Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

FTP Security Disaster

It seems that either the 10.4.9 Sever Upgrade or the recent security update has disastrously altered the behavior of FTP in my configuration.

While FTP users are still sent to their home directories at logon, they're now free to CWD to get above those directories.

Worse, FTP now apparently perceives "/" as being the root level of the boot drive of the server, rather than the FTPRoot configuration in the Server Admin app. This gives FTP users inappropriate access to files that are outside of any sharepoint.

These behaviors persist unchanged even if I unshare everything - i.e., FTP users have all this access even if there are no sharepoints configured. Given the default o=rx configuration of many of the directories at "/" in a conventional X Server instillation, this is a nightmare.

Server Admin's "Advanced" settings for FTP now seem to have no effect whatsoever. Ironically, this means it's impossible to provide FTP users any access whatsoever to sharepoints. It makes no different what I setup - the behaviors described above persist. I can even specify user home directories outside of any sharepoint and FTP will provide access to them. Failure to specify a home directory dumps the user at the root level of the server's boot drive, not the FTPRoot. My only control over any of it is to turn FTP off entirely, which of course I have, much to the distress of my users.

I note that the normal creation of symbolic links in "/Library/FTPServer/FTPRoot" has been somehow suspended. Nothing ever happens, regardless of how I change settings.

I don't use anonymous FTP, and so have no idea how that would impact this mess.

As I'm sure is obvious, I'm now way beyond my expertise. Questions, suggestions... anything at all would be welcome.

Thanks,
Bryan

G5 DP 2.5 ghz, etc., Mac OS X (10.4.9), OS X Server 10.4.9

Posted on Apr 20, 2007 4:41 PM

Best reply

Joakim Hartmann-Petersen

Level 1

15 points

Posted on Apr 21, 2007 12:39 AM

Hi

I have other problems, ( http://discussions.apple.com/thread.jspa?threadID=933299&tstart=0 ) and I just tested, and I also have the same problems you are having (on 2 different servers)

So far, I can see, that the /system/library/launchdaemon/ftp.plist has changed from using the program xftpd to using the program ftpd.

I tried yesterday to change the plist and i seemed ok, but the new one (ftpd) was quicker so i reverted. BUT with your discoveries will make me change the plist file back to pre 2007-004 security update.

Or, perhaps make all the config files as ftpd expects to find ind the /etc/ lib. (try man ftpd)

This is my pre 2007-004 security update ftp.plist:

# cat pre.2007-004.ftp.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.apple.xftpd</string>
<key>Program</key>
<string>/usr/libexec/xftpd</string>
<key>ProgramArguments</key>
<array>
<string>xftpd</string>
<string>-a</string>
</array>
<key>Sockets</key>
<dict>
<key>Listeners</key>
<dict>
<key>SockPassive</key>
<true/>
<key>SockServiceName</key>
<string>ftp</string>
<key>SockType</key>
<string>SOCK_STREAM</string>
</dict>
</dict>
<key>inetdCompatibility</key>
<dict>
<key>Wait</key>
<false/>
</dict>
</dict>
</plist>

The biggest disaster is, that Apple wrote, that the change on the lukemftpd -> tnftpd wasn't an issue on OS X Server (perhaps they meant something other, that what I understood)

View in context

33 replies

Apr 27, 2007 10:47 AM in response to guillaumegete

A thousand thank-yous for this. We're using Sandvox to create websites for posting (via FTP) on Mac OS X Server and this seems to have fixed our little problem.

I think Security Update 2004-007 prevented FTP from starting up, and mangled the ability of web broswers to furnish some of the files that were uploaded via FTP when the incorrect ftp.plist file was present.

I know just enough to be dangerous. Thank goodness for this forum.

mm

Apr 30, 2007 9:07 AM in response to R Bryan Harrison

Guys,

Its very important that we submit bug reports on these issues. Apple does read them and they do take action when enough people submit reports. Here is the page to submit server related issues:

http://www.apple.com/feedback/server.html

Apr 30, 2007 12:12 PM in response to R Bryan Harrison

Personally, I'd suggest using something other than FTP.

But if you're going to use FTP, and security is a concern, Apple's xftpd is apparently just a version of wu_ftpd... and I wouldn't use wu_ftpd for a server hosting hostile users. It's just too big and complex. I'd recommend Troll_FTPd or one of its descendants like Pure-ftpd.

tking13

Level 1

0 points

Apr 30, 2007 12:51 PM in response to R Bryan Harrison

Changing the ftp.plist file back to its pre-Security Update contents fixed the worst of my problems (ie. users getting access to root), but I haven't been able to figure out another problem I've had with my FTP server since applying the Security Update.

i can't figure out why ftp users don't go straight to their home directories upon login; instead they're being placed at FTP root. This is causing some user confusion when they try to open folders they don't have permissions for.

I'm fairly certain that I have the home folders for these FTP-only accounts set up properly, but it just doesn't work right any more.

From the discussion here, it seems that there are other changes at play than just the root issue, though I didn't notice anything specifically about this problem. Does this ring a bell to anyone? Any suggestions? Thanks in advance,

Tim King

Apr 30, 2007 7:36 PM in response to tking13

Tim,

What do you have set under FTP Advanced Settings?

-Bryan

tking13

Level 1

0 points

May 1, 2007 12:02 PM in response to R Bryan Harrison

Authenticated users see: Home Directory Only
FTP root: /Volumes/Production RAID/FTP Mosh/

any user who logs in sees the FTP Mosh folder, rather than the home directory defined for each user. For instance, the home directory for the FTP Guest user is set to "/Volumes/Production\ RAID/FTP\ Mosh/pub", but gets dropped in FTP Mosh instead. It's not a huge problem (users can get to the folders they're supposed to), but it does cause a fair amount of user confusion (& increased support calls).

I think I have the home directory defined properly, although I am a little unclear as to whether the home directory should be defined using a standard POSIX path (as it is) or if it should actually use the non-escaped form that the definition of the FTP root does...

It USED to work, though I may have changed something before finding out about the security update problem.

Thanks for the help.

Tim King

May 1, 2007 3:43 PM in response to guillaumegete

Apple released Security Update 2007-004 v1.1 today to fix the FTP server problem:

FTPServer
CVE-ID: CVE-2007-0745
Available for: Mac OS X Server v10.4.9
Impact: Users with ftp access may be able to navigate to directories
outside the normal scope
Description: Security Update 2007-004 applied an incorrect ftp
configuration file for Mac OS X Server v10.4.9 systems. Users with
ftp access, who would normally be restricted to certain directories,
may be able to access directories outside the normal scope. This
update addresses the issue by restoring the correct version
of the ftp configuration file. This issue only affects
Mac OS X Server v10.4.9 with Security Update 2007-004.

Any brave soul tested it yet?

mm

May 1, 2007 7:10 PM in response to Mike Matthews

Yes, I've tried it. So far so good.

Though the above fix got me out of hot water before the patch came along.

May 2, 2007 12:52 AM in response to tking13

Guys, it's time to update using Security Update v1.1 🙂

<http://www.apple.com/support/downloads/securityupdate2007004v11universal.html>

May 2, 2007 2:08 PM in response to guillaumegete

Interestingly... I just have a QuickTime update waiting for being installed when checking for new software.

Does Apple make updates for PPC/Intel platforms available on different dates ?

Would be interesting to know if this update just generates the same error again instead of fixing it ?

May 2, 2007 2:14 PM in response to Joakim Hartmann-Petersen

I experienced the same problem and was able to fix it by using an older ftp.plist as advised. Thanks for your help 🙂

Anyway, I noticed about this problem just a few days ago by incident. Interestingly in Server Admin the FTP service was turned off (I'm absolutely sure that it was ON). Can this anyone confirm ?

Therefore I don't hope that security was hurt too much. Is there any reliable method to check if logged in ftp users not just having browsed the directories not intended for them, but also modified/copied files in there (all users with ftp access are member of group "staff") ? Maybe searching by all files owned by a certain group or user ?

I guess that no anonymous ftp logins were allowed (at least I have them disabled in Server Admin for sure)... or has anyone experienced such trouble ?

May 2, 2007 2:24 PM in response to tobias Eichner

Anyway, I noticed about this problem just a few days
ago by incident. Interestingly in Server Admin the
FTP service was turned off (I'm absolutely sure that
it was ON). Can this anyone confirm ?

This happend to me.
mm

May 2, 2007 2:46 PM in response to Mike Matthews

This happend to me.

Great 🙂 (If the overall situation allows such a positive expression 😉

So the chance is high that even an abusive user hasn't caused any damage, because ftp was simply not working.

May 2, 2007 3:14 PM in response to Mike Matthews

I tested it today, and indeed, the new update replaces the ftp.plist file with the right one.

Good ! 🙂

May 2, 2007 4:15 PM in response to tobias Eichner

I believe that with the old ftp.plist information in the file the updater will not overwrite plist. I will be testing this theory when I get back in front of my server in the morning. Once I have tested this I will post again.

Christopher

FTP Security Disaster