Subject: Problem with wu-ftpd on Ultrix 4.4 with UPGRADE security

From: Martin Moore <[email-masked]>
Date: Sun, 21 Jan 1996 12:14:20 -0500 (EST)

I have just upgraded the security level on 2 of my Ultrix 4.4 machines to
UPGRADE.  This allows for users to manually migrate from a BSD style password
file (encrypted password in the /etc/passwd file) to using a shadow style 
passowrd file.  After doing the security upgrade the following happened:

Anonymous ftp worked just fine, but real users would get login failures...
220 host.domain FTP server (Version wu-2.4(2) Sun Jan 21 01:43:25 EST 19
96) ready.
Name (host.domain:root): realuser
331 Password required for realuser.
Password:
530 Login incorrect.
Login failed.
ftp> quit
221 Goodbye.

This, I hope, is something that others have allready run into and hopefully 
is fixable.  I looked for an FAQ but have not found one.  However, following 
the installation instructions I built this version using build ult.  It 
complained about typenames and such and I replaces the ftp.h file as the 
instructions show and then ran build ult again.  It was successful.

I then ran bin/ckconfig and get ok results I think:
# ./bin/ckconfig
Checking _PATH_FTPUSERS :: /etc/ftpusers
ok.

Checking _PATH_FTPACCESS :: /usr/local/etc/ftpaccess
ok.

Checking _PATH_PIDNAMES :: /usr/local/daemon/ftpd/ftp.pids-%s
ok.

Checking _PATH_CVT :: /usr/local/etc/ftpconversions
ok.

Checking _PATH_XFERLOG :: /usr/adm/xferlog
ok.

Checking _PATH_PRIVATE :: /etc/ftpgroups
ok.

Checking _PATH_FTPHOSTS :: /usr/local/etc/ftphosts
ok.

Again the anonymous ftp users are working just fine.  It is the real users
who can not login.

Any help would be greatly appreciated!  If you need to know more details
or see logs of access or whatever I will try to quickly provide them.
Thanks in advance!
-- 
						J Martin Moore (704) 262-6274
						Appalachian State University
						Academic Computing Services
						Room 2067 New COB
						Boone, NC 28608
						[email-masked]
						[email-masked]

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Sun, 21 Jan 1996 20:14:06 +0100 (MET)

> is fixable.  I looked for an FAQ but have not found one.

http://www.hvu.nl/~koos/wu-ftpd-faq.html

Anyway, from looking around the password-handling code of wu-ftpd, I conclude
wu-ftpd is either with shadow passwords or without shadow passwords. So,
a transition system like yours is not supported.

Wu-ftpd uses the password calls from libc (or libshadow, when compiled with
shadow password enabled).

If _your_ libshadow can handle your situation correctly (I guess it can,
since your system runs ;) maybe rebuilding it with shadow support enabled
will fix this.

To enable shadow support, change the master config file for your system,
config/config.ult to enable shadow password support.

Also, check the manpage(s) for the getpwent routines and their shadow
counterparts. Maybe you need to call a different crypt (pw_encrypt).

                                        Grtx. KH

-- 
  **  FAQ on current wu-ftpd at http://www.hvu.nl/~koos/wu-ftpd-faq.html  **
  Koos van den Hout,           Internetter, Unix freak and BBS SysOp at large
  [email-masked] (Home)        BBS Koos z'n Doos (+31-30-6036637 28k8)
  [email-masked] (Work)  <-- finger -l for PGPkey    (+31-30-6056619 14k4)
  http://www.hvu.nl/~koos (WWW)    Looking for a license plate with "RFC 822"
  We are root. You will be assimilated. Resistance is useless. Clickety Click

---

From: Martin Moore <[email-masked]>
Date: Sun, 21 Jan 1996 21:25:51 -0500 (EST)

Thanks!  That did the trick!  I was missing the config.ult file changes.
There was a #undef that needed to be changed to a #define
19c19
< #define  ULTRIX_AUTH
---
> #undef  ULTRIX_AUTH

I had already added the -lauth to the makefile.ult but somehow I missed
the config.ult file all together.
LIBES    = -lsupport -lauth

Again thank you for pointing me to the solution!

---

From: "Chadwick A. Dubuque" <[email-masked]>
Date: Sun, 21 Jan 1996 22:25:18 -0600 (CST)

I think I've discovered an "absent feature" (bug) from wu-ftpd on linux with
shadow passwords: It's not honoring the fact that the account has expired.

If you have shadow passwords on linux, could you please test to make sure
it's not just me that is having this problem.

In the meantime, I'll be working on a solution. I'm thinking I'll rip some
of the code out of the login() that somes with the shadow package.

-- 
Chadwick A. Dubuque            [email-masked]
http://www.acm.ndsu.NoDak.edu/~cdubuque/   finger for PGP pub. key
postal:USA/58105-5164/ND/Fargo/IACC 258 NDSU Box 5164/Chad Dubuque

---

From: Chris Timmons <[email-masked]>
Date: Mon, 22 Jan 1996 09:39:43 -0800 (PST)

On the topic of Ultrix, I've got an instance of the "'ls -l' and 'dir'
commands produce no ouput" problem. (all) Ultrix binaries are statically
linked, and I did search through the mail archives and found another instance
of the question but the answer was missing.  'ls' works fine for real and
anonymous users.  I've gone through my configuration and worked through the
FAQ but cannot seem to figure this one out... 

This is on Ultrix/VAX 4.4 and the ftpd is started from inetd via a tcp 
wrapper.  

-Chris

---

From: Martin Moore <[email-masked]>
Date: Mon, 22 Jan 1996 15:35:56 -0500 (EST)

> This is on Ultrix/VAX 4.4 and the ftpd is started from inetd via a tcp 

I have the wrapper around my ftpd as well.  Feel free to ftp to 
ftp.acs.appstate.edu  and poke around to see the files in my ~ftp/bin
directory.  Its contains the ls command that is just copied from its
standard location. Also the ~ftp/etc/directory must have the svc.conf, passwd 
and group files...  

This is not much but I hope it helps...

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Mon, 22 Jan 1996 21:35:44 +0100 (MET)

> of the code out of the login() that somes with the shadow package.

Hmmm.. the shadow password support with Linux is still a bit 'clunky'.
Maybe a couple #IFDEF linux && SHADOW_PWD or something like that would
improve things. This way it could be merged with the main code in a way
that is more transparant for future users.

                                            Grtx. KH