VSFTPD and GVFS security issue

Anarion.h · 2011-08-08 02:04:19

Hi!
I post this here because I don't know where to, maybe it should be done in those projects forums, but here is the deal.
I have recently set up an FTP server on my desktop computer, so I can access my files from anywhere in my notebook. Using AutoFS and Curl I have no problem. I login as my desktop user, and I see my $HOME as I should. everything is in order! I even enter from a web browser and everything looks as it should.

Then I tried using gvfs and run "gvfs-mount ftp://mothership.mulgore"[1] it asked for my user and password, as it should. But when I enter the folder that gvfs created I see de root file system of the other computer, I even get write access to al files there. I can edit all files, from /etc /boot and all that stuff that I shouldn't even be seeing!!

Any idea what's going on? has any got into something like this?
I don't get how could I log in to the FTP server as a common user and still get root access to all files!

[1]: that is the host name defined for my desktop PC in /etc/hosts

Kema01 · 2011-08-09 07:39:11

Have you configured vsftpd to jailbreak the user in there home folder and checked that "ftp root folder" isn't root on your system?

I haven't checked help files for vsftpd but there should be a option for that

Anarion.h · 2011-08-09 13:06:32

I don't quite understand the option you are talking about. BUT no matter what ftp client I use when you login you can only see the user's home dir. I've tried curlftp, web browser, a friend even used a windows client (don't know witch). When I use gvfs you can see the root dir!

wonder · 2011-08-09 13:14:41

@Anarion.h well, you can go to / as well from every ftp client, just move up in the directory. most ftp clients enter in the the home directory by default and that's why you cannot see it.

what are you experience is an improper configuration of vsftpd and has nothing to do with gvfs

Anarion.h · 2011-08-09 13:29:43

wonder wrote:

@Anarion.h well, you can go to / as well from every ftp client, just move up in the directory. most ftp clients enter in the the home directory by default and that's why you cannot see it.
what are you experience is an improper configuration of vsftpd and has nothing to do with gvfs

What I'm saying is that the configuration I did on vsftpd was such that no one could see the root file system. And THAT is consistent with every client I've used except from gvfs!

Arch Linux

#1 2011-08-08 02:04:19

VSFTPD and GVFS security issue

#2 2011-08-09 07:39:11

Re: VSFTPD and GVFS security issue

#3 2011-08-09 13:06:32

Re: VSFTPD and GVFS security issue

#4 2011-08-09 13:14:41

Re: VSFTPD and GVFS security issue

#5 2011-08-09 13:29:43

Re: VSFTPD and GVFS security issue

Board footer