp://ftp.comp.hkbu.edu.hk

If you browse this link by your browser, you can read the following:
05/07/2008 12:00AM  9 class
05/20/2009 09:12PM  ¥Ø¿ý pub
My problem is that my ftp cannot display these information, do you know the 
problem.RegardsJerry
"Frank Lin PIAT"  
¼¶¼g©ó¶l¥ó·s»D:1242799127.5553.13.ca...@solid.paris.klabs.be...
> Hi,
>
> On Wed, 2009-05-20 at 00:11 +0800, Jerry wrote:
>> Dear all,
>>
>> I have installed the Wu-ftpd in Etch.  It works properly after
>> configuration.  One thing strange is that it cannot display the files or
>> folder by using the browser like the following link
>> ftp://ftp.comp.hkbu.edu.hk
>>
>> When using the browser to access my own ftp, it shows the similar page as
>> the above link but without the similar content inside (just a blank white
>> page with the heading)
>
> I don't understand what's wrong.
>
> Do you login anonymously, or with your user account?
>
> Try installing a command line based ftp client (apt-get install ftp),
> then login. it would be interesting to run the command "pwd" to make
> sure you are in the expected folder. I've attached a typical ftp session
> below, in case you are not familiar with it.
>
> Regards,
>
> Franklin
>
>
> $ ftp myetchbox
> Connected to myetchbox
> 220 myetchbox FTP server (Version wu-2.6.2(1) Mon Dec 11 13:26:04 UTC
> 2006) ready.
> Name (myetchbox:jdoe): frank
> 331 Password required for frank.
> Password:
> 230 User frank logged in.
> Remote system type is UNIX.
> Using binary mode to transfer files.
> ftp> pwd
> 257 "/home/frank" is current directory.
> ftp> ls
> 200 PORT command successful.
> 150 Opening ASCII mode data connection for /bin/ls.
> total 12
> -rw-r--r-- 1 frank frank  220 2009-05-20 07:51 .bash_logout
> -rw-r--r-- 1 frank frank  414 2009-05-20 07:51 .bash_profile
> -rw-r--r-- 1 frank frank 2227 2009-05-20 07:51 .bashrc
> 226 Transfer complete.
>
>
> 




-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Re: Wu-ftpd problem

[Frank Lin PIAT]

Hi,

On Wed, 2009-05-20 at 00:11 +0800, Jerry wrote:
> Dear all,
> 
> I have installed the Wu-ftpd in Etch.  It works properly after
> configuration.  One thing strange is that it cannot display the files or
> folder by using the browser like the following link
> ftp://ftp.comp.hkbu.edu.hk
> 
> When using the browser to access my own ftp, it shows the similar page as
> the above link but without the similar content inside (just a blank white
> page with the heading)

I don't understand what's wrong.

Do you login anonymously, or with your user account?

Try installing a command line based ftp client (apt-get install ftp),
then login. it would be interesting to run the command "pwd" to make
sure you are in the expected folder. I've attached a typical ftp session
below, in case you are not familiar with it.

Regards,

Franklin


$ ftp myetchbox
Connected to myetchbox
220 myetchbox FTP server (Version wu-2.6.2(1) Mon Dec 11 13:26:04 UTC
2006) ready.
Name (myetchbox:jdoe): frank
331 Password required for frank.
Password:
230 User frank logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pwd
257 "/home/frank" is current directory.
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
total 12
-rw-r--r-- 1 frank frank  220 2009-05-20 07:51 .bash_logout
-rw-r--r-- 1 frank frank  414 2009-05-20 07:51 .bash_profile
-rw-r--r-- 1 frank frank 2227 2009-05-20 07:51 .bashrc
226 Transfer complete.



-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Wu-ftpd problem

[Jerry]

Dear all,

I have installed the Wu-ftpd in Etch.  It works properly after
configuration.  One thing strange is that it cannot display the files or
folder by using the browser like the following link
ftp://ftp.comp.hkbu.edu.hk

When using the browser to access my own ftp, it shows the similar page as
the above link but without the similar content inside (just a blank white
page with the heading)

Any cue?

Jerry Wong




-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Wu-ftpd - problem

[Jerry]

Dear all,

I have installed the Wu-ftpd in Etch.  It works properly after 
configuration.  One thing strange is that it cannot display the files or 
folder by using the browser like the following link
ftp://ftp.comp.hkbu.edu.hk

When using the browser to access my own ftp, it shows the similar page as 
the above link but without the similar content inside (just a blank white 
page with the heading)

Any cue?


Jerry Wong




-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Re: wu-ftpd: how to set maximal transfer rate

[Branko Djurkovic]

Try this:
http://www.howtoforge.com/debian_etch_virtual_hosting_pureftpd_mysql_quota
http://www.howtoforge.com/pureftpd_mysql_virtual_hosting

On Dec 24, 2007 4:15 AM, J. Little <[EMAIL PROTECTED]> wrote:

> I don't want my ftp server eating all the bandwidth. How can I limit
> transfer rate? Thank you.
>
>

wu-ftpd: how to set maximal transfer rate

[J. Little]

I don't want my ftp server eating all the bandwidth. How can I limit
transfer rate? Thank you.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: wu-ftpd, telnetd, and neighbor table overflow blues

[Heather Yost]

 

 

Heather Yost

Accounts Payable/Administrative Assistant

Capital P & O Center/USA Sport & Health

800.215.0764/800.355.6492

[EMAIL PROTECTED]

 

Re: Problems configuring wu-ftpd

[Romulo Sousa]

sure you did. but could you explain me why the 'ls' command into a ftp
server?? further, which directory it should be copied?

thanks,

Romulo

On 11/8/05, Alan Ianson <[EMAIL PROTECTED]> wrote:
> On Tue November 8 2005 01:14 pm, Romulo Sousa wrote:
> > On 11/8/05, Alan Ianson <[EMAIL PROTECTED]> wrote:
> > > On Tue November 8 2005 12:16 pm, Romulo Sousa wrote:
> > > > Hi folks,
> > > >
> > > > I'm configuring a guest ftp server. The user is authenticated
> > > > normally. When the user try to view the context of the directory,
> > > > nothing show them up after an upload of a file. But when I list this
> > > > directory via ssh, I notice the file is there (though I can't see it
> > > > neither via ftp client nor via browser).
> > > > The unique howto that I've see about this told me the following:
> > > >
> > > > "NOTE WELL: if you cannot see the directory contents after you login
> > > > as the guest user, the 'ls' program that you installed is not working.
> > > > If you use an 'ls' linked for dynamic libraries, and you do not have
> > > > the required libraries and/or devices installed properly in the guest
> > > > tree, 'ls' will not work and you will not see the contents of the
> > > > guest directory."
> > > >
> > > > source: http://www.wu-ftpd.org/HOWTO/guest.HOWTO
> > > >
> > > > Sorry, but it didn't help to figure out this problem. Doesn't my 'ls'
> > > > work? If so, how should I reinstall it?
> > > >
> > > > I would be glad if somebody could help me w/ any documentation or even
> > > > w/ tips about what I might be doing for the context of my directory
> > > > simply is refusing to show me up.
> > >
> > > I use wu-ftpd here also, and haven't had any problems. It could be that
> > > the user doesn't have permission to view the incoming directory? I have
> > > never used it as yet, my server is an anonymous server so various folks
> > > can grab files and I've not had problems with that.
> > >
> > > No one has ever uploaded anything here, so I have never gotten any
> > > reports of problems, but then no one has ever tried. :)
> > >
> > > Is it files in your incoming directory that your having problems with?
> >
> > should i create "/../../incoming" directory w/ this exactly name? or
> > directories such as:
> > /home/user/bin
> > /home/user/etc
> > /home/user/dev
> > must be created for any purpose?
> >
> > i'm trying to understand the logic involved. first look, i thought it
> > would be a closer configuration regarding squid.but for a guest is
> > one and anonymous is another...then i'm dummed! :-P
> >
> > for a guest configuration i've done the following (w/ commands to be
> > shortly ok?) :
> > - adduser user
> > - addgroup client
> > - mkdir /home/user/directory (this is the default directory when users
> > access my box).
> > - chmod properly the directories created as well as their groups.
> > -> i've read about chroot usersbut i didn't understand about it.
> > man pages didn't help me very much
> > "chroot - run command or interactive shell with special root directory"
> > - configure my ftpaccess as i've read at
> > http://www.wu-ftpd.org/HOWTO/guest.HOWTO
>
> wu-ftpd only has access to it's home directory, it is chrooted or jailed there
> so no one can access the rest of your system from there. On my setup public
> files (for anyone, nobody cares who) go into the pub directory off wu-ftpd's
> home directory. If you want to give certain users access to certain
> directories you'll need to create those directories in wu-ftpd's home also
> with the appropriate permissions and setup in wu-ftpd's config.
>
> Hope that helps.. :)
>
>
> --
> To UNSUBSCRIBE, email to [EMAIL PROTECTED]
> with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
>
>

Re: Problems configuring wu-ftpd

[Alan Ianson]

On Tue November 8 2005 01:14 pm, Romulo Sousa wrote:
> On 11/8/05, Alan Ianson <[EMAIL PROTECTED]> wrote:
> > On Tue November 8 2005 12:16 pm, Romulo Sousa wrote:
> > > Hi folks,
> > >
> > > I'm configuring a guest ftp server. The user is authenticated
> > > normally. When the user try to view the context of the directory,
> > > nothing show them up after an upload of a file. But when I list this
> > > directory via ssh, I notice the file is there (though I can't see it
> > > neither via ftp client nor via browser).
> > > The unique howto that I've see about this told me the following:
> > >
> > > "NOTE WELL: if you cannot see the directory contents after you login
> > > as the guest user, the 'ls' program that you installed is not working.
> > > If you use an 'ls' linked for dynamic libraries, and you do not have
> > > the required libraries and/or devices installed properly in the guest
> > > tree, 'ls' will not work and you will not see the contents of the
> > > guest directory."
> > >
> > > source: http://www.wu-ftpd.org/HOWTO/guest.HOWTO
> > >
> > > Sorry, but it didn't help to figure out this problem. Doesn't my 'ls'
> > > work? If so, how should I reinstall it?
> > >
> > > I would be glad if somebody could help me w/ any documentation or even
> > > w/ tips about what I might be doing for the context of my directory
> > > simply is refusing to show me up.
> >
> > I use wu-ftpd here also, and haven't had any problems. It could be that
> > the user doesn't have permission to view the incoming directory? I have
> > never used it as yet, my server is an anonymous server so various folks
> > can grab files and I've not had problems with that.
> >
> > No one has ever uploaded anything here, so I have never gotten any
> > reports of problems, but then no one has ever tried. :)
> >
> > Is it files in your incoming directory that your having problems with?
>
> should i create "/../../incoming" directory w/ this exactly name? or
> directories such as:
> /home/user/bin
> /home/user/etc
> /home/user/dev
> must be created for any purpose?
>
> i'm trying to understand the logic involved. first look, i thought it
> would be a closer configuration regarding squid.but for a guest is
> one and anonymous is another...then i'm dummed! :-P
>
> for a guest configuration i've done the following (w/ commands to be
> shortly ok?) :
> - adduser user
> - addgroup client
> - mkdir /home/user/directory (this is the default directory when users
> access my box).
> - chmod properly the directories created as well as their groups.
> -> i've read about chroot usersbut i didn't understand about it.
> man pages didn't help me very much
> "chroot - run command or interactive shell with special root directory"
> - configure my ftpaccess as i've read at
> http://www.wu-ftpd.org/HOWTO/guest.HOWTO

wu-ftpd only has access to it's home directory, it is chrooted or jailed there 
so no one can access the rest of your system from there. On my setup public 
files (for anyone, nobody cares who) go into the pub directory off wu-ftpd's 
home directory. If you want to give certain users access to certain 
directories you'll need to create those directories in wu-ftpd's home also 
with the appropriate permissions and setup in wu-ftpd's config.

Hope that helps.. :)


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Problems configuring wu-ftpd

[Romulo Sousa]

On 11/8/05, Alan Ianson <[EMAIL PROTECTED]> wrote:
> On Tue November 8 2005 12:16 pm, Romulo Sousa wrote:
> > Hi folks,
> >
> > I'm configuring a guest ftp server. The user is authenticated
> > normally. When the user try to view the context of the directory,
> > nothing show them up after an upload of a file. But when I list this
> > directory via ssh, I notice the file is there (though I can't see it
> > neither via ftp client nor via browser).
> > The unique howto that I've see about this told me the following:
> >
> > "NOTE WELL: if you cannot see the directory contents after you login
> > as the guest user, the 'ls' program that you installed is not working.
> > If you use an 'ls' linked for dynamic libraries, and you do not have
> > the required libraries and/or devices installed properly in the guest
> > tree, 'ls' will not work and you will not see the contents of the
> > guest directory."
> >
> > source: http://www.wu-ftpd.org/HOWTO/guest.HOWTO
> >
> > Sorry, but it didn't help to figure out this problem. Doesn't my 'ls'
> > work? If so, how should I reinstall it?
> >
> > I would be glad if somebody could help me w/ any documentation or even
> > w/ tips about what I might be doing for the context of my directory
> > simply is refusing to show me up.
>
> I use wu-ftpd here also, and haven't had any problems. It could be that the
> user doesn't have permission to view the incoming directory? I have never
> used it as yet, my server is an anonymous server so various folks can grab
> files and I've not had problems with that.
>
> No one has ever uploaded anything here, so I have never gotten any reports of
> problems, but then no one has ever tried. :)
>
> Is it files in your incoming directory that your having problems with?

should i create "/../../incoming" directory w/ this exactly name? or 
directories such as:
/home/user/bin
/home/user/etc
/home/user/dev
must be created for any purpose?

i'm trying to understand the logic involved. first look, i thought it
would be a closer configuration regarding squid.but for a guest is
one and anonymous is another...then i'm dummed! :-P

for a guest configuration i've done the following (w/ commands to be
shortly ok?) :
- adduser user
- addgroup client
- mkdir /home/user/directory (this is the default directory when users
access my box).
- chmod properly the directories created as well as their groups.
-> i've read about chroot usersbut i didn't understand about it.
man pages didn't help me very much
"chroot - run command or interactive shell with special root directory"
- configure my ftpaccess as i've read at
http://www.wu-ftpd.org/HOWTO/guest.HOWTO

thanks a lot!

Romulo Sousa

Re: Problems configuring wu-ftpd

[Alan Ianson]

On Tue November 8 2005 12:16 pm, Romulo Sousa wrote:
> Hi folks,
>
> I'm configuring a guest ftp server. The user is authenticated
> normally. When the user try to view the context of the directory,
> nothing show them up after an upload of a file. But when I list this
> directory via ssh, I notice the file is there (though I can't see it
> neither via ftp client nor via browser).
> The unique howto that I've see about this told me the following:
>
> "NOTE WELL: if you cannot see the directory contents after you login
> as the guest user, the 'ls' program that you installed is not working.
> If you use an 'ls' linked for dynamic libraries, and you do not have
> the required libraries and/or devices installed properly in the guest
> tree, 'ls' will not work and you will not see the contents of the
> guest directory."
>
> source: http://www.wu-ftpd.org/HOWTO/guest.HOWTO
>
> Sorry, but it didn't help to figure out this problem. Doesn't my 'ls'
> work? If so, how should I reinstall it?
>
> I would be glad if somebody could help me w/ any documentation or even
> w/ tips about what I might be doing for the context of my directory
> simply is refusing to show me up.

I use wu-ftpd here also, and haven't had any problems. It could be that the 
user doesn't have permission to view the incoming directory? I have never 
used it as yet, my server is an anonymous server so various folks can grab 
files and I've not had problems with that.

No one has ever uploaded anything here, so I have never gotten any reports of 
problems, but then no one has ever tried. :)

Is it files in your incoming directory that your having problems with?


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Problems configuring wu-ftpd

[Romulo Sousa]

Hi folks,

I'm configuring a guest ftp server. The user is authenticated
normally. When the user try to view the context of the directory,
nothing show them up after an upload of a file. But when I list this
directory via ssh, I notice the file is there (though I can't see it
neither via ftp client nor via browser).
The unique howto that I've see about this told me the following:

"NOTE WELL: if you cannot see the directory contents after you login
as the guest user, the 'ls' program that you installed is not working.
If you use an 'ls' linked for dynamic libraries, and you do not have
the required libraries and/or devices installed properly in the guest
tree, 'ls' will not work and you will not see the contents of the
guest directory."

source: http://www.wu-ftpd.org/HOWTO/guest.HOWTO

Sorry, but it didn't help to figure out this problem. Doesn't my 'ls'
work? If so, how should I reinstall it?

I would be glad if somebody could help me w/ any documentation or even
w/ tips about what I might be doing for the context of my directory
simply is refusing to show me up.

Best regards,

Romulo Sousa

Re: wu-ftpd

[Paul Johnson]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

"Gorka" <[EMAIL PROTECTED]> writes:

> Because of my poor English I'll try to explain it in Spanish.

OK, please take it to debian-user-spanish then.
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFBecsIUzgNqloQMwcRAo2zAKCeNHHSPBtIE16/VyBIMLij6tpK/QCeOIus
9T3XZSKOCXw9NgiU74hyJbU=
=EBwg
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: wu-ftpd

[Ron Johnson]

On Fri, 2004-10-22 at 06:15 -0400, Antonio Rodriguez wrote:
> I am replacing his question with the English adapted version:
> 
> He wants to make available to two people the directory "/var/www/web"
> (none of the two is a 'user' of the system), who would be able to make
> changes to their personal pages persona1.php and persona2.php through
> a ftp client from windows after authentication. They shouldn't be able
> to do anything above /var/www/web.
> 
> He is new to linux and is lost, so he needs pointers to step by step
> tutorials if anyone knows of any. He read /usr/share/doc/wu-ftpd but
> still doesn't have a clue. 

Would it be simple to adduser them, and then symlink
~user1/personal.php -> /var/www/web
  and
~user2/persona2.php -> /var/www/web

-- 
-
Ron Johnson, Jr.
Jefferson, LA USA
PGP Key ID 8834C06B

When Swedes start committing terrorism, I'll become suspicious of
Scandinavians.



signature.asc
Description: This is a digitally signed message part

Re: wu-ftpd

[Antonio Rodriguez]

I am replacing his question with the English adapted version:

He wants to make available to two people the directory "/var/www/web"
(none of the two is a 'user' of the system), who would be able to make
changes to their personal pages persona1.php and persona2.php through
a ftp client from windows after authentication. They shouldn't be able
to do anything above /var/www/web.

He is new to linux and is lost, so he needs pointers to step by step
tutorials if anyone knows of any. He read /usr/share/doc/wu-ftpd but
still doesn't have a clue. 


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

wu-ftpd

[Gorka]

Because of my poor English I'll try to explain it in Spanish.

¿Alguien me puede pasar una lista de pasos a dar en plan novatísimo para
compartir mediante wu-ftpd la carpeta /var/www/web entre un par de personas
(sin usuario en Debian) que actualizarán sus páginas persona1.php y
persona2.php mediante un cliente ftp (desde windows) utilizando su nombre de
usuario y contraseña y para que no puedan hacer /var/www/web/ cd .. sino
sólo crear directorios y lo que sea pero por debajo de /var/www/web/?

Soy nuevo en linux, es decir, que conozco hasta 'apt-get install wu-ftpd', a
partir de ahí estoy en vuestras manos.

Anticipándome a las respuestas. Ya he leído muchos documentos sobre wu-ftpd
anónimo e invitado, y me atasco en todos. La ayuda de
/usr/share/doc/wu-ftpd/ no la entiendo.

Muchas gracias.

Thanks.




  Gorka -> [EMAIL PROTECTED]
Debian Woody / Kernel 2.4 / Apache 1.3.26
PostgreSQL 7.2.1-2 / PHP 4.1.2-6



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Wu-ftpd broken in Sid

[Colin Watson]

On Sat, Aug 02, 2003 at 01:29:26AM +0200, Pim Bliek | PingWings wrote:
> I just did an apt-get update, apt-get dist-upgrade on my SID box and got
> this:
> 
> Selecting previously deselected package wu-ftpd.
> (Reading database ... 49867 files and directories currently installed.)
> Unpacking wu-ftpd (from .../wu-ftpd_2.6.2-12_i386.deb) ...
> Setting up wu-ftpd (2.6.2-12) ...
> Old wu-ftpd options: -l
> 
> Disabling other FTP services in /etc/inetd.conf
> /etc/init.d/wu-ftpd: line 32: syntax error near unexpected token `fi'
> /etc/init.d/wu-ftpd: line 32: `fi     '
> invoke-rc.d: initscript wu-ftpd, action "start" failed.
> 
> Appears to me there is something wrong in the init.d startup script for
> wu-ftpd.

Yeah, there's a missing '; then'. Please file a bug if one hasn't
already been filed.

-- 
Colin Watson  [EMAIL PROTECTED]


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Wu-ftpd broken in Sid

[Pim Bliek | PingWings]

Hi,

I just did an apt-get update, apt-get dist-upgrade on my SID box and got
this:

Selecting previously deselected package wu-ftpd.
(Reading database ... 49867 files and directories currently installed.)
Unpacking wu-ftpd (from .../wu-ftpd_2.6.2-12_i386.deb) ...
Setting up wu-ftpd (2.6.2-12) ...
Old wu-ftpd options: -l

Disabling other FTP services in /etc/inetd.conf
/etc/init.d/wu-ftpd: line 32: syntax error near unexpected token `fi'
/etc/init.d/wu-ftpd: line 32: `fi '
invoke-rc.d: initscript wu-ftpd, action "start" failed.

Appears to me there is something wrong in the init.d startup script for
wu-ftpd.

Anyone else able to reproduce? 

Since I did and apt-get update etc half an hour ago as well, the package
was just updated (or just uploaded to my local mirror in the
netherlands...)

Pim

-
PingWings 

- - - - - - - - - - - - - - - - - - - - -
M:  06-28474259
E:  [EMAIL PROTECTED]
I:  www.pingwings.nl
-
  



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

RE: wu-ftpd security - solved

[Ross Tsolakidis]

Title: RE: wu-ftpd security - solved





Thanks heaps Mike.  :)



-Original Message-
From: Mike Dresser [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, 11 February 2003 2:21 AM
To: Ross Tsolakidis
Cc: '[EMAIL PROTECTED]'
Subject: Re: wu-ftpd security





On Mon, 10 Feb 2003, Ross Tsolakidis wrote:


> Hi all,
>
> With wu-ftpd installed, by default the user can ftp to his home directory,
> but can then just go up a few dirs and view the entire filesystem.
> Is there some way to limit wu-ftpd from doing this, I just want the users to
> have access to their own home dirs and thats it.


guest-root /home username


restricted-uid username


allow-uid username


deny-uid %-65535


The allow-uid line has the advantage of not allowing ftp to anyone that
isn't in the allow-uid field.


If they try to go up a level it will give them an error message to the
effect that they are restricted in what they can do.


Mike



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: wu-ftpd security

[Mike Dresser]

On Mon, 10 Feb 2003, Ross Tsolakidis wrote:

> Hi all,
>
> With wu-ftpd installed, by default the user can ftp to his home directory,
> but can then just go up a few dirs and view the entire filesystem.
> Is there some way to limit wu-ftpd from doing this, I just want the users to
> have access to their own home dirs and thats it.

guest-root /home username

restricted-uid username

allow-uid username

deny-uid %-65535

The allow-uid line has the advantage of not allowing ftp to anyone that
isn't in the allow-uid field.

If they try to go up a level it will give them an error message to the
effect that they are restricted in what they can do.

Mike


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

wu-ftpd security

[Ross Tsolakidis]

Title: wu-ftpd security





Hi all,


With wu-ftpd installed, by default the user can ftp to his home directory, but can then just go up a few dirs and view the entire filesystem.

Is there some way to limit wu-ftpd from doing this, I just want the users to have access to their own home dirs and thats it.

Cheers,


Ross.

Re: wu-ftpd woes

[Rob Weir]

On Thu, Dec 19, 2002 at 04:05:41PM -0600, Michael Kahle wrote:
> to install and configure.  I only hope I can secure it well.

Compared to wu-ftpd, it is probably impenetrable.  wu-* is kind of
infamous for being extremely insecure...Still, don't get lazy with your
security updates.

-rob



msg20525/pgp0.pgp
Description: PGP signature

Re: wu-ftpd woes

[Benedict Verheyen]

On Thu, 2002-12-19 at 19:03, Michael Kahle wrote:
> I am trying to setup a ftp server on my company lan for a repository of g4u
> created machine images.  I have chosen to install wu-ftpd.
> 
> I cannot seam to get this to authenticate me.  I have NOT setup anonymous
> user access, I am only configuring this based on the guest access wu-ftpd
> HOWTO:
> http://www.wu-ftpd.org/HOWTO/guest.HOWTO
> 
> A few questions.  I am using the wu-ftpd package from SID.
> 
> Is the debian package compiled to use /etc/ftpaccess by default?  I am
> assuming it is.
> Does wu-ftpd want you to create user entries in:
> ../[the directory you want the user to chroot to]/etc?
> 
> I am confused as to why this is not working.
> 
> Any (help)(comments)(you are dumb, you should to this) etc welcome.
> 
> Thanks for your time.
> 
> Michael
> 

I use wu-ftpd too for a project and i literally hate it. It came
preinstalled with the red hat server. I prefer proftpd as it
strongely represents the apache style of configuring which is
clearer IMHO than wuftpd.
Of course, your milleage may vary.



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

RE: wu-ftpd woes

[Michael Kahle]

> -Original Message-
> From: Michael Kahle [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, December 19, 2002 12:06 PM
> To: [EMAIL PROTECTED]
> Subject: wu-ftpd woes
> 
> 
> I am trying to setup a ftp server on my company lan for a 
> repository of g4u
> created machine images.  I have chosen to install wu-ftpd.
> 
> I cannot seam to get this to authenticate me.  I have NOT 
> setup anonymous
> user access, I am only configuring this based on the guest 
> access wu-ftpd
> HOWTO:
> http://www.wu-ftpd.org/HOWTO/guest.HOWTO
> 
> A few questions.  I am using the wu-ftpd package from SID.
> 
> Is the debian package compiled to use /etc/ftpaccess by default?  I am
> assuming it is.
> Does wu-ftpd want you to create user entries in:
> ../[the directory you want the user to chroot to]/etc?
> 
> I am confused as to why this is not working.
> 
> Any (help)(comments)(you are dumb, you should to this) etc welcome.
> 
> Thanks for your time.
> 
> Michael

I have given up on wu-ftpd.  I installed proftpd and I find it MUCH easier
to install and configure.  I only hope I can secure it well.

Thanks for your time.

Michael


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

wu-ftpd woes

[Michael Kahle]

I am trying to setup a ftp server on my company lan for a repository of g4u
created machine images.  I have chosen to install wu-ftpd.

I cannot seam to get this to authenticate me.  I have NOT setup anonymous
user access, I am only configuring this based on the guest access wu-ftpd
HOWTO:
http://www.wu-ftpd.org/HOWTO/guest.HOWTO

A few questions.  I am using the wu-ftpd package from SID.

Is the debian package compiled to use /etc/ftpaccess by default?  I am
assuming it is.
Does wu-ftpd want you to create user entries in:
../[the directory you want the user to chroot to]/etc?

I am confused as to why this is not working.

Any (help)(comments)(you are dumb, you should to this) etc welcome.

Thanks for your time.

Michael


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Passive mode with wu-ftpd

[nate]

Bob Nielsen said:

> Or is this is a firewall configuration problem, in which case what
> changes do I need to make there?  The fact that the server is sending its
> 192.168.2.2 address makes me suspicious, since that is not
> routable.

Use 1:1 Static NAT. Or only use active ftp on the machine. I've run
many machines behind static NAT(only using cisco routers, never using
a firewall machine) and they work fine. Or drop ftp and go with a
more friendly protocol like HTTP or HTTPS.

nate




-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Passive mode with wu-ftpd

[Bob Nielsen]

I am running a wu-ftpd server on a machine inside my NAT
router/firewall, which uses ipmasq and ipchains.  I have port 21
forwarded from the firewall to the ftp server with ipmasqadm.

Retrieving files without using passive mode works fine from either
inside or outside the firewall.  From another host on my LAN, passive
mode also works.  However, from outside the lan using passive mode, the
connection freezes after the server sends the following:

227 Entering Passive Mode (192,168,2,2,68,60)

I don't know if it is relevant, but found the following in
/usr/share/doc/wu-ftpd/wu-ftpd-faq.txt.gz:

14. Normal ftp clients work, Netscape ftp's fail. So, passive
mode doesn't work.
Apparantly ftpd needs write permission on ~ftp/dev/tcp in
order to operate correctly in passive mode (Solaris). Set it
to the same mode as permissions shown by ls -lL /dev/tcp,
being 666. Also read the Solaris man page for ftpd for
Solaris-specific information. Changed from previous versions
Fix:
cd ~ftp/dev
chmod 666 tcp

Is there an equivalent fix for Debian Linux, which doesn't have
~ftp/dev/tcp?

Or is this is a firewall configuration problem, in which case what
changes do I need to make there?  The fact that the server is sending
its 192.168.2.2 address makes me suspicious, since that is not
routable.

Bob


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: problem with ftpd (wu-ftpd and proftpd). Network freezes when I download/upload locally

[Hans Ekbrand]

On Fri, Feb 22, 2002 at 10:28:57AM +0100, "J?rn Andr? Berntzen [Nick: Nor]" 
wrote:
> Hi!
> 
> I'm using Debian with kernel 2.2.19 as a router for my home network doing 
> 100Mbit inside and cable outside.
> 
> I am using proftpd as a ftp server, but it freezes when I download/upload 
> locally from my Windows XP machine inside in the house.
> It all starts ok, giving me 6000kBytes or so in the beginning, but then the 
> transfer-rate diminishes 
> to 0.0Kbytes in a few seconds and Debian freezes every network connection 
> inside the house.
> But when I log into Debian at the machine itself - connection outside seems 
> ok. 
> 
> So I use ifdown -a and ifup -a  to get the network up and going again, but 
> ftpd freezes when I try anew.

It sound like the problem is with the NIC/kernel rather than ftpd. To
test, try scp a large file, or http.

What NIC do you have, and what driver do you use?

I had horrible issues with a bad NIC driver (eepro100 in the
kernel-source tree up to 2.4.17), network traffic would often cause
hard lock-ups. I got a driver from Intels webbsite, installed it, and
never had a problem since.


pgpkETXUsLria.pgp
Description: PGP signature

problem with ftpd (wu-ftpd and proftpd). Network freezes when I download/upload locally

[Jørn André Berntzen [Nick: Nor]]

Hi!

I'm using Debian with kernel 2.2.19 as a router for my home network doing 
100Mbit inside and cable outside.

I am using proftpd as a ftp server, but it freezes when I download/upload 
locally from my Windows XP machine inside in the house.
It all starts ok, giving me 6000kBytes or so in the beginning, but then the 
transfer-rate diminishes 
to 0.0Kbytes in a few seconds and Debian freezes every network connection 
inside the house.
But when I log into Debian at the machine itself - connection outside seems ok. 

So I use ifdown -a and ifup -a  to get the network up and going again, but ftpd 
freezes when I try anew.

Have anyone of you had this problem?
I'd be pleased to hear some suggestions of how to solve this. 

Greetings, 
Jorn Andre.

question on restarting daemons on package update(specifically wu-ftpd)

[Mike Dresser]

I'm sure this is a dumb question.

But i just installed the new wu-ftp (2.6.0-6) from proposed-updates via

apt-get update ; apt-get upgrade

Just ftp'd to localhost, and checked that it was immune or not.  Surprise,
the ~{ kills it.. Hmm.. Look up a few lines, and it's still the old date
string. So I

/etc/init.d/wu-ftpd restart

and now it's running the latest for me, doesn't throw a fit on the cd ~{
Shouldn't this have been done automatically for me?

I'm so lazy sometimes it's pathetic ;)

Mike

Re: wu-ftpd exploit and patch I got, debs too

[Colin Watson]

On Wed, Nov 28, 2001 at 09:57:29PM -0800, Brian Lavender wrote:
> A friend of mine emailed me this glob.c patch for the recent wu-ftpd
> exploit.  I don't understand how the exploit works, but I am sure someone
> will tell me if this patch gaurds against it. The only other patch out
> there seems to be the Dead Rat src rpm, so I'll post what I found. I also
> used the patch build Debian packages, so if you are running Debian, you
> can use my Debian packages.  Use them at your own risk though.

A fix is in incoming (http://incoming.debian.org/) for both stable and
unstable. Take the appropriate one. As usual when downloading from
incoming, though, it's at your own risk, and you should verify that the
GPG signature on the .changes file was made by a key on the Debian
keyring.

-- 
Colin Watson  [EMAIL PROTECTED]

wu-ftpd exploit and patch I got, debs too

[Brian Lavender]

A friend of mine emailed me this glob.c patch for the recent wu-ftpd
exploit.  I don't understand how the exploit works, but I am sure someone
will tell me if this patch gaurds against it. The only other patch out
there seems to be the Dead Rat src rpm, so I'll post what I found. I also
used the patch build Debian packages, so if you are running Debian, you
can use my Debian packages.  Use them at your own risk though. I don't
have extended experience at building Debian packages, and basically I
took the source from the previous package, upped the rev on the changelog,
and did a

$ fakeroot debian/rules binary 

and voila, I had new deb packages. You can get those at:

ftp://brie.com/pub/debian/potato

Below is the patch a friend emailed me.

brian


Generic patch against globc.c for:
Subject:  Wu-Ftpd File Globbing Heap Corruption Vulnerability


-- SNIP --

--- glob.c.orig Sat Jul  1 14:17:39 2000
+++ glob.c  Wed Nov 28 00:43:38 2001
@@ -298,7 +298,7 @@

 for (lm = restbuf; *p != '{'; *lm++ = *p++)
continue;
-for (pe = ++p; *pe; pe++)
+for (pe = ++p; *pe; pe++) {
switch (*pe) {

case '{':
@@ -314,11 +314,19 @@
case '[':
for (pe++; *pe && *pe != ']'; pe++)
continue;
+   if (!*pe) {
+   globerr = "Missing ]";
+   return (0);
+   }
continue;
}
+}
   pend:
-brclev = 0;
-for (pl = pm = p; pm <= pe; pm++)
+if (brclev || !*pe) {
+   globerr = "Missing }";
+   return (0);
+}
+for (pl = pm = p; pm <= pe; pm++) {
switch (*pm & (QUOTE | TRIM)) {

case '{':
@@ -352,19 +360,18 @@
return (1);
sort();
pl = pm + 1;
-   if (brclev)
-   return (0);
continue;

case '[':
for (pm++; *pm && *pm != ']'; pm++)
continue;
-   if (!*pm)
-   pm--;
+   if (!*pm) {
+   globerr = "Missing ]";
+   return (0);
+   }
continue;
}
-if (brclev)
-   goto doit;
+}
 return (0);
 }

@@ -416,11 +423,10 @@
else if (scc == (lc = cc))
ok++;
}
-   if (cc == 0)
-   if (ok)
-   p--;
-   else
-   return 0;
+   if (cc == 0) {
+   globerr = "Missing ]";
+   return (0);
+   }
continue;

case '*':


-- 
Brian Lavender
http://www.brie.com/brian/
-- 
Brian Lavender
http://www.brie.com/brian/

[marcus@doutlets.com: WU-FTPD 2.6.1 diff glob.c patch]

[Michael P. Soulier]

FYI

-- 
Michael P. Soulier <[EMAIL PROTECTED]>, GnuPG pub key: 5BC8BE08
"...the word HACK is used as a verb to indicate a massive amount
of nerd-like effort."  -Harley Hahn, A Student's Guide to Unix
--- Begin Message ---

Generic patch against globc.c for:
Subject:  Wu-Ftpd File Globbing Heap Corruption Vulnerability


-- SNIP --

--- glob.c.orig Sat Jul  1 14:17:39 2000
+++ glob.c  Wed Nov 28 00:43:38 2001
@@ -298,7 +298,7 @@

 for (lm = restbuf; *p != '{'; *lm++ = *p++)
continue;
-for (pe = ++p; *pe; pe++)
+for (pe = ++p; *pe; pe++) {
switch (*pe) {

case '{':
@@ -314,11 +314,19 @@
case '[':
for (pe++; *pe && *pe != ']'; pe++)
continue;
+   if (!*pe) {
+   globerr = "Missing ]";
+   return (0);
+   }
continue;
}
+}
   pend:
-brclev = 0;
-for (pl = pm = p; pm <= pe; pm++)
+if (brclev || !*pe) {
+   globerr = "Missing }";
+   return (0);
+}
+for (pl = pm = p; pm <= pe; pm++) {
switch (*pm & (QUOTE | TRIM)) {

case '{':
@@ -352,19 +360,18 @@
return (1);
sort();
pl = pm + 1;
-   if (brclev)
-   return (0);
continue;

case '[':
for (pm++; *pm && *pm != ']'; pm++)
continue;
-   if (!*pm)
-   pm--;
+   if (!*pm) {
+   globerr = "Missing ]";
+   return (0);
+   }
continue;
}
-if (brclev)
-   goto doit;
+}
 return (0);
 }

@@ -416,11 +423,10 @@
else if (scc == (lc = cc))
ok++;
}
-   if (cc == 0)
-   if (ok)
-   p--;
-   else
-   return 0;
+   if (cc == 0) {
+   globerr = "Missing ]";
+   return (0);
+   }
continue;

case '*':


--- End Message ---


pgpTPB3EokAgA.pgp
Description: PGP signature

Re: *ALERT* Wu-Ftpd File Globbing Heap Corruption Vulnerability

[Colin Watson]

On Wed, Nov 28, 2001 at 02:59:48PM -0800, Account for Debian group mail wrote:
> Anyone know what is being done with the Debian verson of Wu-Ftpd for this
> problem?

The maintainer knows about it and it's being dealt with.

-- 
Colin Watson  [EMAIL PROTECTED]

*ALERT* Wu-Ftpd File Globbing Heap Corruption Vulnerability

[Account for Debian group mail]

Anyone know what is being done with the Debian verson of Wu-Ftpd for this
problem?

Thanks,

Ken 

Date: Wed, 28 Nov 2001 10:05:28 -0700 (MST)
From: Dave Ahmad <[EMAIL PROTECTED]>
To: 
Subject: *ALERT* BID 3581: Wu-Ftpd File Globbing Heap Corruption
Vulnerability
Message-ID:
<[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII


---
  Security Alert

Subject:  Wu-Ftpd File Globbing Heap Corruption Vulnerability
BUGTRAQ ID:   3581   CVE ID: CVE-MAP-NOMATCH
Published:Nov 27, 2001   Updated:Nov 28, 2001 01:12:56

Remote:   YesLocal:  No
Availability: Always Authentication: Not Required
Credibility:  Vendor Confirmed   Ease:   No Exploit Available

Impact:   10.0   Severity: 10.0Urgency:  8.2

Last Change:  Initial analysis.
---

Vulnerable Systems:

  Washington University wu-ftpd 2.6.1
   + Caldera OpenLinux Server 3.1
   + Caldera OpenLinux Workstation 3.1
   + Cobalt Qube 1.0
   + Conectiva Linux 7.0
   + Conectiva Linux 6.0
   + MandrakeSoft Corporate Server 1.0.1
   + MandrakeSoft Linux Mandrake 8.1
   + MandrakeSoft Linux Mandrake 8.0 ppc
   + MandrakeSoft Linux Mandrake 8.0
   + MandrakeSoft Linux Mandrake 7.2
   + MandrakeSoft Linux Mandrake 7.1
   + MandrakeSoft Linux Mandrake 7.0

   + MandrakeSoft Linux Mandrake 6.1
   + MandrakeSoft Linux Mandrake 6.0
   + RedHat Linux 7.2 noarch
   + RedHat Linux 7.2 ia64
   + RedHat Linux 7.2 i686
   + RedHat Linux 7.2 i586
   + RedHat Linux 7.2 i386
   + RedHat Linux 7.2 athlon
   + RedHat Linux 7.2 alpha
   + RedHat Linux 7.1 noarch
   + RedHat Linux 7.1 ia64
   + RedHat Linux 7.1 i686
   + RedHat Linux 7.1 i586
   + RedHat Linux 7.1 i386
   + RedHat Linux 7.1 alpha
   + RedHat Linux 7.0 sparc
   + RedHat Linux 7.0 i386
   + RedHat Linux 7.0 alpha
   + TurboLinux TL Workstation 6.1
   + TurboLinux Turbo Linux 6.0.5
   + TurboLinux Turbo Linux 6.0.4
   + TurboLinux Turbo Linux 6.0.3
   + TurboLinux Turbo Linux 6.0.2
   + TurboLinux Turbo Linux 6.0.1
   + TurboLinux Turbo Linux 6.0
   + Wirex Immunix OS 7.0-Beta
   + Wirex Immunix OS 7.0
  Washington University wu-ftpd 2.6.0
   + Cobalt Qube 1.0
   + Conectiva Linux 5.1
   + Conectiva Linux 5.0
   + Conectiva Linux 4.2
   + Conectiva Linux 4.1
   + Conectiva Linux 4.0es
   + Conectiva Linux 4.0
   + Debian Linux 2.2 sparc
   + Debian Linux 2.2 powerpc
   + Debian Linux 2.2 arm
   + Debian Linux 2.2 alpha
   + Debian Linux 2.2 68k
   + Debian Linux 2.2
   + RedHat Linux 6.2 sparc
   + RedHat Linux 6.2 i386
   + RedHat Linux 6.2 alpha
   + RedHat Linux 6.1 sparc
   + RedHat Linux 6.1 i386
   + RedHat Linux 6.1 alpha
   + RedHat Linux 6.0 sparc
   + RedHat Linux 6.0 i386
   + RedHat Linux 6.0 alpha
   + RedHat Linux 5.2 sparc
   + RedHat Linux 5.2 i386
   + RedHat Linux 5.2 alpha
   + S.u.S.E. Linux 6.4ppc
   + S.u.S.E. Linux 6.4alpha
   + S.u.S.E. Linux 6.4
   + S.u.S.E. Linux 6.3 ppc
   + S.u.S.E. Linux 6.3 alpha
   + S.u.S.E. Linux 6.3
   + S.u.S.E. Linux 6.2
  + S.u.S.E. Linux 6.1 alpha
   + S.u.S.E. Linux 6.1
   + TurboLinux Turbo Linux 4.0
   + Wirex Immunix OS 6.2
  Washington University wu-ftpd 2.5.0
   + Caldera eDesktop 2.4
   + Caldera eServer 2.3.1
   + Caldera eServer 2.3
   + Caldera OpenLinux 2.4
   + Caldera OpenLinux Desktop 2.3
   + RedHat Linux 6.0 sparc
   + RedHat Linux 6.0 i386
   + RedHat Linux 6.0 alpha


Summary:

  Wu-Ftpd contains a remotely exploitable heap corruption bug.

Impact:

  A remote attacker may execute arbitrary code on the vulnerable server.

Technical Description:

  Wu-Ftpd is an ftp server based on the BSD ftpd that is maintained  by
  Washington University.

  Wu-Ftpd allows for clients to organize files for ftp actions  based  on
  "file globbing" patterns.  File globbing is also used by various
  shells.  The implementation of file globbing included in Wu-Ftpd
  contains a heap corruption vulnerability that may allow for an attacker
  to execute arbitrary code on a server remotely.

  During the processing of a globbing pattern, the Wu-Ftpd implementation
  creates a list of the files that match.  The memory where this data is
  stored is on the heap, allocated using malloc().  The globbing function
  simply returns a pointer to the list.   It is up to the calling
  functions to free the allocated memory.

  If an error occurs processing the pattern, memory will not be allocated
  and a variable indicating this should be set.  The calling functions
  must check the value of this variable before attempting to use the
  globbed filenames (and later freeing the memory).

  When certain globbing patterns are processed, the globbing function does
  not set this variable when an error occurs.  As a result of this,
  Wu-Ftpd may

Re: wu-ftpd exploit?

[Jerome Acks Jr]

Banshee wrote:


A little while ago when I was running wu-ftpd there was people from all
around the world connecting to my FTP (originaly it was only meant for a
few people I know from a small IRC server.)  So I changed the password
for the account and then they started to login as root.  That's when I
knew I had to remove wu-ftpd (well I wanted to remove it for a while but
since I was never hacked before that I didn't care about it being insecure)
  I recently got rid of wu-ftpd and got proftpd instead.  I was just
wondering if there is some sort of exploit with wu-ftpd that would let
them find the password for accounts or if it is maybe something else
they used to get my passwords.  It was the newest version of wu-ftpd I
have debian unstable and I apt-get upgrade alot.




Here is one root exploit:

http://www.debian.org/security/2000/2623

And Debian security lists a number of other security problems with 
various versions of wu-ftp.


You may want to subscribe to debian-security-announce mailing list to 
get security advisories.


--
Jerome

wu-ftpd exploit?

[Banshee]

A little while ago when I was running wu-ftpd there was people from all
around the world connecting to my FTP (originaly it was only meant for a
few people I know from a small IRC server.)  So I changed the password
for the account and then they started to login as root.  That's when I
knew I had to remove wu-ftpd (well I wanted to remove it for a while but
since I was never hacked before that I didn't care about it being insecure)
  I recently got rid of wu-ftpd and got proftpd instead.  I was just
wondering if there is some sort of exploit with wu-ftpd that would let
them find the password for accounts or if it is maybe something else
they used to get my passwords.  It was the newest version of wu-ftpd I
have debian unstable and I apt-get upgrade alot.
-- 

If you can't beat 'em, set the building on fire

Re: stopping wu-ftpd manually not working

[will trillich]

On Sat, Mar 31, 2001 at 04:07:54AM -0700, Jimmy Richards wrote:
> Hi Martin,
> 
> Ok. Thank you. I will use dpkg-inetd then if I keep using using wu-ftpd. I 
> will look at proftd.

is there a significant security advantage in replacing inetd with
xinetd? (i find xinetd easier to configure; also seems more
flexible in allowing services to be attached to specific
interfaces -- such as keeping telnet limited to intranet-only...)

xinetd vs inetd : pro's and con's?

-- 
does a brain cell think?

[EMAIL PROTECTED]
http://sourceforge.net/projects/newbiedoc -- we need your brain!
http://www.dontUthink.com/ -- your brain needs us!

Re: stopping wu-ftpd manually not working - i meant update-inetd

[Jimmy Richards]

Oh... i meantupdate-inetd...  sorry.

Re: stopping wu-ftpd manually not working

[Jimmy Richards]

Hi Martin,

Ok. Thank you. I will use dpkg-inetd then if I keep using using wu-ftpd. I 
will look at proftd.


Tanks for ebby ting,

Jimmy Richards


On Saturday 31 March 2001 02:45, Martin Würtele wrote:
> On Sat, Mar 31, 2001 at 02:30:37AM -0700, Jimmy Richards wrote:
> > Hello All,
> >
> > I installed wu-ftpd and said 'no' to setting it up right now. I could
> > then stop it manually with /etc/init.d/wu-ftpd stop. Starting also worked
> > fine. Later I wanted to set it up and couldn't find the script to run
> > that brings up the setup questions, and dpkg-reconfigure wu-ftpd didn't
> > work either. So I purged it, re-installed, and then went through the
> > setup. I am using a Linksys Cable/DSL router and had to put a line in
> > /etc/ftpaccess like this (in case it makes any difference)   passive
> > address 24.15.40.134   Now when I try to stop it with the above manual
> > command, nothing happens. Anyone got any ideas? Another interesting thing
> > is that my friend who was testing it for me couldn't get on to it with
> > 'leapftp' or MS Internet Explorer 5.5 until I put the 'passive address'
> > line in. But he could get on and download/upload stuff just fine with an
> > old version of CuteFTP... he said it was dated 1996. I found that to be
> > interesting.
>
> you have to install wu-ftp as standalone to stop and start it with
> /etc/init.d/wu-ftpd stop|start. otherwise it is started on connection by
> inetd (check /etc/inetd.conf).
>
> i think this is becaouse ie cannot connect in passive mode.
>
> btw if you have cable you may be connected to the internet permanently and
> therefore i recommand another ftp server (eg proftpd) due to security bugs
> in wu-ftp.
>
> yours martin

Re: stopping wu-ftpd manually not working

[Martin Würtele]

On Sat, Mar 31, 2001 at 02:30:37AM -0700, Jimmy Richards wrote:
> Hello All,
> 
> I installed wu-ftpd and said 'no' to setting it up right now. I could then 
> stop it manually with /etc/init.d/wu-ftpd stop. Starting also worked fine. 
> Later I wanted to set it up and couldn't find the script to run that brings 
> up the setup questions, and dpkg-reconfigure wu-ftpd didn't work either. So I 
> purged it, re-installed, and then went through the setup. I am using a 
> Linksys Cable/DSL router and had to put a line in /etc/ftpaccess like this 
> (in case it makes any difference)   passive address 24.15.40.134   Now when I 
> try to stop it with the above manual command, nothing happens. Anyone got any 
> ideas? Another interesting thing is that my friend who was testing it for me 
> couldn't get on to it with 'leapftp' or MS Internet Explorer 5.5 until I put 
> the 'passive address' line in. But he could get on and download/upload stuff 
> just fine with an old version of CuteFTP... he said it was dated 1996. I 
> found that to be interesting.

you have to install wu-ftp as standalone to stop and start it with
/etc/init.d/wu-ftpd stop|start. otherwise it is started on connection by
inetd (check /etc/inetd.conf).

i think this is becaouse ie cannot connect in passive mode.

btw if you have cable you may be connected to the internet permanently and
therefore i recommand another ftp server (eg proftpd) due to security bugs
in wu-ftp.

yours martin
-- 
 /"\  ASCII RIBBON  |  e-mail:   [EMAIL PROTECTED]   |   .''`.  |
 \ /  CAMPAIGN AGAINST  |  work: http://www.factline.com   |  : :' :  |
  X   HTML MAIL |  gpg-key:  30DC 1D28 1D79 32F5 5E67  |  `. `'   |
 / \  AND POSTINGS  |3ABB 28EE B35A 3E8D CCC0  |`-|

stopping wu-ftpd manually not working

[Jimmy Richards]

Hello All,

I installed wu-ftpd and said 'no' to setting it up right now. I could then 
stop it manually with /etc/init.d/wu-ftpd stop. Starting also worked fine. 
Later I wanted to set it up and couldn't find the script to run that brings 
up the setup questions, and dpkg-reconfigure wu-ftpd didn't work either. So I 
purged it, re-installed, and then went through the setup. I am using a 
Linksys Cable/DSL router and had to put a line in /etc/ftpaccess like this 
(in case it makes any difference)   passive address 24.15.40.134   Now when I 
try to stop it with the above manual command, nothing happens. Anyone got any 
ideas? Another interesting thing is that my friend who was testing it for me 
couldn't get on to it with 'leapftp' or MS Internet Explorer 5.5 until I put 
the 'passive address' line in. But he could get on and download/upload stuff 
just fine with an old version of CuteFTP... he said it was dated 1996. I 
found that to be interesting.


Thanks,

Jimmy Richards

re: wu-ftpd

[Arthur H. Johnson II]

Its very possible.  I have set it up on numerous occaisions for my company.  
Here is a howto.

-- Origional Message --
hey all, i'm setting up an ftp (wu-ftpd) server and i'm wondering if there is 
any way
to set the ftp users start dir? say i have a dir called /stuff, and i want 5
(or however many users) so when they login, their start dir is /stuff.. is
that possible to do? and if so, how?

thanks!!
-- 
@ugust

-- 
Arthur H. Johnson II
The Linux Box
http://www.linuxbox.nu
[EMAIL PROTECTED]
Installing Web, Email, and FTP Servers

Apache:

1.Install all the apache RPMS from your distributions CD-ROM
2.Configuration files reside in /etc/httpd/conf
1.Modification is usually not necessary for simple web services.
3.Web home is usually /home/httpd
1.CGI-Scripts go in /home/httpd/cgi-bin
2.Web pages go in /home/httpd/html
4.Limiting web access to certain users
1.put this file in directory you want to limit access to as .htaccess
AuthUserFile /etc/httpd/conf/passwd
AuthGroupFile /dev/null
AuthName "AbMyr Squid Reports"
AuthType Basic
require valid-user 
2.create password file with "htpasswd -c /etc/httpd/conf/passwd username"
1.After initial creation, leave off -c


Sendmail:

1.Most servers come with common reasonable configurations.
2.Any configuration is done through /etc/sendmail.mc
1.Example:
include(/usr/lib/sendmail-cf/m4/cf.m4)
VERSIONID(`sendmail.mc - [EMAIL PROTECTED]')
OSTYPE(linux)
define(`ALIAS_FILE',`/etc/mail/aliases')
MASQUERADE_AS(`usol.com')
FEATURE(masquerade_envelope)
FEATURE(genericstable, `hash -o /etc/mail/genericstable')
GENERICS_DOMAIN_FILE(`/etc/mail/genericsdomain')
define(`SMART_HOST',`mail.usol.com')
define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')
FEATURE(local_procmail)
FEATURE(`access_db')
MAILER(procmail)
MAILER(local)
MAILER(smtp)
2.Lines to note:
1.MASQUERADE_AS:  Is sometimes necessary to add this line to the configuration to tell sendmail what your hostname "really" is.  The newer sendmail has a ton of spam protections.  This is one.
2.Relaying.  Sendmail must be told what hosts can relay.
1.Worse comes to worse, you can turn sendmail completely non biased with this line in the MC file:  FEATURE(promiscuous_relay).  If your mail server is behind a firewall you can be assured this will do no harm.
2.If your configuration has an /etc/mail/access file, add your hosts to this file and run make from /etc/mail.  This will allow relaying.
3.To rebulid your Sendmail.mc file, run these commands:
1.m4 sendmail.mc > _sendmail.cf
2.mv -f _sendmail.cf sendmail.cf
3.Reload sendmail.  /etc/rc.d/init.d/sendmail restart
3.Further reading on Sendmail:
1.sendmail address rewriting mini-HOWTO from the Linux Doc Project
2.if your sendmail-doc rpm is installed:  /usr/doc/sendmail/README.cf
3.O'Reilly Sendmail book.  The difinative source.


Wu-FTPd

1.Normal FTP:  Install wu-ftpd and be happy.  Restart inetd.
2.For anonymous.  Install anonftp rpm.
3.For authenticated, but users denyed full access to file tree:
1.Create ftponly shell
	- add /bin/ftponly to /etc/shells
	- Create /bin/ftponly with the following lines:
		#!/bin/bash
		echo "This account is for FTP access only"
		exit
	- Make this file executeable:  chmod +x /bin/ftponly
2. Edit /etc/ftpaccess file
	- Disable anonftp in /etc/ftpaccess by changing the first line
	  which should read "class all real,guest,anonymous *" to
	  "class all real,guest *"
	- Enable users to delete files by changeing "delete no guest,anonymous"
	  to "delete yes all"
	- put guestuser * at the end of file
	- For real users on the system, put "realuser" followed by the
	  names of all the users allowed access outside the /home/ftp
	  tree.
	  	- ex. realuser brian joe richard
3. To add an FTP only user to the system:
	- Example:  adduser -M -s /bin/ftponly -d /home/ftp/./ username
		- "-M" means do not copy /etc/skel
			- Contains profile, desktop entries, etc.
			- Not needed for FTP users.
		- "-s /bin/ftponly" sets the shell
		- "-d /home/ftp/./" sets the initial direcory and root
			- the /./ signifies location of changed root
			- You may put a forced directory after /./
			- example:  You want all ford users to be
			  forced into /pub/ford, so you make the -d
			  /home/ftp/./pub/ford.
			- You may also make the root
			  /home/ftp/pub/ford/./ but you must copy the
			  bin, etc, and lib directories exactly as they
			  are into /home/ftp/pub/ford/ directory
	- Set the users password with "passwd username"
4. Create directories and adjust permissions to allow for read / write
access in FTP tree for users and groups using the FTP archive.
5. Edit /etc/hosts.allow to allow FTP connections
	- example: wu.ftpd: somehost : ALLOW
	- To allow for world access:  wu.ftpd: ALL : ALLOW

wu-ftpd

[August]

hey all, i'm setting up an ftp (wu-ftpd) server and i'm wondering if there is 
any way
to set the ftp users start dir? say i have a dir called /stuff, and i want 5
(or however many users) so when they login, their start dir is /stuff.. is
that possible to do? and if so, how?

thanks!!
-- 
@ugust

wu-ftpd

[Marc-Adrian Napoli]

hi all,

has anyone noticed that the default path-filter for wuftpd doesnt allow
question mark's in a file to be uploaded?

does anyone know why?

Regards,

Marc-Adrian Napoli
Network Admin
Connect Infobahn Australia
+61 2 9212 0387

WU-ftpd package broken

[Leonardo Dias]

It seems that the wu-ftpd packate is broken. It's not generating the
/etc/inetd.conf entry.


Because of problems I had to do the following:

1) Installation wu-ftpd ftp server
2) Removal of the wu-ftpd and installation of ftpd
3) Patched ftp.pl
4) Removal of ftpd and reinstallation of wu-ftpd

After the fourth item, dpkg didn't generate the wu-ftpd entry as
desired. It also didn't create all the files in the /etc/wu-ftpd dir.

What could possibly be wrong?
-- 
Leonardo Dias
Analista Programador / Analyst Programmer
Catho Online
http://www.catho.com.br

debianized wu-ftpd problems

[Leonardo Dias]

Has anyone faced this problem with WU-FTPD?

I have to websites which need to be just the same. Both of them are
running the debianized wu-ftpd. The directory that needs to be mirrored
is enormous, with lots and lots of files. 

The problem is that the secondary machine (the one which uses mirror)
stops the ls -lRat transfer in the middle of doing it. Nothing happens. 

I ran mirror with -d -d -d -d and it happened again. It stops in a
randomic file (it changes each time I run it), after approximately 30
seconds of reading the results. Then the mirror timeouts and no transfer
(of course) is done. 

The problem is surely with wu-ftpd. I changed to the normal ftpd debian
package and the mirror worked. 

I need the xferlog for auditing purposes. Since ftpd doesn't provide it,
what could I do?


-- 
Leonardo Dias
Analista Programador / Analyst Programmer
Catho Online
http://www.catho.com.br

wu-ftpd chroot environment

[Paulo Henrique Baptista de Oliveira]

Hi all Debian users,
I use proftp as a ftp server but now I have to maintain a wuftpd server
and want to know how to restring a client to a chroot dir (he can login into
ftp server but dont have to permit he to change to other dir another his home)
with wuftpd.
Anyone knows how to this?
Thanks, Paulo Henrique

Re: wu-ftpd (2000-06-23 security-fixed frozen version) constantly crashes

[Ralf G. R. Bergs]

On Wed, 28 Jun 2000 14:56:39 -0500, Lee Revell wrote:

>> my wu-ftpd is constantly crashing. :-(
[...]
>Use ProFTPD.  It has a MUCH better security record, is fast,

That's true, but it *also* has its security leaks.

>lightweight, and configuration is a breeze if you have ever configured
>Apache.  I made the switch several months ago and would never go back.

I'm already running a server with ProFTPD, so I know it already. ProFTPD 
surely has its advantages over WU-FTPD, but I don't consider them that 
important that I absolutely *have* to switch.

Anyway, I don't want to start a discussion on which is the best FTP server. 
It's just not my thing to evade problems as soon as I face them. Instead I'd 
like to cure them.

So, is there anyone who can help me stopping these crashes?

Thanks,

Ralf


-- 
Sign the EU petition against SPAM:  L I N U X   .~.
http://www.politik-digital.de/spam/The  Choice  /V\
of a  GNU  /( )\
   Generation  ^^-^^

Re: wu-ftpd (2000-06-23 security-fixed frozen version) constantly crashes

[Ethan Benson]

On Wed, Jun 28, 2000 at 02:56:39PM -0500, Lee Revell wrote:
> Use ProFTPD.  It has a MUCH better security record, is fast,

i don't know if i would go that far... it is much younger then
wu-root^H^H^H^Hftpd  but it has quite an abysmal record from when it
started.  it however has been ok lately (as in i don't recall seeing a
BugTraq post about it in a few monthes).  

Dan Jacobowitz scored Debian a PowerMac box by way of a Proftpd root
hole ;-)

i prefer OpenBSD's given its older and well audited. 

-- 
Ethan Benson
http://www.alaska.net/~erbenson/


pgpYtDGcXwgHl.pgp
Description: PGP signature

Re: wu-ftpd (2000-06-23 security-fixed frozen version) constantly crashes

[Lee Revell]

Use ProFTPD.  It has a MUCH better security record, is fast,
lightweight, and configuration is a breeze if you have ever configured
Apache.  I made the switch several months ago and would never go back.

"Ralf G. R. Bergs" wrote:
> 
> Hi there,
> 
> my wu-ftpd is constantly crashing. :-(
> 
> About half a dozen times per hour (sometimes even more often) I see lines in
> syslog like the following, which indicate crashed instances:
> 
> wu-ftpd[28359]: exiting on signal 11: Segmentation fault
> 
> Before I upgraded from stable to frozen my FTP daemon (wu-ftpd-academ then)
> was rock solid (I have FTP guests on my box 24 hours per day, from 10 users
> max to 25 max.) Now I have the above errors.
> 
> When I learnt about the recently published buffer-overflow bug in wu-ftpd, I
> thought this was the reason, so I immediately installed the fixed version
> (2.6.0-5.1.) But to no avail, the crashes still occur. :-(((
> 
> I'm running wu-ftpd from xinetd as follows:
> 
> service ftp
> {
> socket_type = stream
> protocol= tcp
> wait    = no
> user= root
> server  = /usr/sbin/wu-ftpd
> instances   = 30
> log_type= SYSLOG local6
> log_on_failure += HOST
> }
> 
> Any idea what's causing this? My system is completely "frozen" (i.e. Debian-
> version-like :-)
> 
> Thanks,
> 
> Ralf
>

wu-ftpd (2000-06-23 security-fixed frozen version) constantly crashes

[Ralf G. R. Bergs]

Hi there,

my wu-ftpd is constantly crashing. :-(

About half a dozen times per hour (sometimes even more often) I see lines in 
syslog like the following, which indicate crashed instances:

wu-ftpd[28359]: exiting on signal 11: Segmentation fault

Before I upgraded from stable to frozen my FTP daemon (wu-ftpd-academ then) 
was rock solid (I have FTP guests on my box 24 hours per day, from 10 users 
max to 25 max.) Now I have the above errors.

When I learnt about the recently published buffer-overflow bug in wu-ftpd, I 
thought this was the reason, so I immediately installed the fixed version 
(2.6.0-5.1.) But to no avail, the crashes still occur. :-(((

I'm running wu-ftpd from xinetd as follows:

service ftp
{
socket_type = stream
protocol= tcp
wait= no
user= root
server  = /usr/sbin/wu-ftpd
instances   = 30
log_type= SYSLOG local6
log_on_failure += HOST
}


Any idea what's causing this? My system is completely "frozen" (i.e. Debian-
version-like :-)

Thanks,

Ralf


-- 
Sign the EU petition against SPAM:  L I N U X   .~.
http://www.politik-digital.de/spam/The  Choice  /V\
of a  GNU  /( )\
   Generation  ^^-^^

WU-FTPD and passive ftp

[Richard A Nelson]

Has anyone run wu-ftpd Version wu-2.6.0(1) Wed Mar 15 16:30:52 CET 2000
with passive ftp support?

ftp> ls wtf 
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
-rw-r--r--1 cowboy   cowboy   9269 Nov 18 17:15 wtf
226 Transfer complete.
ftp> passive
Passive mode on.
ftp> ls wtf
227 Entering Passive Mode (9,51,81,11,180,209)
421 Service not available, remote server has closed connection

I get no indications of anything wrong in the syslog...

I know its trying passive, because if I use a host that isn't in
pasv-allow, I get this:
ftp> passive
Passive mode on.
ftp> ls wtf
227 Entering Passive Mode (9,51,81,11,99,62)
ftp: connect: Connection refused

The relevant portions of ftpaccess are:
passive address 9.51.81.11 0.0.0.0/0# this *IS* required for passive
passive ports 0.0.0.0/0 1024 65535  # to see if it made a difference
pasv-allow all *.ibm.com# localhost fails this test
port-allow all *.ibm.com# Is this needed wrt passive?
-- 
Rick Nelson
Life'll kill ya -- Warren Zevon 
Then you'll be dead -- Life'll kill ya

wu-ftpd. Takes 2 mins to log in.

[Jens K. Olsen]

After updating my ftp server about a month ago, it suddenly take 2 mins.
for anyone to log in. After typing 

$ftp my.ftpserver.com

i get the message

Connected to my.ftpserver.com

immediately, but it takes 2 minutes before the username prompt comes.

I am running the Debian frozen and I am updating once a week. I haven't
changed anything in the configuration files, because I don't know what
to change, and there has been no network/firewall, etc. changes
recently.

I checked the wu-ftpd faq and mailing list archives and I get the
impression that something in wu-ftpd was changed recently relating to
IDENT RCF931.

Can anyone help me please. I am getting tired of waiting 2 mins. for the
username prompt.

Thanks

Linear RAID CRC errors (was wu-ftpd fails)

[Alex McCool]

Does anyone have any experience with
aic7xxx and linear raid
oh
and throw in wu-ftpd.
 
Since this is a contination of another thread:
Background.
When uploading a file using wu-ftpd to a RAID linear directory 
mount I get CRC errors in the file.
Uploading to a normal ext2 mount the upload works 
great.

Re: wu-ftpd fails CRC checks

[David Wright]

Quoting Alex McCool ([EMAIL PROTECTED]):
> 
> Doing md5sum results:
> This is the client, I know this files is good
> /home/amccool$ md5sum winamp25e_full.exe 
> 1a8cc2cddc56fbffef748cb83903913d  winamp25e_full.exe
> 
> This is the suscpect FTP server
> /home/amccool$ md5sum winamp25e_full.exe 
> 057748fecb0b918eda5dc3df0ebf4a1d  winamp25e_full.exe
> 
> VERY different sums
> 
> Any thoughts?

One of bit difference will give a completely different md5.
That's an essential property they have.

Cheers,

-- 
Email:  [EMAIL PROTECTED]   Tel: +44 1908 653 739  Fax: +44 1908 655 151
Snail:  David Wright, Earth Science Dept., Milton Keynes, England, MK7 6AA
Disclaimer:   These addresses are only for reaching me, and do not signify
official stationery. Views expressed here are either my own or plagiarised.

Re: wu-ftpd fails CRC checks

[Alex McCool]

>thats very odd, but yeah it can't hurt.  what kernel and what version of
>the raid utils ?
>
>i running 2 mirrored disks in 2 different systems on
>2.0.36+securelinux...no probs so far.  is this a new server? or is it just
>a new problem?
>
>nate

running frozen potato 2.2.14 - had this problem on slink(stable) 2.2.1
(linear /home and wu-ftpd-academ)

ii  wu-ftpd2.6.0-3powerful and widely used FTP server
ii  raidtools  0.42-21Utilities to support 'old-style' RAID
disks
pn  raidtools2  (no description available)

Re: wu-ftpd fails CRC checks

[aphro]

On Thu, 24 Feb 2000, Alex McCool wrote:

debian >AAARRRGGG...
debian >I tried "putting" the file on a regular e2fs parition and 
SUCCCESS!
debian >
debian >Linear is broken apprently when using FTP server to it. should I 
file a
debian >bug report?

thats very odd, but yeah it can't hurt.  what kernel and what version of
the raid utils ?

i running 2 mirrored disks in 2 different systems on
2.0.36+securelinux...no probs so far.  is this a new server? or is it just
a new problem?

nate

[mailto:[EMAIL PROTECTED] ]--
   Vice President Network Operations   http://www.firetrail.com/
  Firetrail Internet Services Limited  http://www.aphroland.org/
   Everett, WA 425-348-7336http://www.linuxpowered.net/
Powered By:http://comedy.aphroland.org/
Debian 2.1 Linux 2.0.36 SMPhttp://yahoo.aphroland.org/
-[mailto:[EMAIL PROTECTED] ]--
3:56pm up 189 days, 4:17, 1 user, load average: 1.02, 1.03, 1.00

Re: wu-ftpd fails CRC checks

[Alex McCool]

>
>yes thats right.  try doing a md5sum on one drive then copying it to
>another not on the raid if possible(or even to a floppy winamp should fit
>i think) and run another md5sum
>
>nate

On the server  I copied a file from plain e2fs to the linear mount and the
two files matched.

bishop:/# cp usr/share/man/man1/ftpwho.1.gz/home/amccool/
bishop:/# md5sum usr/share/man/man1/ftpwho.1.gz
f552ae6fcd517ac9ade3f73110705a50  usr/share/man/man1/ftpwho.1.gz
bishop:/# md5sum /home/amccool/ftpwho.1.gz
f552ae6fcd517ac9ade3f73110705a50  /home/amccool/ftpwho.1.gz

Before we get even farther..server stats
Debian GNU/Linux 2.2 (frozen) ftp.cadscape.com
Linux bishop 2.2.14 #8 Thu Feb 10 15:27:20 PST 2000 i586 unknown
ii  wu-ftpd  2.6.0-3  powerful and widely used FTP
server

AAARRRGGG...
I tried "putting" the file on a regular e2fs parition and SUCCCESS!

Linear is broken apprently when using FTP server to it. should I file a
bug report?

Re: wu-ftpd fails CRC checks

[aphro]

On Thu, 24 Feb 2000, Alex McCool wrote:

debian >Yes I am transfering using binary.
debian >I am beginning to wonder about my linear RAID setup.
debian >Secondly I am NOT familar with the use of md5sum, is there something 
special
debian >I need to do for checking?
debian >
debian >client:md5sum  xx.zip
debian >server:  md5sum  xx.zip   <== should equal to the client sum, 
right??

yes thats right.  try doing a md5sum on one drive then copying it to
another not on the raid if possible(or even to a floppy winamp should fit
i think) and run another md5sum

nate

[mailto:[EMAIL PROTECTED] ]--
   Vice President Network Operations   http://www.firetrail.com/
  Firetrail Internet Services Limited  http://www.aphroland.org/
   Everett, WA 425-348-7336http://www.linuxpowered.net/
Powered By:http://comedy.aphroland.org/
Debian 2.1 Linux 2.0.36 SMPhttp://yahoo.aphroland.org/
-[mailto:[EMAIL PROTECTED] ]--
3:26pm up 189 days, 3:47, 2 users, load average: 1.02, 1.04, 1.00

Re: wu-ftpd fails CRC checks

[Alex McCool]

>On Thu, 24 Feb 2000, Alex McCool wrote:
>
>debian >Doing md5sum results:
>debian >This is the client, I know this files is good
>debian >/home/amccool$ md5sum winamp25e_full.exe
>debian >1a8cc2cddc56fbffef748cb83903913d  winamp25e_full.exe
>debian >
>debian >This is the suscpect FTP server
>debian >/home/amccool$ md5sum winamp25e_full.exe
>debian >057748fecb0b918eda5dc3df0ebf4a1d  winamp25e_full.exe
>debian >
>debian >VERY different sums
>debian >
>debian >Any thoughts?
>
>this is a stupid question but i gotta ask, are you trasnferring the
>file(s) in binary mode? not ascii mode right.
>
>nate


Yes I am transfering using binary.
I am beginning to wonder about my linear RAID setup.
Secondly I am NOT familar with the use of md5sum, is there something special
I need to do for checking?

client:md5sum  xx.zip
server:  md5sum  xx.zip   <== should equal to the client sum, right??

Re: wu-ftpd fails CRC checks

[aphro]

On Thu, 24 Feb 2000, Alex McCool wrote:

debian >Doing md5sum results:
debian >This is the client, I know this files is good
debian >/home/amccool$ md5sum winamp25e_full.exe 
debian >1a8cc2cddc56fbffef748cb83903913d  winamp25e_full.exe
debian >
debian >This is the suscpect FTP server
debian >/home/amccool$ md5sum winamp25e_full.exe 
debian >057748fecb0b918eda5dc3df0ebf4a1d  winamp25e_full.exe
debian >
debian >VERY different sums
debian >
debian >Any thoughts?

this is a stupid question but i gotta ask, are you trasnferring the
file(s) in binary mode? not ascii mode right.

nate
[mailto:[EMAIL PROTECTED] ]--
   Vice President Network Operations   http://www.firetrail.com/
  Firetrail Internet Services Limited  http://www.aphroland.org/
   Everett, WA 425-348-7336http://www.linuxpowered.net/
Powered By:http://comedy.aphroland.org/
Debian 2.1 Linux 2.0.36 SMPhttp://yahoo.aphroland.org/
-[mailto:[EMAIL PROTECTED] ]--
2:19pm up 189 days, 2:40, 2 users, load average: 1.06, 1.04, 1.04

Re: wu-ftpd fails CRC checks

[Alex McCool]

>
>looks like the drive is having problems, i dont think the ftpd would(or
>could) cause such errors, try moving the file to another disk and
>transferring again.  run md5sum on the local file then run it again after
>the remote site downloads it and compare the 2.
>
>if they are the same then the original file is curropted.
>


Ok I removed the suspect drive
was:
scsi0 /
scsi1 /usr   <=== suspect drive
scsi2-3   linear/home

now   moved all scsi1 into scsi0 /usr
scsi0 /
scsi2-3 linear home

Doing md5sum results:
This is the client, I know this files is good
/home/amccool$ md5sum winamp25e_full.exe 
1a8cc2cddc56fbffef748cb83903913d  winamp25e_full.exe

This is the suscpect FTP server
/home/amccool$ md5sum winamp25e_full.exe 
057748fecb0b918eda5dc3df0ebf4a1d  winamp25e_full.exe

VERY different sums

Any thoughts?

Re: wu-ftpd fails CRC checks

[aphro]

On Thu, 24 Feb 2000, Alex McCool wrote:

debian >One more thing... I am getting these in the message log.lots of 
these (that scsi id is the /usr mount)
debian >
debian >Feb 24 06:27:38 bishop kernel: scsidisk I/O error: dev 08:11, sector 
591714
debian >Feb 24 06:27:39 bishop kernel: scsi0: MEDIUM ERROR on channel 0, id 1, 
lun 0, CDB: Read (6) 09 07 82 02 00
debian >Feb 24 06:27:39 bishop kernel: Info fld=0x90782, Current sd08:11: sense 
key Medium Error
debian >

looks like the drive is having problems, i dont think the ftpd would(or
could) cause such errors, try moving the file to another disk and
transferring again.  run md5sum on the local file then run it again after
the remote site downloads it and compare the 2.

if they are the same then the original file is curropted.

nate

[mailto:[EMAIL PROTECTED] ]--
   Vice President Network Operations   http://www.firetrail.com/
  Firetrail Internet Services Limited  http://www.aphroland.org/
   Everett, WA 425-348-7336http://www.linuxpowered.net/
Powered By:http://comedy.aphroland.org/
Debian 2.1 Linux 2.0.36 SMPhttp://yahoo.aphroland.org/
-[mailto:[EMAIL PROTECTED] ]--
12:37pm up 189 days, 57 min, 1 user, load average: 1.18, 1.10, 1.03

SCSI HD developping bad blocks (was Re: wu-ftpd fails CRC checks

[Ralf G. R. Bergs]

On Thu, 24 Feb 2000 10:51:08 -0800, Alex McCool wrote:

>I've noticed that the sector=591714 (and one other) is always the culprit.
>Can someone tell me how to repair/badblock these sectors?

Back it up, then low-level format it.

BUT BEWARE: Usually bad sector remapping works transparently w/o the user 
noticing it. The fact that there are bad sectors visible to the user usually 
means the HD is dying, so prepare for the worst.

Sorry, but this is the truth.


-- 
Sign the EU petition against SPAM:  L I N U X   .~.
http://www.politik-digital.de/spam/The  Choice  /V\
of a  GNU  /( )\
   Generation  ^^-^^

Re: wu-ftpd fails CRC checks

[Alex McCool]

>>
>>Feb 24 06:27:38 bishop kernel: scsidisk I/O error: dev 08:11, sector =
>>591714
>>Feb 24 06:27:39 bishop kernel: scsi0: MEDIUM ERROR on channel 0, id 1, =
>>lun 0, CDB: Read (6) 09 07 82 02 00
>>Feb 24 06:27:39 bishop kernel: Info fld=3D0x90782, Current sd08:11: =
>>sense key Medium Error
>
>You're having a *SCSI* problem, possibly incorrect termination, or simply a
>bad hard drive, cable, or host-adapter. What yoU're seeing is most
definitely
>NOT a problem w/ wu-ftpd.
>

thanks Ralf -

I've noticed that the sector=591714 (and one other) is always the culprit.
Can someone tell me how to repair/badblock these sectors?

Thanks,

Re: wu-ftpd fails CRC checks

[Ralf G. R. Bergs]

On Thu, 24 Feb 2000 09:24:08 -0800, Alex McCool wrote:

>I'm having a problem with wu-ftpd.  On large transfers ( > 24 megs ) I =
>keep getting CRC errors.
[...]
>One more thing... I am getting these in the message log.lots of =
>these (that scsi id is the /usr mount)
>
>Feb 24 06:27:38 bishop kernel: scsidisk I/O error: dev 08:11, sector =
>591714
>Feb 24 06:27:39 bishop kernel: scsi0: MEDIUM ERROR on channel 0, id 1, =
>lun 0, CDB: Read (6) 09 07 82 02 00
>Feb 24 06:27:39 bishop kernel: Info fld=3D0x90782, Current sd08:11: =
>sense key Medium Error

You're having a *SCSI* problem, possibly incorrect termination, or simply a 
bad hard drive, cable, or host-adapter. What yoU're seeing is most definitely 
NOT a problem w/ wu-ftpd.

-- 
Sign the EU petition against SPAM:  L I N U X   .~.
http://www.politik-digital.de/spam/The  Choice  /V\
of a  GNU  /( )\
   Generation  ^^-^^

wu-ftpd fails CRC checks

[Alex McCool]

Hi all,
 
I'm having a problem with wu-ftpd.  On large transfers ( 
> 24 megs ) I keep getting CRC errors.  This occurs on zip files, 
tgz's.  I cant tell if any ascii files are getting damaged.
 
I originally had this problem on slink using wu-ftpd-academ 
and a 2.2.1 kernel.  I thought it had to do with the kernel version.  
S I upgraded to potato(frozen), and moved to wu-ftpd from 
wu-ftpd-academ.
 
One more thing... I am getting these in the message 
log.lots of these (that scsi id is the /usr mount)
 
Feb 24 06:27:38 bishop kernel: scsidisk I/O error: dev 08:11, 
sector 591714Feb 24 06:27:39 bishop kernel: scsi0: MEDIUM ERROR on channel 
0, id 1, lun 0, CDB: Read (6) 09 07 82 02 00Feb 24 06:27:39 bishop kernel: 
Info fld=0x90782, Current sd08:11: sense key Medium Error
 
Sorry to be a pain
Alex

Re: Advice on wu-ftpd security needed (URGENT)

[oneiros]

Thus spake Robert J. Alexander ([EMAIL PROTECTED]):

> I am running a Debian 2.1 dist.
> 
> I was sent the following (appended) quite recent (a month old) CERT
> advisory.
> 
> How do I understand which Debian packaging has closed these holes ????
> 

The latest wu-ftpd (2.6.0-2) in potato closes these issues.  In fact, all of
the 2.5.0 finals should be fine as well.  The advisory lists 2.5.0 wu-ftpd's
as not vulnerable.  I was able to test and confirm this.  I haven't tested
those recent issues on the pre's though, since I didn't have any pre versions
installed on any of my servers at the time.

If you're running < 2.5.0pre* it would be best to update.  It would be best to
update to the current version regardless.  There are a number of bugfixes
closed in 2.6.0 that will probably prevent additional exploits from popping
up, that have not yet been discovered.

> BTW Is there a way to automate the PUT of files in the incoming area so
> that every time one is performed root gets a mail with the filename
> filesize and originator ??? 

You can write a little program that runs from cron every so often to do this.
If not, there is some perl code called ftpcheck that does this.  I haven't
tried it out, but it looks good.  You can pick it up at
ftp://ftp.cle.ab.com/pub/ftpcheck.v2.3

-- 
,  oneiros ([EMAIL PROTECTED])  |  . OpenPGP Supported .  '
Your good nature will bring unbounded happiness.

Advice on wu-ftpd security needed (URGENT)

[Robert J. Alexander]

I am running a Debian 2.1 dist.

I was sent the following (appended) quite recent (a month old) CERT
advisory.

How do I understand which Debian packaging has closed these holes 

BTW Is there a way to automate the PUT of files in the incoming area so
that every time one is performed root gets a mail with the filename
filesize and originator ??? 

Thank you very much in advance. Bob Alexander
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

CERT Advisory CA-99-13 Multiple Vulnerabilities in WU-FTPD

   Original release date: October 19, 1999
   Last revised: --
   Source: CERT/CC

   A complete revision history is at the end of this file.

Systems Affected

 * Systems running the WU-FTPD daemon or its derivatives

I. Description

   Three vulnerabilities have been identified in WU-FTPD and other ftp
   daemons based on the WU-FTPD source code. WU-FTPD is a common package
   used to provide File Transfer Protocol (FTP) services. Incidents
   involving at least the first of these vulnerabilities have been
   reported to the CERT Coordination Center.

Vulnerability #1: MAPPING_CHDIR Buffer Overflow

   Because of improper bounds checking, it is possible for an intruder
to
   overwrite static memory in certain configurations of the WU-FTPD
   daemon. The overflow occurs in the MAPPING_CHDIR portion of the
source
   code and is caused by creating directories with carefully chosen
   names. As a result, FTP daemons compiled without the MAPPING_CHDIR
   option are not vulnerable.

   This is the same vulnerability described in AUSCERT Advisory
   AA-1999.01, which is available from

  
ftp://www.auscert.org.au/security/advisory/AA-1999.01.wu-ftpd.mapping_
  chdir.vul

   This is not the same vulnerability as the one described in CA-99-03
   "FTP Buffer Overflows", even though it is closely related. Systems
   that have patches to correct the issue described in CA-99-03 may
still
   be vulnerable to this problem.

Vulnerability #2: Message File Buffer Overflow

   Because of improper bounds checking during the expansion of macro
   variables in the message file, intruders may be able to overwrite the
   stack of the FTP daemon.

   This is one of the vulnerabilities described in AUSCERT Advisory
   AA-1999.02, which is available from

  
ftp://www.auscert.org.au/security/advisory/AA-1999.02.multi.wu-ftpd.vu
  ls

Vulnerability #3: SITE NEWER Consumes Memory

   The SITE NEWER command is a feature specific to WUFTPD designed to
   allow mirroring software to identify all files newer than a supplied
   date. This command fails to free memory under some circumstances.

II. Impact

Vulnerability #1: MAPPING_CHDIR Buffer Overflow

   Remote and local intruders may be able exploit this vulnerability to
   execute arbitrary code as the user running the ftpd daemon, usually
   root.

   To exploit this vulnerability, the intruder must be able to create
   directories on the vulnerable systems that are accessible via FTP.
   While remote intruders are likely to have this privilege only through
   anonymous FTP access, local users may be able to create the required
   directories in their own home directories.

Vulnerability #2: Message File Buffer Overflow

   Remote and local intruders may be able exploit this vulnerability to
   execute arbitrary code as the user running the ftpd daemon, usually
   root.

   If intruders are able to control the contents of a message file, they
   can successfully exploit this vulnerability. This access is
frequently
   available to local users in their home directories, but it may be
   restricted in anonymous FTP access, depending on your configuration.

   Additionally, under some circumstances, remote intruders may be able
   to take advantage of message files containing macros provided by the
   FTP administrator.

Vulnerability #3: SITE NEWER Consumes Memory

   Remote and local intruders who can connect to the FTP server can
cause
   the server to consume excessive amounts of memory, preventing normal
   system operation. If intruders can create files on the system, they
   may be able exploit this vulnerability to execute arbitrary code as
   the user running the ftpd daemon, usually root.

III. Solution

Install appropriate patches from your vendor

   These vulnerabilities can be eliminated by applying appropriate
   patches from your vendor. We encourage you to apply a patch as soon
as
   possible and to disable vulnerable programs until you can do so.

   Disabling the WU-FTPD daemon may prevent your system from operating
   normally. Upgrading to WU-FTPD 2.6.0 may cause some inter-operability
   problems with certain FTP clients. We encourage you to review the
   WU-FTPD documentation carefully before performing this upgrade.

   Appendix A contains information provided by vendors for this
advisory.
   We will update the appendix as we receive more information. If you do
   not see your vendor's name, the CERT/CC did not hear from that
ve

Re: wu-ftpd vs proftpd vs ftpd

[aphro]

id avoid proftpd until they re write the thing, too many bugs in it's
core, unless security isn't a main concern.  wuftpd has similar problems
but most of them have been fixed and i've seen no reports of flawed code
like proftpd has.  i use normal ftpd (port from openBSD) i think i use
v20 (compiled from source) not very customizable commpared to the
competition but i want a ftpd i can run and forget about, and this is
it.(anonymous works)

nate

[mailto:[EMAIL PROTECTED] ]--
  Linux System Administrator   http://www.firetrail.com/
  Firetrail Internet Services Limited  http://www.aphroland.org/
   Everett, WA 425-348-7336http://www.linuxpowered.net/
Powered By:http://comedy.aphroland.org/
Debian 2.1 Linux 2.0.36 SMPhttp://yahoo.aphroland.org/
-[mailto:[EMAIL PROTECTED] ]--

On 12 Oct 1999, Ron Farrer wrote:

> Hello all,
> 
> I'm trying to decide which ftp server to install. Typing "apt-get install
> ftp" listed:
> 
> wu-ftpd 2.5.0-4
> proftpd 1.2.0pre7-3
> ftpd 0.11-4
> 
> Which one of them is better? I don't want something that is going to puke
> on large files. Something that has lots of features to play with would be
> nice. User and anonymous ftp access is required.
> 
> 
> 
> TIA,
> 
> Ron
> -- 
> =
> = Ronald Burnett Farrer =
> =
> 
> - "mailto:[EMAIL PROTECTED]"   -
> - "http://www.magnesium.net/~rbf/"; -
> 
> !!
> ! If you let Windows dominate, expect the worst: !
> ! "WORLD.SYS is corrupt, reboot UNIVERSE Y/n"!
> !!
> ???
> ? "How could this [Y2K Bug] be a problem in a country ?
> ? where we have Intel and Microsoft?" -- Al Gore  ?
> ???
> 
> 
> -- 
> Unsubscribe?  mail -s unsubscribe [EMAIL PROTECTED] < /dev/null
> 

Re: wu-ftpd vs proftpd vs ftpd

[David Coe]

Ron Farrer <[EMAIL PROTECTED]> writes:

> wu-ftpd 2.5.0-4
> proftpd 1.2.0pre7-3
> ftpd 0.11-4
> 
> Which one of them is better? I don't want something that is going to puke
> on large files. Something that has lots of features to play with would be
> nice. User and anonymous ftp access is required.

This has been a point of contention for many months; I don't think
anyone can answer you question fully for you -- search the debian
mailing lists, or search Usenet (e.g. at deja.com) if you want to read
all the various pros and cons. 

My personal advice is don't use (any of the) wu-ftpd or proftpd
versions unless you actaully need to do virtual hosting (support
different ftp archives at different internet host addresses on the
same machine).  The simple ftpd is likely a lot more secure, and
definitely a lot less complex.  They all allow you to provide user and
anonymous ftp access.

wu-ftpd vs proftpd vs ftpd

[Ron Farrer]

Hello all,

I'm trying to decide which ftp server to install. Typing "apt-get install
ftp" listed:

wu-ftpd 2.5.0-4
proftpd 1.2.0pre7-3
ftpd 0.11-4

Which one of them is better? I don't want something that is going to puke
on large files. Something that has lots of features to play with would be
nice. User and anonymous ftp access is required.



TIA,

Ron
-- 
=
= Ronald Burnett Farrer =
=

- "mailto:[EMAIL PROTECTED]"   -
- "http://www.magnesium.net/~rbf/"; -

!!
! If you let Windows dominate, expect the worst: !
! "WORLD.SYS is corrupt, reboot UNIVERSE Y/n"!
!!
???
? "How could this [Y2K Bug] be a problem in a country ?
? where we have Intel and Microsoft?" -- Al Gore  ?
???

Re: proftpd vs wu-ftpd

[Martin Bialasinski]

* "Ali" == Ali Onur UYAR <[EMAIL PROTECTED]> wrote:

Ali> I am planning to enable anonymous ftp to my linux box.  I am
Ali> aware of two alternatives: proftpd and wu-ftpd.  Any advantages
Ali> of one over another?

proftpd is actively maintained by the author, and is easier to
configure IMHO.

Ciao,
Martin

proftpd vs wu-ftpd

[Ali Onur UYAR]

I am planning to enable anonymous ftp to my linux box.
I am aware of two alternatives: proftpd and wu-ftpd.
Any advantages of one over another?

TIA

Re: wu-ftpd-2.4.2.16-12 security problem

[Shao Zhang]

Hi,
thx for you reply. but it does not work for me.

here is what I have:
in /etc/passwd:
shao:x:1000:1000:Shao Zhang,,,:/home/shao/./:/bin/bash

in /etc/group:
floppy:x:25:shao

in /etc/wu-ftpd-academ/ftpaccess:
guestgroup floppy

After the user logs in, the use cannot see their home dir at all.

pwd returns the current dir is /.

Thanks.
Shao.


In-Reply-To: <[EMAIL PROTECTED]>; from Chad A. Adlawan on Tue, May 18, 1999 at 
11:41:38AM +0800

On Tue, May 18, 1999 at 11:41:38AM +0800, Chad A. Adlawan wrote:
>   thats not a security problem.  its how its supposed to behave.
>   if u dont want users chrooted to /home/username, that is, they can only go
> to as high as /home/username, read on re giving users "guestgroup" access in
> wu-ftpd docs, and then change their respective enreies in /etc/passwd so that
> when theyll log in to ftp, they'll be chrooted to /home/username ...
>   example, for /etc/passwd:
>   user:x:1023:1100:user,,,:/home/user/./:/usr/bin/ascriptiwrote
>^
>this is his chrooted dir
>   also, try reading man chroot
> AFAIK,
> Chad
> 
> 
> On Tue, May 18, 1999 at 01:00:15PM +, Shao Zhang wrote:
> > Hi,
> > I just found that this version of the wu-ftpd allows any user do a cd /
> > And then all users can see the / directory on the system.
> > 
> > How do I stop this? I only want them to see /home/username.
> > 
> > Thanks.
> > 
> > 
> > Shao.
> > 
> > -- 
> > 
> > Shao Zhang - Running Debian 2.1  ___ _   _
> > Department of Communications/ __| |_  __ _ ___  |_  / |_  __ _ _ _  __ 
> > _ 
> > University of New South Wales   \__ \ ' \/ _` / _ \  / /| ' \/ _` | ' \/ _` 
> > |
> > Sydney, Australia   |___/_||_\__,_\___/ /___|_||_\__,_|_||_\__, 
> > |
> > Email: [EMAIL PROTECTED]  
> > |___/ 
> > _
> > 
> > 
> > -- 
> > Unsubscribe?  mail -s unsubscribe [EMAIL PROTECTED] < /dev/null
> > 
> 

-- 

Shao Zhang - Running Debian 2.1  ___ _   _
Department of Communications/ __| |_  __ _ ___  |_  / |_  __ _ _ _  __ _ 
University of New South Wales   \__ \ ' \/ _` / _ \  / /| ' \/ _` | ' \/ _` |
Sydney, Australia   |___/_||_\__,_\___/ /___|_||_\__,_|_||_\__, |
Email: [EMAIL PROTECTED]  |___/ 
_

Re: wu-ftpd-2.4.2.16-12 security problem

[Chad A. Adlawan]

  thats not a security problem.  its how its supposed to behave.
  if u dont want users chrooted to /home/username, that is, they can only go
to as high as /home/username, read on re giving users "guestgroup" access in
wu-ftpd docs, and then change their respective enreies in /etc/passwd so that
when theyll log in to ftp, they'll be chrooted to /home/username ...
  example, for /etc/passwd:
  user:x:1023:1100:user,,,:/home/user/./:/usr/bin/ascriptiwrote
   ^
   this is his chrooted dir
  also, try reading man chroot
AFAIK,
Chad


On Tue, May 18, 1999 at 01:00:15PM +, Shao Zhang wrote:
> Hi,
>   I just found that this version of the wu-ftpd allows any user do a cd /
>   And then all users can see the / directory on the system.
> 
>   How do I stop this? I only want them to see /home/username.
> 
>   Thanks.
> 
> 
> Shao.
> 
> -- 
> 
> Shao Zhang - Running Debian 2.1  ___ _   _
> Department of Communications/ __| |_  __ _ ___  |_  / |_  __ _ _ _  __ _ 
> University of New South Wales   \__ \ ' \/ _` / _ \  / /| ' \/ _` | ' \/ _` |
> Sydney, Australia   |___/_||_\__,_\___/ /___|_||_\__,_|_||_\__, |
> Email: [EMAIL PROTECTED]  
> |___/ 
> _
> 
> 
> -- 
> Unsubscribe?  mail -s unsubscribe [EMAIL PROTECTED] < /dev/null
> 

wu-ftpd-2.4.2.16-12 security problem

[Shao Zhang]

Hi,
I just found that this version of the wu-ftpd allows any user do a cd /
And then all users can see the / directory on the system.

How do I stop this? I only want them to see /home/username.

Thanks.


Shao.

-- 

Shao Zhang - Running Debian 2.1  ___ _   _
Department of Communications/ __| |_  __ _ ___  |_  / |_  __ _ _ _  __ _ 
University of New South Wales   \__ \ ' \/ _` / _ \  / /| ' \/ _` | ' \/ _` |
Sydney, Australia   |___/_||_\__,_\___/ /___|_||_\__,_|_||_\__, |
Email: [EMAIL PROTECTED]  |___/ 
_

Re: wu-ftpd-academ

[Jens Ritter]

"Daniel J. Brosemer" <[EMAIL PROTECTED]> writes:

> The Debian Weekly News had an announcement that fixes are already out for
> wu-ftpd-academ but are in /incoming.  I seem to remember something about
> that being accessable only to developers.  Is there a place where we can
> get at it?

Netgod makes them available on his site:

PROFTPD:

i386:
   wget http://netgod.net/debian/security/proftpd_1.2.0pre1-2_i386.deb
   dpkg --install proftpd_1.2.0pre1-2_i386.deb

m68k:
   wget http://netgod.net/debian/security/proftpd_1.2.0pre1-2_m68k.deb
   dpkg --install proftpd_1.2.0pre1-2_m68k.deb

WU-FTPD:

i386:
   wget http://netgod.net/debian/security/wu-ftpd-academ_2.4.2.16-12.2_i386.deb
   dpkg --install wu-ftpd-academ_2.4.2.16-12.2_i386.deb

(from Johnie Ingram earlier post, which was pgp signed, so please look
at his message titled: Debian FTP Security Update)

HTH,

Jens
---
[EMAIL PROTECTED]   [EMAIL PROTECTED]
Key ID: 2048/E451C639 Jens Ritter
Key fingerprint: 5F 3D 43 1E 24 1E CC 48  1E 05 93 3A A7 10 73 37 

Re: wu-ftpd-academ

[Brandon Mitchell]

On Tue, 9 Feb 1999, Daniel J. Brosemer wrote:

> The Debian Weekly News had an announcement that fixes are already out for
> wu-ftpd-academ but are in /incoming.  I seem to remember something about
> that being accessable only to developers.  Is there a place where we can
> get at it?

There is a list of incoming mirrors in the developers corner (on the web
site).  My personal favorite is llug.sep.bnl.gov.

Brandon

+------+
| Brandon Mitchell  [EMAIL PROTECTED]  http://bmitch.nws.net/  ICQ 30631197 |
| Throughout history, UNIX systems have regulary been broken into, beaten, |
| brutalized, corrupted, commandeered, compromised, and illegally fscked.  |
|   -- UNIX System Administration Handbook |

wu-ftpd-academ

[Daniel J. Brosemer]

The Debian Weekly News had an announcement that fixes are already out for
wu-ftpd-academ but are in /incoming.  I seem to remember something about
that being accessable only to developers.  Is there a place where we can
get at it?

-Dan

cat & more in anon wu-ftpd

[Bob Bernstein]

I have begun to set up anonymous ftp on one of my boxes. Actually it is set up
and working, but when I try to add commands other than 'ls' to /home/ftp/bin
all I get (issuing these commands) when logged in as anonymous is '?Invalid
command.'

The permissions are the same as for 'ls' and I've placed in /home/ftp/lib all
the libs indicated by 'ldd cat' and 'ldd more'. (The version of ls I have
isn't statically linked, so I _think_ I'm ok there: ls works just fine.)

Interestingly enough, these two commands _work_ if run from a chroot command,
per the wu-ftpd faq. Eg running on the server machine 'chroot /home/ftp
/home/ftp/bin/cat some.txt' will work for 'some.txt' located in /home/ftp/pub.


-n--e--u--t--r--i--n--of--e--v--e--r--!
Bob Bernstein  [EMAIL PROTECTED]   http://www.brainiac.com/bernie
at
Esmond, R.I.   ftp://rupturedduck.dyn.ml.org  (sometimes)





--  
Unsubscribe?  mail -s unsubscribe [EMAIL PROTECTED] < /dev/null

wu-ftpd hangs in local network

[Jay Barbee]

Hello all,

I cannot figure out what is wrong with my two debian systems at home.  It 
seems that whenever I FTP into that it connects almost instantly, but hangs for 
about a minute or two before the login prompt appears.  Name resolution is not 
the issue, what is?

--Jay


--  
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Inoperative ls in wu-ftpd-academ

[Harald Schueler]

Am Sun, 28 Jun 1998 schrieb Bob Nielsen:
> In wu-ftpd-academ 2.4.2.16-9 (hamm), I'm not getting any response to an ls
> command with an anonymous connection.  I know there was a bug report on
> an earlier version had included libc5 files in /home/ftp/lib with binaries
> linked with libc6.  With that version, I copied the correct lib files into
> /home/ftp/lib and everything started working again.
> 
> The current installation has the correct lib files reported by ldd, but ls
> still doesn't work.  What is missing this time?

Try setting the x-bit on the library files in ~ftp/lib. This fixed it for me.
(see also bug #22323)
---
Harald Schueler
Universitaet Essen			Tel +49-201-183-2456/2568
Fachbereich 7Fax +49-201-183-2120
45117 EssenE-mail [EMAIL PROTECTED]


--   To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] 

Inoperative ls in wu-ftpd-academ

[Bob Nielsen]

In wu-ftpd-academ 2.4.2.16-9 (hamm), I'm not getting any response to an ls
command with an anonymous connection.  I know there was a bug report on
an earlier version had included libc5 files in /home/ftp/lib with binaries
linked with libc6.  With that version, I copied the correct lib files into
/home/ftp/lib and everything started working again.

The current installation has the correct lib files reported by ldd, but ls
still doesn't work.  What is missing this time?

Bob


Bob Nielsen Internet: [EMAIL PROTECTED]
Tucson, AZ  AMPRnet:  [EMAIL PROTECTED]
DM42nh  http://www.primenet.com/~nielsen


--  
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: wu-ftpd-academ question ?

[Bob Nielsen]

On 24 Jun 1998, Paul Seelig wrote:

> [EMAIL PROTECTED] (Peter Shtinkov) writes:
> 
> > I have hamm and wu-ftpd-academ ver 2.4.2.16-9 installed, but when I log
> > as anonymous i can't see directory listings.
> >
> Are you possibly running kernel-2.0.34?  This very same problem
> happened here on two "hamm" machines after installation of the latest
> so called stable kernel.  So now we are back to 2.0.33. :-(

Do the results of 'ldd /home/ftp/bin/ls' agree with the files in
/home/ftp/lib?  This was a bug which was fixed a while ago.  I'm not
having any problem with wu-ftpd-academ and 2.0.34. 

Bob


Bob Nielsen Internet: [EMAIL PROTECTED]
Tucson, AZ  AMPRnet:  [EMAIL PROTECTED]
DM42nh  http://www.primenet.com/~nielsen


--  
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: wu-ftpd-academ question ?

[Bob Nielsen]

On Fri, 19 Jun 1998, Peter Shtinkov wrote:

> I have hamm and wu-ftpd-academ ver 2.4.2.16-9 installed, but when I log
> as anonymous i can't see directory listings.
> Can anybody help me with this ?
> Thanks.


I thought this was fixed (there was a bug report on this which I believe 
has been closed).

Go to /home/ftp/bin and type 'ldd ls'.  It should say something like:

# ldd ls
libc.so.6 => /lib/libc.so.6 (0x4000e000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x4000)

Check /home/ftp/lib and see if libc.so.6 and ld-linux.so.2 are there.  If
not:

cp /lib/libc-2.0.6.so /home/ftp/lib/libc.so.6
cp /lib/ld-2.0.6.so /home/ftp/lib/ld-linux-so.2

I think the installation script for wu-ftpd-academ should have done this
for you.

cheers,

Bob


Bob Nielsen Internet: [EMAIL PROTECTED]
Tucson, AZ  AMPRnet:  [EMAIL PROTECTED]
DM42nh  http://www.primenet.com/~nielsen


--  
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

wu-ftpd-academ question ?

[Peter Shtinkov]

I have hamm and wu-ftpd-academ ver 2.4.2.16-9 installed, but when I log
as anonymous i can't see directory listings.
Can anybody help me with this ?
Thanks.
begin:  vcard
fn: Peter Shtinkov
n:  Shtinkov;Peter
org:Spectrum NET
email;internet: [EMAIL PROTECTED]
title:  System Administrator
tel;work:   (+359 2) 974 3238
x-mozilla-cpt:  ;0
x-mozilla-html: FALSE
version:2.1
end:vcard

Re: wu-ftpd-academ package disables itself

[Bob Nielsen]

On Tue, 28 Apr 1998, Nathan E Norman wrote:

> hamm system current as of this afternoon :)
> 
> I installed wu-ftpd-academ, oh, two versions ago.  At that time it
> disabled the "stock" ftpd, wu-ftpd, and itself!  I edited my
> /etc/inetd.conf and removed the two unused lines (perhaps this is the
> problem)
> 
> At any rate, the past two upgrades of wu-ftpd-academ have resulted in
> the ftpd service being disabled in /etc/inetd.conf (with a comment like
> "##)  Why would it do that, if it's the only ftp daemon installed?
> 
> Color me confused,

I know it works for me so I checked and found two entries in
/etc/inetd.conf.

The commented line has /usr/sbin/ftpd.in and the uncommented line has
/usr/sbin/ftpd which is a symlink to /etc/alternatives/ftpd, which is a
symlink to /usr/sbin/wu-ftpd-academ.

hth,

Bob


Bob Nielsen Internet: [EMAIL PROTECTED]
Tucson, AZ  AMPRnet:  [EMAIL PROTECTED]
http://www.primenet.com/~nielsen


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

wu-ftpd-academ package disables itself

[Nathan E Norman]

hamm system current as of this afternoon :)

I installed wu-ftpd-academ, oh, two versions ago.  At that time it
disabled the "stock" ftpd, wu-ftpd, and itself!  I edited my
/etc/inetd.conf and removed the two unused lines (perhaps this is the
problem)

At any rate, the past two upgrades of wu-ftpd-academ have resulted in
the ftpd service being disabled in /etc/inetd.conf (with a comment like
"##)  Why would it do that, if it's the only ftp daemon installed?

Color me confused,

--
Nathan Norman
MidcoNet - 410 South Phillips Avenue - Sioux Falls, SD  57104
mailto://[EMAIL PROTECTED]   http://www.midco.net
finger [EMAIL PROTECTED] for PGP Key: (0xA33B86E9)

PS hamm is, overall, running like a champ.  One of our hamm machines
receives a full news feed, and performance is great.  A few minor
glitches, but this is INN ...


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: wu-ftpd and anonymous ftp

[Jim]

On Wed, 4 Mar 1998, Jason Ish wrote:

> I'm running hamm and have just installed the wu-ftpd server for the purpose
> of an anonymous ftp account.  I thought I had everything working, or so it
> appeared to work from any command line ftp client (linux/win95), but when a
> friend tried to get to it using wsftp, no directory listing was given to
> him.
> 
> Whats the cause of this and how do I fix it please.  (I did read all the
> docs).

You need to build either a static version (i.e., loads no dynamic libs) of ls,
or else locate the dynamic version _plus_ copies of any libs it loads. Next put
them into appropriate directories of /home/ftp (user ftp's home dir).

Then, wu-ftpd will call that ls when asked for a directory listing from anon
users.

Something-to-try department:

Consider trying proftpd; it does not require any extra things in the anon
dir; it takes care of everything itself.

-Jim


--
E-mail the word "unsubscribe" to [EMAIL PROTECTED]
TO UNSUBSCRIBE FROM THIS MAILING LIST. Trouble?  E-mail to [EMAIL PROTECTED] .

Re: wu-ftpd and anonymous ftp

[Bob Nielsen]

On Wed, 4 Mar 1998, Jason Ish wrote:

> I'm running hamm and have just installed the wu-ftpd server for the purpose
> of an anonymous ftp account.  I thought I had everything working, or so it
> appeared to work from any command line ftp client (linux/win95), but when a
> friend tried to get to it using wsftp, no directory listing was given to
> him.
> 
> Whats the cause of this and how do I fix it please.  (I did read all the
> docs).

Apparently the libc5 libs were included in this package (also
wu-ftpd-academ) rather than libc6.  There are bug reports on this,
however, and it will hopefully be fixed soon.

The solution (until wu-ftpd gets fixed by the maintainer) was given last
week by Ossama Othman.  It worked for me, but some others seem to be still
having problems.

Run ldd on ls.   For example,

ldd /bin/ls   (you need the absolute path)

You should get output like:

libc.so.6 => /lib/libc.so.6 (0x4000f000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x4000)

Copy the the libraries from the ldd output to ~ftp/lib, or wherever the
above libraries are relative to root (i.e. if in /usr/lib, copy to
~ftp/usr/lib).  Make sure the libraries have a+rx permissions.

HTH,

Bob

---
Bob Nielsen Internet: [EMAIL PROTECTED]
Tucson, AZ  AMPRnet: [EMAIL PROTECTED]
http://www.primenet.com/~nielsen/



--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
[EMAIL PROTECTED] . 
Trouble?  e-mail to [EMAIL PROTECTED] .

Re: wu-ftpd and anonymous ftp

[Ben Gertzfield]

"Jason Ish" <[EMAIL PROTECTED]> writes:

> I'm running hamm and have just installed the wu-ftpd server for the purpose
> of an anonymous ftp account.  I thought I had everything working, or so it
> appeared to work from any command line ftp client (linux/win95), but when a
> friend tried to get to it using wsftp, no directory listing was given to
> him.

There are some problems with the current wu-ftpd package. I'd try
the proftpd package instead, which is much easier to set up and
probably more secure.

-- 
Brought to you by the letters W and T and the number 4.
"Killer refresh rate! It's even got a PCI bus!" -- Hackers
Ben Gertzfield <http://www.imsa.edu/~wilwonka/> Finger me for my public
PGP key. I'm on FurryMUCK as Che, and EFNet and YiffNet IRC as Che_Fox.


--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
[EMAIL PROTECTED] . 
Trouble?  e-mail to [EMAIL PROTECTED] .

wu-ftpd and anonymous ftp

[Jason Ish]

I'm running hamm and have just installed the wu-ftpd server for the purpose
of an anonymous ftp account.  I thought I had everything working, or so it
appeared to work from any command line ftp client (linux/win95), but when a
friend tried to get to it using wsftp, no directory listing was given to
him.

Whats the cause of this and how do I fix it please.  (I did read all the
docs).

Thanks
jason



--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
[EMAIL PROTECTED] . 
Trouble?  e-mail to [EMAIL PROTECTED] .

Re: ls doesn't work with anonymous ftp (wu-ftpd-academ, hamm)

[Joel Klecker]

At 15:32 -0500 1998-02-27, Nelson, R.A \(Richard/Rick\) wrote:
>I've got ls working - using libc6... but the owner/gid names are
>not displayed, only the numeric values.
>
>I verified that Joel's system exhibits the same problems!
>
>We must be missing something in ~ftp/etc that deals with the getgrnam
>and related calls.  This problem is new with libc6...

No, it's missing from ~ftp/lib, copy libnss_files* from /lib to ~ftp/lib,
and user/group names are displayed correctly.

(165) [EMAIL PROTECTED]
[/home/ftp/lib]# ls -l
total 823
-r-xr-xr-x   1 root root   161959 Jan 21 10:30 ld-2.0.6.so*
lrwxrwxrwx   1 root root   11 Feb 17 11:32 ld-linux.so.2 ->
ld-2.0.6.so*
-r-xr-xr-x   1 root root   643772 Jan 21 10:31 libc-2.0.6.so*
lrwxrwxrwx   1 root root   13 Feb 17 11:32 libc.so.6 ->
libc-2.0.6.so*
-rwxr-xr-x   1 root root29332 Feb  9 14:04 libnss_files-2.0.6.so*
lrwxrwxrwx   1 root root   21 Feb 27 22:39 libnss_files.so.1 ->
libnss_files-2.0.6.so*
(166) [EMAIL PROTECTED]
[/home/ftp/lib]# ftp ftp.espy.org
Connected to cerberus.espy.org.
220 cerberus.espy.org FTP server (Version wu-2.4.2-academ[BETA-16](1) Tue
Feb 17 02:42:59 CET 1998) ready.
Name (ftp.espy.org:jk): anonymous
331 Guest login ok, send your complete e-mail address as password.
Password:
230-Welcome to...
230- .  ___ .___.___   .______
230- / '   //   \   / \,___, ,..'   `. /   \ .'   \
230- |__.  ||,_-'   |__.( |\ |`| | |__-' |
230- | ||   |   `--.  || ||| | |  \  |_
230- / // / // \___.' |`---'  `---|. /  `.__.' /   \
`.___|
230-  \   \___/
230-...Joel Klecker's little chunk of FTP space.
230-
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd pub
250 CWD command successful.
ftp> ls -l
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
total 2197
drwxrwxr-x   6 root staff1024 Feb 11 11:17 .
dr-xr-xr-x   6 root root 1024 Feb 17 19:14 ..
drwxrwxr-x   2 root staff1024 Dec 30 18:59 apple-sw-updates
-rw-rw-r--   1 root staff   25098 Jan 14 23:47 bincompat-1.0.0.tar.gz
drwxrwxr-x   3 root staff1024 Feb  7 04:16 debian
drwxrwxr-x   2 root staff1024 Dec 31 18:20 incoming
-rw-rw-r--   1 root staff 2206028 Feb 11 11:17 iwanturvax.au
drwxrwxr-x   2 root staff1024 Dec 30 18:59 mt-newswatcher
226 Transfer complete.
ftp> quit
221 Goodbye.

--
Joel "Espy" KleckerDebian GNU/Linux Developer
   
God shows his contempt for wealth by the kind of person He selects to
receive it.  -- Austin O'Malley (1858-1952)



--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
[EMAIL PROTECTED] . 
Trouble?  e-mail to [EMAIL PROTECTED] .

ls doesn't work with anonymous ftp (wu-ftpd-academ, hamm)

[Nelson, R.A \(Richard/Rick\)]

I've got ls working - using libc6... but the owner/gid names are
not displayed, only the numeric values.

I verified that Joel's system exhibits the same problems!

We must be missing something in ~ftp/etc that deals with the getgrnam
and related calls.  This problem is new with libc6...

Richard Nelson


--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
[EMAIL PROTECTED] . 
Trouble?  e-mail to [EMAIL PROTECTED] .