RE: How do I force an FTP user to '/home/ftpdir'?

["Kurt Goolsbee" <kurt.goolsbee@xxxxxxxxxxxxx>]

The discussion has so far just been dealing with change directory.  However
you must do path validation on all request options that supply a path name. 
This: 
cd /home/ftpdir
mget *

Is that same as this:
mget /home/ftpdir/*

Kurt

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Monday, February 21, 2005 7:59 AM
To: Midrange Systems Technical Discussion
Subject: Re: How do I force an FTP user to '/home/ftpdir'?

Tom,

Two area's of concern. 
QIBM_QTMF_SVR_LOGON  Will be where you set initial directory.
QIBM_QTMF_SERVER_REQ will be where you make sure that they do not go to 
another directory.  Beware of a patch I need to make to my version, (as 
pointed out on this list).  If you lock them down to a directory 
/ftp/customer123/upload/*, the hack would be 
/ftp/customer123/upload/../../customer456/upload
It was suggested that I actually do the CD and then just check the 
resultant directory against what directory was intended.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.