ftp from pc windows:the password appears!

[Francesco Sarno]

Hi all,
i have a probelm with ftp.I have same ws linux (AS2.1,RH8) and when i open a ftp session from a pc windows towards ws (by browser internet explorer v5.0,6.0) on the title bar i see my password!
There are same things that i must change on the ftp servers.

Thanks a lot,
Francesco

[Jerome Henry]

Hi,

Which ftp server do you use ? Can you post your .conf file ?
Tks
J

[Francesco Sarno]

I use wu-ftp. Wath do you mean for ".conf" file? ftpaccess,ftpusers,ftpgroups?

thank you!

[Jerome Henry]

Hi,

First check that the feature "remember my password" is disabled in Explorer, otherwise it 's normal.

Then, yes, post ftpaccess for check. Please precise what version of wu-ftpd you are running.

From later AS 3, Redhat changed to vsftpd, as wu-ftpd has a long history of flaws that make it quite insecure ( http://www.vsftpd.org ). You may consider turning to it, it's configuration is quite simple, and it's very secure.

hth

J

[Francesco Sarno]

I had disabled memorization of password in IE.
The version of wu-ftpd is 2.6.1

The ftpaccess is :
# This file controls the behavior of the wu-ftpd
# ftp server.
#
# If you're looking for a graphical frontend to
# editing it, try kwuftpd from the kdeadmin
# package.

# Don't allow system accounts to log in over ftp
deny-uid %-99 %65534-
deny-gid %-99 %65534-
allow-uid ftp
allow-gid ftp

# Chroot all users to their home directory by default
# (comment this out if you don't want to chroot most of your users)

#guestuser *
# If you wish to allow user1 and user2 to access other
# directories, use the line below:
# realuser user1,user2
realuser fsarno,tbosio

# The ftpchroot group doesn't exist by default, this
# entry is just supplied as an example.
# To chroot a user, modify the line below or create
# the ftpchroot group and add the user to it.
#
# You will need to setup the required applications
# and libraries in the root directory (set using
# guest-root).
#
# Look at the anonftp package for the files you'll need.
guestgroup ftpchroot

# User classes...
class all real,guest,anonymous *
# Set this to your email address
email root@localhost

# Allow 5 mistyped passwords
loginfails 5

# Notify the users of README files at login and when
# changing to a different directory
readme README* login
readme README* cwd=*

# Messages displayed to the user
message /welcome.msg login
message .message cwd=*

# Allow on-the-fly compression and tarring
compress yes all
tar yes all

# Prevent anonymous users (and partially guest users)
# from executing dangerous commands
chmod no guest,anonymous
delete no anonymous
overwrite no anonymous
rename no anonymous

# Turn on logging to /var/log/xferlog
log transfers anonymous,guest,real inbound,outbound

# If /etc/shutmsg exists, don't allow logins
# see ftpshut man page
shutdown /etc/shutmsg

# Ask users to use their email address as anonymous
# password
passwd-check rfc822 warn


Thank a lot!

[Jerome Henry]

Hi,
Your ftpaccess has nothing wrong.
It seems to be related to Ms explorer. I tried putting on a AS2.1 wu-ftpd version 2.6, then 2.8, nopassword appear in title bar of explorer 5.5 (only with server IP and username), but does appear in both cases if I use Ms explorer 5 on a vmware NT4 box...
Seems that showing user password to the user himself wasn't considered as abnormal at that time.
Maybe upgrading explorer on your network would be a good idea, keeping in mind that the password you see is the password you typed, so you are supposed to know it. The only issue is if s.o. looks over your shoulder...
Still vsftpd is considered as better secured than wu-ftpd...

hope it helped

J

[Francesco Sarno]

Thank you,but i don't believe that wu-ftp is the problem,becouse the same things happens with anothers ftpserver (alpha server with tru64).
Bye,F.

[Jerome Henry]

Yes,
that's what I mean by "it seems to be related to Ms explorer".
My advice on wu-ftpd was intended to be general, and has no link with the issue you encounter.
Cheers

J

[Govind_3]

hi,
May b I am little late, anyways this is a known bug in IE5. Get the latest IE6, you shouldnot see this problem. Read the following link for more info.
http://www.astonisher.com/archives/bugnet/alerts/bugalert_81199.html
-Govind