🚀 go-pugleaf

unruh@physics.ubc.ca (Bill Unruh) writes:

> In <F5p6AI.569@scrum.muc.de> mibu@scrum.muc.de (M. Buchenrieder) writes:
> >and manually edit the /etc/passwd file to have an entry with an empty
> >password string and no corresponding entry in /etc/shadow, then you'll
> >always be able to login without password. Try it. Add a user manually
> >and login. I just tested it on a SuSE 5.3 system, using login.c v. 1.4 .
> >Using an FTP account to actually access the system is just a way to hide
> >the intruder(s) from the eyes of the sysadmin. But the damage is already
> >done.
> 
> His comment is that while login does not allow a remote root login with no
> password, ftp does allow a root login with no password. This is what he
> is calling the bug in ftpd.  It certainly is an inconsistancy between
> the two.

No, his comment was that his "login scripts" do not allow no password.
The inconsistency is not w/ wu-ftpd. I seriously doubt wu-ftpd hand
checks the /etc/passwd file or reads the /etc/shadow file directly;
it almost certainly calls getpwnam() and getspnam() which do whatever
is defined for the system.

> 
> It is also true that this bug is minor compared to the bug which allowed
> a root user to be entered into passwd without a password.

Which is the cause of the problem, NOT any supposed hole in wu-ftpd.

~frank

-- 
Frank Cusack       **       Icon CMT Corp.       **       PGP: C001AA75
496620796F752063616E207265616420746869732C20796F7520686176652066
617220746F6F206D7563682074696D65206F6E20796F75722068616E6473210F