Subject: chroot and logging

From: Charles Bruneteau <[email-masked]>
Date: Tue, 04 May 1999 11:17:43 +0200

hi,

On my solaris server i configured wuftpd with the option "-r/file/ftp"
in inetd.conf in order to have a chrooted environment for everyone. The
chroot is done just after the parse of the ftpaccess file. Therefore
even the authentication is done after the chroot : this is a simple way
to manage the ftp users in different files than /etc/passwd, etc. (our
ftp users should be created dynamically by a cgi-bin).
But whith the chroot comes my problem : it seems that ftpd can't
communicate with syslog and i see the following errors :

    open("/etc/.syslog_door", O_RDONLY)             Err#2 ENOENT

So there is my question : is there a way to had such a door in a
chrooted environment ? I don't know much about doors on Solaris.
The same problem occurs for name resolution (/etc/.name_service_door).
Maybe there is a way to make ftpd use another facility than syslog ?

Thanks

Charles Bruneteau

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 4 May 1999 08:51:44 -0400 (EDT)

On Tue, 4 May 1999, Charles Bruneteau wrote:

> in inetd.conf in order to have a chrooted environment for everyone.
> The chroot is done just after the parse of the ftpaccess file.
> Therefore even the authentication is done after the chroot : this is a
> simple way to manage the ftp users in different files than
> /etc/passwd, etc. (our ftp users should be created dynamically by a
> cgi-bin). But whith the chroot comes my problem : it seems that ftpd
> can't communicate with syslog and i see the following errors :
> 
> chrooted environment ? I don't know much about doors on Solaris. The
> same problem occurs for name resolution (/etc/.name_service_door).

I use one of two approaches depending upon what I need to do on the
machine.

 - Hard link (ln) the syslog file from the real system to the chroot.  On
   Linux, this is /dev/log and it gets recreated every time the syslog
   daemon starts or is restarted (via -HUP, say, for log rotation).  I do
   this for short-term execution such as FTP.

 - Run a copy of syslogd in the same chroot'd area.  This fixes the
   hardlink being de-linked problem but costs a process.  It's what I
   usually do, though, when running a standalone daemon.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Ted Keller <[email-masked]>
Date: Tue, 4 May 1999 10:15:55 -0400 (EDT)

I'm doing logging across a chrooted environment successfully in Solaris
2.5.1 and Solaris 2.6.  I haven't tested Solaris 2.7 yet.  Releases prior
to that did NOT/does NOT work.  Charles, you failed to mention which
version of Solaris you are working on.  If you are still on a 2.5 or
earlier, please upgrade and I think your syslog can work across the
chroot.  If you still have problems, let me know and I will share with you
some of the chroot envronment setup.

ted keller

---

From: Charles Bruneteau <[email-masked]>
Date: Tue, 04 May 1999 16:41:10 +0200

> >    usually do, though, when running a standalone daemon.

Ted, this is Solaris 2.6.

I didn't add anything for syslog in my chroot environment since i have not try
to chroot a syslog. I can't figure how to link a door on Solaris. Therefore i
guess that the only solution is to chroot a syslog ?

Gregory, have you never thouht about allowing to use another facility than
syslog (as for xfrlog) ?

Thanks

Charles

---

From: Charles Bruneteau <[email-masked]>
Date: Tue, 04 May 1999 18:35:40 +0200

In order to chroot syslog i added (in the chroot environment) :
    - libraries in /usr/lib
    - log dans conslog in /dev
    - wtmp and wtmpx in /var/adm
    - syslogd

With theses files i can do 'chroot /opt/ftp syslogd'.
BUT when i wan to connect to the server it crashes : here is the end of the
trace of inetd (pid 137)
------------------------------------------------------------------------
open("/usr/local/etc/wu-ftp-msgs/wu-anonftp-wellcomemsg", O_RDONLY) Err#13
EACCES
18640:  open(".", O_RDONLY)                             = 8
18640:  lstat(".", 0xEFFFDE10)                          = 0
18640:  chdir(".")                                      = 0
18640:  pathconf(".", _PC_PATH_MAX)                     = 1024
18640:  stat64("./", 0xEFFFD8E0)                        = 0
18640:  stat64("/p003103", 0xEFFFD848)                  = 0
18640:  fchdir(8)                                       = 0
18640:  close(8)                                        = 0
18640:  pathconf(".", _PC_PATH_MAX)                     = 1024
18640:  stat64("./", 0xEFFFE288)                        = 0
18640:  stat64("/p003103", 0xEFFFE1F0)                  = 0
18640:  open(".", O_RDONLY)                             = 8
18640:  lstat(".", 0xEFFFE580)                          = 0
18640:  chdir(".")                                      = 0
18640:  pathconf(".", _PC_PATH_MAX)                     = 1024
18640:  stat64("./", 0xEFFFE050)                        = 0
18640:  stat64("/p003103", 0xEFFFDFB8)                  = 0
18640:  fchdir(8)                                       = 0
18640:  close(8)                                        = 0
18640:  pathconf(".", _PC_PATH_MAX)                     = 1024
18640:  stat64("./", 0xEFFFE9F8)                        = 0
18640:  stat64("/p003103", 0xEFFFE960)                  = 0
18640:  open(".", O_RDONLY)                             = 8
18640:  lstat(".", 0xEFFFE580)                          = 0
18640:  chdir(".")                                      = 0
18640:  pathconf(".", _PC_PATH_MAX)                     = 1024
18640:  stat64("./", 0xEFFFE050)                        = 0
18640:  stat64("/p003103", 0xEFFFDFB8)                  = 0
18640:  fchdir(8)                                       = 0
18640:  close(8)                                        = 0
18640:  time()                                          = 925831513
18640:  stat("/etc/ftpd_maintenance", 0xEFFFF310)       Err#2 ENOENT
18640:  fstat(3, 0xEFFFEC60)                            = 0
18640:  time()                                          = 925831513
18640:      Incurred fault #6, FLTBOUNDS  %pc = 0xEF624614
18640:        siginfo: SIGSEGV SEGV_MAPERR addr=0xEF561A58
18640:      Received signal #11, SIGSEGV [caught]
18640:        siginfo: SIGSEGV SEGV_MAPERR addr=0xEF561A58
18640:  fstat(3, 0xEFFFDD40)                            = 0
18640:  time()                                          = 925831513
18640:      Incurred fault #6, FLTBOUNDS  %pc = 0xEF624614
18640:        siginfo: SIGSEGV SEGV_MAPERR addr=0xEF561A58
18640:      Received signal #11, SIGSEGV [default]
18640:        siginfo: SIGSEGV SEGV_MAPERR addr=0xEF561A58
137:        Received signal #18, SIGCLD, in poll() [caught]
137:          siginfo: SIGCLD CLD_KILLED pid=18640 status=0x000B
137:    poll(0xEFFFD890, 44, -1)                        Err#4 EINTR
137:    sigprocmask(0, 0x00000000, 0xEFFFD4A8)          = 0
137:    sigprocmask(SIG_BLOCK, 0xEFFFD4A8, 0xEFFFD498)  = 0
137:    waitid(P_ALL, 0, 0xEFFFD518, WEXITED|WNOHANG)   = 0
137:    waitid(P_ALL, 0, 0xEFFFD518, WEXITED|WNOHANG)   = 0
137:    sigprocmask(0, 0x00000000, 0xEFFFD4A8)          = 0
137:    sigprocmask(SIG_SETMASK, 0xEFFFD4A8, 0xEFFFD498) = 0
137:    setcontext(0xEFFFD658)
137:    alarm(0)                                        = 0
137:    sigaction(SIGALRM, 0xEFFFF7A0, 0xEFFFF850)      = 0
137:    sigprocmask(SIG_BLOCK, 0xEFFFF840, 0xEFFFF830)  = 0
137:    alarm(1)                                        = 0
18640:          *** process killed ***
------------------------------------------------------------------------

the file descriptor 3 is /dev/conslog.

The server only crashes if it uses PAM. I mean that a server compiled without
USE_PAM doesn't crash.
With PAM, but without /dev/conslog there is no more crash... but no more logs.

Then i tried with /dev/conslog and a server compiled without PAM, and with no
chrooted syslogd (but with the system syslogd): i can see the command and
security logs...

So i don't understand how syslog runs and how process can log messages betwen
the door /etc/.syslog_door and the devices /dev/log & /dev/conslog ? I guess
that i only need /dev/*log, but no chrooted syslogd.  Now there 's still the
problem with PAM.

Any explications ?

Charles

---

From: "L. Marcel BARRERO M." <[email-masked]>
Date: Tue, 4 May 1999 13:14:08 -0400 (BOT)

Hello,

  In my /ets/ftpaccess file, I have the following line:

limit      anonymous 10 any /etc/ftp.msg.dead

  obviously with the file /etc/ftp.msg.dead created and with the "came
back later" message.

  The problem is that when I'm doing an anonymous ftp to my server, the
message I got is:
		You are user #x from -1 allowed

  -1 as for unlimited connections, where I just want 10.

  the -1 is taken with %M variable and x from %N

  Thank you for any help....

			Marcel

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 4 May 1999 13:32:45 -0400 (EDT)

> limit anonymous 10 any /etc/ftp.msg.dead
        ^^^^^^^^^

do you have a line starting with "class anonymous "?  No?  Then there is
no class 'anonymous' so this line has no effect.

--