Re: Re: Wackamole and ProFTPd on FreeBSD

I did some further investigation of this by looking at the ProFTPd
source and I noticed the following comment in inet.c:

    * FreeBSD 2.2.6 (possibly other versions as well), has a security
    * "feature" which disallows SO_REUSEADDR from working if the socket
    * owners don't match.  The easiest thing to do is simply make
    * sure the socket is created as root.  (Note: this "feature" seems to
    * apply to _all_ BSDs.)

I then decided to see if I could reproduce this same behavior in a
program other than ProFTPd and outside of xinetd. I then installed
tcpserver which is from /usr/ports/sysutils/ucspi-tcp. This program
fails the same way that ProFTPd does. I first ran tcpserver against a
non-wackamole managed alias and it works fine:

    # tcpserver -v -1 192.168.0.19 0 sh
    51625
    tcpserver: status: 0/40

I then ran tcpserver against a wackamole managed alias:

    # tcpserver -v -1 192.168.0.20 0 sh
    tcpserver: fatal: unable to bind: address not available

Looking at the source for ucspi-tcp, in socket_bind.c sets the
SO_REUSEADDR option. I am running tcpserver as user root and wackamole
is also running as user root.

So, how do you find out the socket owners?

On Thu, Sep 08, 2005 at 09:12:10AM -0500, Eric L. Anderson wrote:
> On Wed, Sep 07, 2005 at 04:56:30PM -0400, Theo Schlossnagle wrote:
> > Eric L. Anderson wrote:
> > 
> > >On Wed, Sep 07, 2005 at 02:48:54PM -0400, Theo Schlossnagle wrote:
> > > 
> > >
> > >>Are you running proftpd stand alone or from inetd?  If you are running 
> > >>it standalone, start it, add 192.168.0.20, then try passive FTP.  It 
> > >>maybe that proftpd notes the lack of IP at startup and then refuses to 
> > >>"relearn" that the IP addres sis no available locally on the box.
> > >>   
> > >>
> > >
> > >We are running it in inetd mode from xinetd.
> > > 
> > >
> > If you assign multiple IP addresses manually can you make passive FTP 
> > connections via each of the IPs or only to one?
> 
> I configured two additional aliases manually via ifconfig and passive
> FTP works fine to both of them.
> 
> -- 
> Eric L. Anderson
> [email protected]
> 
> _______________________________________________
> wackamole-users mailing list
> [email protected]
> http://lists.backhand.org/mailman/listinfo/wackamole-users
> 

-- 
Eric L. Anderson
[email protected]