Date: Tue, 22 Jan 2002 08:46:16 -0800 (PST) From: Aragon Gouveia <aragon@phat.za.net> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/34171: ftpd indiscrete about unprivileged user accounts Message-ID: <200201221646.g0MGkGp34798@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 34171
>Category: misc
>Synopsis: ftpd indiscrete about unprivileged user accounts
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Jan 22 08:50:01 PST 2002
>Closed-Date:
>Last-Modified:
>Originator: Aragon Gouveia
>Release: 4.4
>Organization:
none
>Environment:
FreeBSD root.nis.za 4.4-STABLE FreeBSD 4.4-STABLE #0: Fri Dec 7 14:07:57 SAST 2001 root@root.nis.za:/usr/src/sys/compile/ROOT i386
>Description:
When logging in via the ftpd and entering login information for, say, a none existant account simply returns a "530 Login incorrect" after entering username AND password. However, try login with an account that does exist, but whose shell is not listed in /etc/shells, and you get a "530 User xxxx access denied" after *only* entering the username. This immediately confirms to the client that the username does exist on the system! Not good imho.
>How-To-Repeat:
# telnet localhost 21
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 localhost FTP server (Version 6.00LS) ready.
user nobody
530 User nobody access denied.
quit
221 Goodbye.
Connection closed by foreign host.
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200201221646.g0MGkGp34798>