Debian wu-ftpd package notes +--------------------------+ You can read more about how to set up (configure) wu-ftpd in the /etc/wu-ftpd/README file. In the case where ftp-only accounts are required on the system, it is common practice to set the users shell in /etc/passwd to something that is not contained in /etc/shells (for example: /etc/ftponly). The default PAM configuration that ships with wu-ftpd disallows logins without a valid shell. To allow these logins, simply remove the line referring to pam_shells.so in /etc/pam.d/wu-ftpd. If you don't have the proper libnss_files.so.X library installed in ~ftp/lib directory, owned by root, and with permissions of 444 (r--r--r--), anonymous FTP users will only see UID and GID numbers, instead of names. It is not installed by default, since there is no easy way to find out what version we need to install. If you have any additional commands in ~ftp/bin or ~ftp/bin/ftp-exec, you should make sure that they are up to date, and that the libraries they use are present, and in sync with your other system libraries. A check for this will automatically be performed in the future. Jason Gunthorpe provided a sample awk script to make wu-ftpd xferlog output usable by webalizer or analog: awk '{if (length($3) != 2) $3 = "0" $3;\ print $7 " - - [" $3 "/" $2 "/" $5 ":" $4 "] \"GET " $9 \ " HTTP/1.0\" 200 " $8}' /var/log/wu-ftpd/xferlog.0 Here's Gregory A. Lundberg's , one of the main wu-ftpd upstream developers, opinion of wtmp logging: Date: Wed, 4 Aug 1999 10:53:53 -0400 From: Gregory A Lundberg To: WU-FTPD Questions , WU-FTPD Discussion List , Josip Rodin , Chris Butler , WU-FTPD Development Group Subject: Why wtmp is bad These are my parting thoughts on src/logwtmp.c and wtmp logging ... Many administrators like to see FTP logins when they run the last(1) command. On most unix systems, this is implemented using the wtmp file (usually named /var/run/wtmp). The wtmp file records login/logout (and other activity, such as system shutdown and reboot) by appending a record to the end of the file. This can be problematic, especially for the WU-FTPD daemon. Some platforms, notably Solaris, traditionally have problems with wtmp logging and the last(1) command. For Solaris, steps have been taken to mitigate (but not necessarily solve) these problems in WU-FTPD. If you are using wtmp logging on Solaris, you MUST ensure you have applied all available patches. (Even then, I'm told, it is possible you will have intermitent problems with the last(1) command.) To append to the wtmp file, one opens the file with O_APPEND. This can lead to corruption if the file is mounted via NFS (or any other filesystem which does not directly support appending). In this case, the system must synthesize the effect of O_APPEND, which leads to a race condition resulting in file corruption. For this reason, if you are using wtmp logging, you MUST ensure the wtmp file is on a local filesystem. The wtmp file grows without bounds. Therefore, on a well-run server, it will occassionally be cleaned out. In general, there are two methods by which the file is cleared: mv/touch and cp/cat. Both methods suffer from race conditions which can lead to loss of information. In most cases, the window for this race is very small (a fraction of a second); the resulting information loss will occur very infrequently and will probably be unnoticed. This problem is worse with the WU-FTPD daemon; the probability of information loss is substantially higher. The WU-FTPD daemon uses chroot(2) to increase security for guest and anonymous users. The login record is written prior to the chroot(2). Unfortunately, the logout record can only be written afterward. To enable the daemon to write the logout record, the wtmp file is openned at the beginning of the FTP session and remains open for the duration. For systems using mv/touch clearing, which results in a new wtmp file being created and the old one being deleted, this significantly increases the window for information loss during wtmp clearing (from a fraction of a second to minutes or even hours). For maximum reliability, you MUST use cp/cat (emptying the file without recreating it) to clear the file. One effect of this workarround to the problem of wtmp logging while chroot'ing is the WU-FTPD daemon uses slightly more system resources (a file handle and associated buffers) than would otherwise be necessary. If your server is especially busy, or close to kernel limits, you should consider disabling wtmp logging as a means of reducing the resource utilization of the daemon. I generally set up FTP servers to run as unattended standalone machines. On these machines, the last(1) command is unnecessary. In addition, FTP activity is forwarded to my system log hosts via syslog(3). When historical login/logout information is desired, I generate it by scanning the system logs. Therefore, no wtmp logging is ever needed. I disable it using the -W command-line switch. I recommend you examine your own needs concerning wtmp logging. -- Gregory A Lundberg WU-FTPD Development Group 1441 Elmdale Drive lundberg@wu-ftpd.org Kettering, OH 45409-1615 USA 1-800-809-2195 * end * -- Josip Rodin, Tue, 14 Mar 2000 18:39:00 +0100 Chris Butler, Fri, 10 Mar 2000 16:24:06 +0000