Bugtraq mailing list archives
Re: ftpd: the advisory version
From: smb () RESEARCH ATT COM (Steven M. Bellovin)
Date: Mon, 26 Jun 2000 14:13:39 -0400
In message <20000624091756.28153.qmail () fiver freemessage com>, Lamagra Argamal writes:
Last thing, I've been thinking about the general ftp protocol and there is onl y 1 reason why it should run as root after authentication. Namely to bind the dataconnection to port <ftpport - 1> (mostly 20). And we all know high ports r equire root priviledges for binding. Couldn't you change it to bind to the port at startup. This would require some other changes to prevent DoS etc But it should be possible, after that the daemon can just drop all priviledges after authentication. Giving an attacker nothing.
In "Firewalls and Internet Security", Bill Cheswick and I outlined an implementation technique that could avoid the problem. Specifically, we invoked a small, stupid, setuid-root program that, when passed a socket on port 21, bound another socket to port 20. Many other variants on that scheme are possible, especially if passing file descriptors across pipes or UNIX domain socket pairs works on your system. --Steve Bellovin
Current thread:
- Re: ftpd: the advisory version Lamagra Argamal (Jun 24)
- Re: ftpd: the advisory version Jim Knoble (Jun 26)
- Re: ftpd: the advisory version Olaf Kirch (Jun 27)
- Re: ftpd: the advisory version Mike Eldridge (Jun 29)
- Re: ftpd: the advisory version Olaf Kirch (Jun 27)
- Linux capability bounding set weakness Patrick Reynolds (Jun 26)
- Re: Linux capability bounding set weakness Paul Wouters (Jun 27)
- Re: Linux capability bounding set weakness Matthew Kirkwood (Jun 27)
- Improved ARP sniffer Paul Starzetz (Jun 27)
- [suse-security-announce] SuSE Security Announcement: kernel-2.2.x (fwd) Daniel T. Chen (Jun 27)
- <Possible follow-ups>
- Re: ftpd: the advisory version Steven M. Bellovin (Jun 26)
- Re: ftpd: the advisory version Dan Harkless (Jun 27)
- Re: ftpd: the advisory version Teodor Cimpoesu (Jun 28)
- Re: ftpd: the advisory version Sebastian (Jun 28)
- Re: ftpd: the advisory version Kasatenko Ivan Alex. (Jun 29)
- Re: ftpd: the advisory version Barney Wolff (Jun 29)
- Re: ftpd: the advisory version Sebastian (Jun 29)
- (forw) Re: Netscape ftp Server (fwd) Elias Levy (Jun 29)
- Re: ftpd: the advisory version Juergen P. Meier (Jun 30)
- SecureXpert Advisory [SX-20000620-1] SecureXpert DIRECT Sender (Jun 30)
- SecureXpert Advisory [SX-20000620-3] SecureXpert DIRECT Sender (Jun 30)
- Re: ftpd: the advisory version Jim Knoble (Jun 26)