Subject: Is it working somewhere on some OS ?

From: [email-masked] (Daniel Clar)
Date: Wed, 3 Jan 1996 09:37:54 +0200

Sometimes ago, I've asked a question about the fact that some messages were 
missing in the syslog files when the connections were made through anonymous 
ftp. In particular all commands relative messages are missing in Digital Unix 
3.2c. During my vacation (!) , I've looked carefully at the source code and I've
understood the reason.

Let's take the following code sequence in ftpd.c in the pass routine :

    if (anonymous || guest) {
        /* We MUST do a chdir() after the chroot. Otherwise the old current
         * directory will be accessible as "." outside the new root! */
        if (anonymous) {
/* the following line is added by me */
            syslog(LOG_INFO,"PW->PW_DIR %s", pw->pw_dir);
            if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) {
                reply(550, "Can't set guest privileges.");
                goto bad;
            }
/* the following two lines are added by me */
        reply(220, "after chroot and chdir.");
        syslog(LOG_INFO,"AFTER CHDIR ANONYMOUS %d GUEST %d", anonymous, guest);

So what happens ?

The first syslog works correctly and the PW->PW_DIR message is sent in the 
daemon.log file. But, if the "after chroot and chdir." is correctly sent to the 
user, the "AFTER CHDIR ANONYMOUS" is absolutely not sent to the daemon.log file.

When the chdir,chroot is not executed, for an identified user, there is 
absolutely no problem. 

So for me the syslog doesn't work any more after the chroot,chdir. But in the 
ftpd.c and ftpcmd.c files many syslog(LOG_INFO,.....) have been put even for
anonymous ftp accesses. Some of them are at the end of the pass routine :

syslog(LOG_INFO, "ANONYMOUS FTP LOGIN FROM %S [%S], %S", .....);

So I suppose that it's working on some other UNIX systems. Am I wrong ?

I think that the software authors were sure that it works before putting this
syslog lines.

Thank you for your answer. I need to be sure that it's a problem in my Unix
version.

Daniel

o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o
|   Daniel Clar          	    	   e-mail : [email-masked]  |
|   Computer Operations Manager			  : [email-masked]	    |
|   Service Informatique Supelec                    and                     |
|   Plateau de Moulon                     DECUSF::CLAR_D or [email-masked] |
|   91192 Gif sur Yvette Cedex - France                                     |
|   Tel : (33 1) 69 85 14 87        	   Fax : (33 1) 69 85 12 34         |
o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o=o

---

From: Ric Anderson <[email-masked]>
Date: Wed, 3 Jan 1996 16:50:09 -0700 (MST)

Works on Sun Solaris 2.3.  I've seen lost messages on other systems
though.  It depends a lot on how syslog does things.  If it opens
a file descriptor at openlog() time and keeps it open, then 
you'll get messages after a chroot.  If syslog() re-opens the
connection for each message then its likely to fail after a chroot
because some device entry is not in the ~ftp/dev/ hierarchy.

You could create a test program that does
	openlog()
	syslog()
	chroot(to your home dir)
	syslog()
to demonstrate the problem, then replace the path in the chroot
with "/" and see if you get all the messages.  If you do, some
work with trace or truss (I think DEC has one of those tools
for tracing system calls) should turn up the file name.

Good Luck,
Ric (<[email-masked]> "Ric Anderson", using RTD's public internet access)