Subject: wu security?

From: Jose Delgado <[email-masked]>
Date: Sun, 21 Apr 1996 16:37:24 +0200

Hi,

I was very surprised to see that my real users (with username and password) can login with ftp and access their 
home directory, with pwd /home/user (not chroot()), then play all around the system.. I'm using the wu shipped 
with RedHat 3.0.3 (2.4.2b9), and I did no change to the default config, only using kernel 1.3.87 instead 
1.2.13. Seems also that wu ignores ftpaccess config (regardless of changes, always anonymous and real names can 
login, even deleting classes).

I only found it by searching for a way to allow the users access their public_html directory, so they can 
maintain their own Apache Web pages via ftp.

I checked all the man pages, FAQ list, configuration files, mail list comments and many more, but all seems to 
be ok.

:-?

Jose

BTW: does anyone what's the package used by [email-masked]?, I'm searching for a good mailing list 
server.

---

From: The Doctor <[email-masked]>
Date: Sun, 21 Apr 1996 09:01:57 -0600 (MDT)

> I checked all the man pages, FAQ list, configuration files, mail list comments and many more, but all seems to 

Jose, This is the case WITH wu, BUt some files could be blocked as
downloadable.