From owner-freebsd-bugs Tue Jan 22 8:51:35 2002 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id B21FB37B691 for ; Tue, 22 Jan 2002 08:50:03 -0800 (PST) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.6/8.11.6) id g0MGo1u38578; Tue, 22 Jan 2002 08:50:01 -0800 (PST) (envelope-from gnats) Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 78C2D37B433 for ; Tue, 22 Jan 2002 08:46:16 -0800 (PST) Received: (from nobody@localhost) by freefall.freebsd.org (8.11.6/8.11.6) id g0MGkGp34798; Tue, 22 Jan 2002 08:46:16 -0800 (PST) (envelope-from nobody) Message-Id: <200201221646.g0MGkGp34798@freefall.freebsd.org> Date: Tue, 22 Jan 2002 08:46:16 -0800 (PST) From: Aragon Gouveia To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-1.0 Subject: misc/34171: ftpd indiscrete about unprivileged user accounts Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 34171 >Category: misc >Synopsis: ftpd indiscrete about unprivileged user accounts >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Jan 22 08:50:01 PST 2002 >Closed-Date: >Last-Modified: >Originator: Aragon Gouveia >Release: 4.4 >Organization: none >Environment: FreeBSD root.nis.za 4.4-STABLE FreeBSD 4.4-STABLE #0: Fri Dec 7 14:07:57 SAST 2001 root@root.nis.za:/usr/src/sys/compile/ROOT i386 >Description: When logging in via the ftpd and entering login information for, say, a none existant account simply returns a "530 Login incorrect" after entering username AND password. However, try login with an account that does exist, but whose shell is not listed in /etc/shells, and you get a "530 User xxxx access denied" after *only* entering the username. This immediately confirms to the client that the username does exist on the system! Not good imho. >How-To-Repeat: # telnet localhost 21 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 localhost FTP server (Version 6.00LS) ready. user nobody 530 User nobody access denied. quit 221 Goodbye. Connection closed by foreign host. >Fix: >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message