ftpck:
WU-FTPD configuration checker

Last updated: June 23, 1997

What is ftpck ?
Current development status
What does it test ?
Getting ftpck
Installing ftpck
Running ftpck
Development Comments

What is ftpck

ftpck is utility to verify the various files required to run wu-ftpd.
Since the beginning, the only wu-ftpd configuration checker was "ckconfig". All it did was simply check to see if the needed files were where they had been specified in pathnames.h. Other than that, you had to look at the man pages, examples and the source code to try and figure out what was the proper syntax. In some cases, ftpaccess file directives were added but not listed in the man pages or READMEs.
ftpck is intended to check all files and fields in all the files to assure proper syntax. It checks to assure that all files referenced in the various wu-ftpd system files exist. It checks modes on files as well as modes on ftp directories specified.
This is a third developmental version and is finally nearing public release.
Please help me complete this. It has already pointed out errors in my configuration here and I'm sure it will help you as well. I need suggestions about what checks make sense and should be added. Also I need help deciding what should be listed as an ERROR: and what should be listed as a WARNING:. Please help me create a useful and complete wu-ftpd configuration checker for all to use.

Current development status

June 3, 1997: This has been cleaned up greatly with all ftpaccess records now being checked. There a only a couple checks still needed and we are entering the cleanup phase in preparation for release. It has not been converted to ANSI C yet. That is coming.
This was developed on Solaris 2.5 and there may be portability concerns. I hope not but if so, please send me any required patches and I'll add them.
I could use some help. Portability testing is what I need most.

What does it test ?

This list nearly complete. At present the following things are checked.
The following WU-FTPD configuration files being tested.
ftpaccess, ftpconversions, ftphosts, ftppidnames,
ftpgroups, ftpservers, ftpusers, xferlogs
Additionally, the _PATH_EXECPATH define, is checked as is the inetd.conf file.
The plan is to:

assure complete ftpaccess file checking is done,
final cleanup with manual page,
write a separate utility which checks permissions, modes, ownership, number of links, etc. of the individual ftp data directories. This utility is tenatively named auditftp.
Please send suggestions to kent@landfield.com concerning tests you would like to see done.

ftpaccess

The existence of the specified ftpaccess file is verified.
Modes on each of the specified ftpaccess files are checked to assure they are 0600.
In addition, each record in the file is verified.

alias directive

Improper number of fields
The Following checks can be compiled in or requested at runtime.

Checks if directory aliased exists for real users
Checks if directory aliased exists for anonymous users

autogroup directive

Improper number of fields
Groupname specified is a valid system group
Checks each "class" specified to assure it is a valid "class"

banner directive

Improper number of fields
Checks if banner message file exists

cdpath directive

Improper number of fields
The Following checks can be compiled in or requested at runtime.

Checks if directory aliased exists for real users
Checks if directory aliased exists for anonymous users

class directive

Improper number of fields
Verify there is a valid typelist specified
Verify the Domain and/or IP address globbing passed in

compress and tar directives

Improper number of fields
Invalid "yes/no" specified
Checks each "class" specified to assure it is a valid "class"

chmod, delete, overwrite, rename and umask directives

Improper number of fields
Invalid "yes/no" specified
Assures <typelist> is a comma-separated list of any of the keywords "anonymous", "guest" and "real".

deny directive

Improper number of fields
Checks for valid Address, domain or !nameserved
Checks to assure the message file exists

email directive

Improper number of fields

guestgroup directive

Improper number of fields
Groupnames specified are valid system groups

guestserver directive

Improper number of fields

limit directive

Improper number of fields
Check if valid class specified
Check <n> is a number
Valid <time> specified (valid_time TBD)
Message file exists in guest and real ftp directories

log directive

Improper number of fields
Checks both the `log transfers' and `log commands' entries.
Assures <typelist> is a comma-separated list of any of the
Checks directions

logfile directive (new virtual support directive)

Improper number of fields
Assure logfile exists at specified path

loginfails directive

Improper number of fields
content is a number

lslong and lsshort directives

Verify the specified executable exists

message directive

Improper number of fields
Check the <when> specified is valid
Verify any classes listed are valid system classes

noretrieve directive

Improper number of fields
Check the to assure the <filename> file is available

passwd-check directive

Improper number of fields
Check for <none|trivial|rfc822> validity
Check for <enforce|warn> validity

path-filter directive

Improper number of fields
Check typelist specified is valid
Verify message file path exists

private directive

Improper number of fields
Invalid "yes/no" specified
If "private yes" check to see if _PATH_PRIVATE exists

readme directive

Improper number of fields
Check the <when> is valid
Verify any classes listed are valid system classes

root directive (new virtual support directive)

Improper number of fields
Verify specified ftpd root data directory exists
Check to assure path is a directory.

shutdown directive

Improper number of fields

upload directive

Improper number of fields
Check to assure maximum of 7 arguments
Make sure <root-dir> matches the ftp user passwd file homedir
Check if ARG2 is yes/no
Validate dirs/nodirs
Assure the mode specified is sane
Assure any specified user has a passwd file entry
Assure any specified group has a group file entry

virtual directive

Improper number of fields
Make sure <addr> seems sane
Check if ARG1 is root/banner/logfile
Assure path exists (only from machine root)
Assure root path is a directory
Assure banner and logfiles are regular files

Also checks for invalid directives used in the ftpaccess files.

ftpconversions

The existence of the ftpconversions file is verified.
Modes on the ftpconversions file are checked to assure they are 0600.
Verify syntax of the ftpconversions file.
Verify specified external commands exist in the root.
Verify specified external commands exist in the anonymous area.
Verify 'types' specified are valid.
Verify 'options' specified are valid.

ftphosts

The existence of the ftphosts file is verified.
Modes on the ftphosts file are checked to assure they are 0600.
Verify syntax of the ftpgroups file.
Verify allow/deny keyword usage.
Verify valid domain and IP globbing specified.

ftppidnames

Checks the existence of the runtime pid file directory.

ftpgroups

The existence of the ftpgroups file is verified.
Modes on the ftpgroups file are checked to assure they are 0600.
Verify syntax of the ftpgroups file.
Make sure the groups specified are valid system groups.

ftpservers

The existence of the ftpservers file is verified if VIRTUAL_SERVER support compiled in.
Modes on the ftpservers file are checked to assure they are 0600.
Checks to assure all ftpaccess files specified in the ftpservers file exist.
All specified ftpaccess files are then themselves checked via the ftpaccess tests listed above.

ftpusers

The existence of the ftpusers file is verified.
Modes on the ftpusers file are checked to assure they are 0600.
Account names not longer than 8 characters.
Assure only one item per line.
Records are newline terminated.
Check root and all system accounts are in ftpusers file.

xferlogs

The existence of the xferlog files are verified. All xferlogs are checked if the site has indicated the use of virtual server support.
Modes on the xferlog file are checked to assure they are 0660.

_PATH_EXECPATH

Checks to assure you have not compiled WU-FTPD with _PATH_EXECPATH set to /bin, /usr/bin, /etc or /sbin. Doing so would open potential or real security holes onto your system.

inetd.conf

Check to assure the "-a" option is specified on the 'ftp' entry. Without it all ftpaccess functionality is disabled.

Getting ftpck

You can get the current snapshot of ftpck from ftp://ftp.landfield.com/wu-ftpd/ftpck/

Installing ftpck

As the distribution is configured, it needs to be unpacked under the wu-ftpd src/ directory. The tar/shar files will create a subdirectory ftpck.X.x. You will need to edit the Makefile in the ftpck directory and make sure things are right for your installation. It is setup to use your existing pathnames.h and config.h files.
You will want to check ftpck.h to assure the defines are appropriate for your local installation's policy.
Type make and build it. Test it from that directory. When you are satisfied it does the right things, type make install and then go verify your config.
Note: rdservers.c is not used unless you are one of the beta sites for my new way of doing virtual hosting. If so, make sure you put -DVIRTUAL_SERVER in the CFLAGS. If you are using the current virtual support then you do not need to do anything.

Running ftpck

usage: ftpck [ -ceFghprstuvx ] [-f accessfile]

With no options, all WU-FTPD configuration files are checked.
More than one set of checks can be specified at a time.

Options for checking default config files
  -c:             Check ftpconversions file at /tmp/ftpd/ftpconversions
  -f:             Check ftpaccess file at /tmp/ftpd/ftpaccess
  -g:             Check ftpgroups file at /tmp/ftpd/ftpgroups
  -h:             Check ftphosts file at /tmp/ftpd/ftphosts
  -p:             Check pid directory at /tmp/ftpd/ftp.pids-%s
  -s:             Check ftpservers file at /tmp/ftpd/ftpservers
  -u:             Check ftpusers file at /tmp/ftpd/ftpusers
  -x:             Check xferlog file at /tmp/ftpd/xferlog

Check named file options
  -C conversions: Check the specified ftpconversions file
  -F ftpaccess:   Check the specified ftpaccess file
  -G ftpgroups:   Check the specified ftpgroups file
  -H ftphosts:    Check the specified ftphosts file
  -S ftpservers:  Check the specified ftpservers file
  -U ftpusers:    Check the specified ftpusers file

Other options
  -a:             Verify aliases and cdpaths usable for
                  anonymous/virtual ftp users
  -d:             Turn on describe mode. (Very verbose) A
                  second -d enables accessfile line display
  -e:             Check _PATH_EXECPATH not == /bin
  -i:             Check inetd.conf file at /etc/inetd.conf
  -I inetd.conf:  Check the specified inetd.conf file
  -r:             Verify aliases and cdpaths usable for real systm users
  -v:             Produce verbose output

Please Note: The files specified in the above usage example represent the test location of the various WU-FTPD config files on my system. These paths are dependent on the specifications in the pathnames.h you use.

archive@landfield.com

ftpck:WU-FTPD configuration checker

Table of Contents

ftpck:
WU-FTPD configuration checker