Tiger Server: usuarios sin permisos lo ven TODO por FTP

[emegezeta]

La "solución" o más bien el parche está aquí (funcionar, funciona. Lo he probado)






Re: FTP Security Disaster
Posted: Apr 25, 2007 5:51 AM in response to: webjedi
Reply Email

Well, after I tested this, I can tell you what happened.

The 2007-004 Security Update replaced the http://ftp.plist in /System/Library/LaunchDaemons from Mac OS X server with the version from Mac OS X *Client*. There is no check in the installer if the update installs on client or Server, and it is the same update for both.

But, of course, FTP services on client and server are *very* different. With the client http://ftp.plist from client on the server, it is ftpd which is launched, not xftpd.

The solution is to replace the http://ftp.plist with a previous version from Mac OS X Server. If you don't have it, here is its content :

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.apple.xftpd</string>
<key>Program</key>
<string>/usr/libexec/xftpd</string>
<key>ProgramArguments</key>
<array>
<string>xftpd</string>
<string>-a</string>
</array>
<key>Sockets</key>
<dict>
<key>Listeners</key>
<dict>
<key>SockPassive</key>
<true/>
<key>SockServiceName</key>
<string>ftp</string>
<key>SockType</key>
<string>SOCK_STREAM</string>
</dict>
</dict>
<key>inetdCompatibility</key>
<dict>
<key>Wait</key>
<false/>
</dict>
</dict>
</plist>

Restart the server (relaunching the FTP service is not enough), and you should be up and running.