🚀 go-pugleaf

In article <83347@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:
>  What keeps any person who can anonymous ftp from going down your
>etc directory and grabbing the passwd file?  Does ftp log this?  I
>know that some Unix systems use a chroot system to lock anonymous
>ftp users into a restricted section of the directory.  Do all
>ftp systems do this?

Most Unix anonymous FTP servers use chroot() to limit the access of
anonymous FTP.  The /etc/passwd file it has access to is usually a minimal
version.

If you have a system that doesn't use chroot() for anonymous FTP, maybe it
has shadow passwords.
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar

In article <83347@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:
>  What keeps any person who can anonymous ftp from going down your
>etc directory and grabbing the passwd file?  Does ftp log this?  I
>know that some Unix systems use a chroot system to lock anonymous
>ftp users into a restricted section of the directory.  Do all
>ftp systems do this?

No, they don't all do it but you'd be hard pressed nowadays to find one
that didn't.  Anyway, most unixes are set up on the principle that
people *can* snarf your password file.  If you're a security-by-obscurity
fanatic, you might as well go the whole hog and get a shadow password
suite.

On the flavour of unix that I run, I haven't worked out how to get
it to log transfers except by turning ftpd debugging on (-d).  A bit
verbose, but it gives me what I want.

(I have moral objections to logging anonymous ftp transfers on public
sites, but this is *my* machine, and I have no public archives and
no users who would be ftp'ing in)

G
--