diff options
| author | lukem <lukem@NetBSD.org> | 1997-09-23 14:25:30 +0000 |
|---|---|---|
| committer | lukem <lukem@NetBSD.org> | 1997-09-23 14:25:30 +0000 |
| commit | 96ad830ee2f07a4be0c370e4cdec2084c133fe41 (patch) | |
| tree | e738ead5a1a756d85885b573ff474036976dcb7e /libexec | |
| parent | 550665a81478c166997b7a00d76615df29b63129 (diff) | |
- add '-C user', which runs checkaccess(user) and exits with the result
(0 == user allowed in /etc/ftpusers, 1 == user denied in /etc/ftpusers).
from Jim Bernard <jbernard@tater.mines.edu> in [security/4061] with mods
- getopt returns -1 not EOF
- in lostcon(), call dologout(1) not dologout(-1);
Diffstat (limited to 'libexec')
| -rw-r--r-- | libexec/ftpd/ftpd.8 | 15 | ||||
| -rw-r--r-- | libexec/ftpd/ftpd.c | 66 |
2 files changed, 50 insertions, 31 deletions
diff --git a/libexec/ftpd/ftpd.8 b/libexec/ftpd/ftpd.8 index 466a309f334..208de852df5 100644 --- a/libexec/ftpd/ftpd.8 +++ b/libexec/ftpd/ftpd.8 @@ -1,4 +1,4 @@ -.\" $NetBSD: ftpd.8,v 1.16 1997/09/23 13:56:41 lukem Exp $ +.\" $NetBSD: ftpd.8,v 1.17 1997/09/23 14:25:30 lukem Exp $ .\" .\" Copyright (c) 1985, 1988, 1991, 1993 .\" The Regents of the University of California. All rights reserved. @@ -45,6 +45,7 @@ Internet File Transfer Protocol server .Op Fl dl .Op Fl a Ar anondir .Op Fl c Ar confdir +.Op Fl C Ar user .Sh DESCRIPTION .Nm is the @@ -69,6 +70,14 @@ Change the root directory of the configuration files from .Dq Pa /etc to .Ar directory . +.It Fl C +Check whether the specified user would be granted access under +the restrictions given in +.Pa /etc/ftpusers +and exit without attempting a connection. +.Nm +exits with an exit code of 0 if access would be granted, or 1 otherwise. +This can be useful for testing configurations. .It Fl d Debugging information is written to the syslog using LOG_FTP. .It Fl l @@ -460,7 +469,9 @@ Make this directory owned by and unwritable by anyone (mode 555). The program .Xr ls 1 -must be present to support the list command. +must be present to support the +.Sq LIST +command. This program should be mode 111. .It Pa ~ftp/etc Make this directory owned by diff --git a/libexec/ftpd/ftpd.c b/libexec/ftpd/ftpd.c index 1fb1ff72f92..597ddc1c9b0 100644 --- a/libexec/ftpd/ftpd.c +++ b/libexec/ftpd/ftpd.c @@ -1,4 +1,4 @@ -/* $NetBSD: ftpd.c,v 1.34 1997/09/23 13:56:42 lukem Exp $ */ +/* $NetBSD: ftpd.c,v 1.35 1997/09/23 14:25:31 lukem Exp $ */ /* * Copyright (c) 1985, 1988, 1990, 1992, 1993, 1994 @@ -44,7 +44,7 @@ __COPYRIGHT( #if 0 static char sccsid[] = "@(#)ftpd.c 8.5 (Berkeley) 4/28/95"; #else -__RCSID("$NetBSD: ftpd.c,v 1.34 1997/09/23 13:56:42 lukem Exp $"); +__RCSID("$NetBSD: ftpd.c,v 1.35 1997/09/23 14:25:31 lukem Exp $"); #endif #endif /* not lint */ @@ -223,34 +223,11 @@ main(argc, argv, envp) char *cp, line[LINE_MAX]; FILE *fd; - /* - * LOG_NDELAY sets up the logging connection immediately, - * necessary for anonymous ftp's that chroot and can't do it later. - */ - openlog("ftpd", LOG_PID | LOG_NDELAY, LOG_FTP); - addrlen = sizeof(his_addr); - if (getpeername(0, (struct sockaddr *)&his_addr, &addrlen) < 0) { - syslog(LOG_ERR, "getpeername (%s): %m",argv[0]); - exit(1); - } - addrlen = sizeof(ctrl_addr); - if (getsockname(0, (struct sockaddr *)&ctrl_addr, &addrlen) < 0) { - syslog(LOG_ERR, "getsockname (%s): %m",argv[0]); - exit(1); - } -#ifdef IP_TOS - tos = IPTOS_LOWDELAY; - if (setsockopt(0, IPPROTO_IP, IP_TOS, (char *)&tos, sizeof(int)) < 0) - syslog(LOG_WARNING, "setsockopt (IP_TOS): %m"); -#endif - data_source.sin_port = htons(ntohs(ctrl_addr.sin_port) - 1); debug = 0; + logging = 0; (void)strcpy(confdir, _DEFAULT_CONFDIR); - /* set this here so klogin can use it... */ - (void)snprintf(ttyline, sizeof(ttyline), "ftp%d", getpid()); - - while ((ch = getopt(argc, argv, "a:c:dlt:T:u:v")) != EOF) { + while ((ch = getopt(argc, argv, "a:c:C:dlt:T:u:v")) != -1) { switch (ch) { case 'a': anondir = optarg; @@ -260,6 +237,10 @@ main(argc, argv, envp) (void)strncpy(confdir, optarg, sizeof(confdir)); confdir[sizeof(confdir)-1] = '\0'; break; + + case 'C': + exit(checkaccess(optarg)); + /* NOTREACHED */ case 'd': case 'v': /* deprecated */ @@ -278,10 +259,38 @@ main(argc, argv, envp) break; default: + if (optopt == 'a' || optopt == 'C') + exit(1); warnx("unknown flag -%c ignored", optopt); break; } } + + /* + * LOG_NDELAY sets up the logging connection immediately, + * necessary for anonymous ftp's that chroot and can't do it later. + */ + openlog("ftpd", LOG_PID | LOG_NDELAY, LOG_FTP); + addrlen = sizeof(his_addr); + if (getpeername(0, (struct sockaddr *)&his_addr, &addrlen) < 0) { + syslog(LOG_ERR, "getpeername (%s): %m",argv[0]); + exit(1); + } + addrlen = sizeof(ctrl_addr); + if (getsockname(0, (struct sockaddr *)&ctrl_addr, &addrlen) < 0) { + syslog(LOG_ERR, "getsockname (%s): %m",argv[0]); + exit(1); + } +#ifdef IP_TOS + tos = IPTOS_LOWDELAY; + if (setsockopt(0, IPPROTO_IP, IP_TOS, (char *)&tos, sizeof(int)) < 0) + syslog(LOG_WARNING, "setsockopt (IP_TOS): %m"); +#endif + data_source.sin_port = htons(ntohs(ctrl_addr.sin_port) - 1); + + /* set this here so klogin can use it... */ + (void)snprintf(ttyline, sizeof(ttyline), "ftp%d", getpid()); + (void) freopen(_PATH_DEVNULL, "w", stderr); (void) signal(SIGPIPE, lostconn); (void) signal(SIGCHLD, SIG_IGN); @@ -346,7 +355,7 @@ lostconn(signo) if (debug) syslog(LOG_DEBUG, "lost connection"); - dologout(-1); + dologout(1); } /* @@ -543,7 +552,6 @@ checkaccess(name) } (void) fclose(fd); return (retval); - } #undef ALLOWED #undef NOT_ALLOWED |
