Subject: Re: Re[2]: Re[2]: Re[2]: Re[2]: Please help...

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 27 May 1999 11:11:43 -0400 (EDT)

On Thu, 27 May 1999, Mad Vinnie wrote:

> mort:x:1000:101::/home/mort/./:/bin/bash exit

This will not work.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Koos van den Hout _U nix and we all_ <[email-masked]>
Date: Fri, 28 May 1999 08:47:04 +0200

Quoting Mad Vinnie who wrote on Thu, May 27, 1999 at 04:58:06PM +0200:

> The problem is, everybody thinks its a /etc/shells problem,

One thing: wu-ftpd is using PAM now if possible. Maybe PAM on that system
checks valid shells differently. Check /etc/pam.d/ftp

Just a hunch.

                                                Koos

-- 
 Koos van den Hout                    Expertisecentrum Cetis http://cetis.nl/
 [email-masked] (Work)                     Workphonenumber: +31-30-2586287
 [email-masked] (Home)                   Workfaxnumber: +31-30-2586290
 http://web.cetis.hvu.nl/~koos/  PGP keyid RSA/1024 0xCA845CB5 via keyservers

---

From: Mad Vinnie <[email-masked]>
Date: Thu, 27 May 1999 16:58:06 +0200

Hi Ian,

Well, the problem with the .profile is that I can ^C before the .profile
is read/executed therefor trapping the ^C won't be the sollution.

The problem is, everybody thinks its a /etc/shells problem, but if I use
the normal bash in the passwd file (except there exit behind it) it
should work because its the same shell I use for my normal (console)
logins therefor thatone must be correct in the /etc/shells file. Mayby
it works for you ,by the way, so you won't have to use the .profile
anymore.

For the one's who still think its a /etc/shells problem, I've pasted my
shells here under...

/bin/ash
/bin/bash
/bin/bash1
/bin/csh
/bin/false
/bin/true
/bin/sh
/bin/tcsh
/usr/bin/csh
/usr/bin/ksh
/usr/bin/tcsh
/usr/bin/zsh
/bin/ftponly
/etc/ftponly

This is my /etc/shells files and this is my passwd file (or at least a
part of it)

nobody:x:65534:65534:nobody:/tmp:/bin/bash
mort:x:1000:101::/home/mort/./:/bin/bash exit
test:x:1001:101::/home/test/./:/etc/ftponly

If there is anymore info anyone should need to help me with this problem
than PLEASEEEE tell me.

Greetz Vincent...

:-))

On Thu, 27 May 1999 10:17:49 -0400
"Ian Guthrie" <[email-masked]> wrote:

> I'm damn lazy, rather than configure more, you could always trap the ^C with
> a trap command before the exit line in their profile, that way they couldn't
> ^C to exit.
> 
> Of course, you could also get the problem sorted out (a much better way). I
> can't help more sorry, I'm sure some others on the list can! I'm sure it's
> somewhere in the configuration of your shell. It's definately not your
> "ftpaccess" file. When you get it figured out could you let me/the list know
> what it was?
> 
> Ian
> 
> 
> 
> ----- Original Message -----
> From: Mad Vinnie <[email-masked]>
> To: <[email-masked]>
> Sent: Thursday, May 27, 1999 4:19 AM
> Subject: Re[2]: Re[2]: Re[2]: Please help...
> 
> 
> > Now I'm sure somehow it want's to execute something at the login at FTP.
> > When I give hime a .profile with just exit, it works just fin, but it is
> > easy exploit, if your fast enough just hit ^C and all you get is the
> > prompt and you are not logged out. Now I tried to give him the shell
> > :/bin/bash exit    which just works fine in the telnet , I get logged
> > out and I can't hit ^C to escape it, but when I try to FTP I get a login
> > incorrect. (again) which should indicate that someone/thing tries to
> > execute a script or something but because you are logged out or you have
> > no 'legitimate' shell it cannot be executed and therefor you can't login
> > via FTP. is there anyway to check what it tries to execute on login?
> >
> > Thanks in advance,
> >
> > Greetz Vincent...
> >
> > :-))
> >