Bug 771289

Summary:	The MinUID setting in /etc/pure-ftpd.conf should be 1000 instead of 500.
Product:	[Fedora] Fedora	Reporter:	Tom Bennet <tom-bennet>
Component:	pure-ftpd	Assignee:	Jaromír Cápík <jcapik>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	16	CC:	mi, ovasik
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pure-ftpd-1.0.35-2.fc16	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-03-21 19:11:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tom Bennet 2012-01-03 06:27:10 UTC

Description of problem:

Not much of a bug really.  A default configuration that might possibly have some negative security consequences.

The pure-ftp server configuration file /etc/pure-ftpd.conf contains a setting MinUID which blocks FTP access to low-numbered accounts.  In pure-ftpd-1.0.32-2.fc16.i686 which I just installed, the value of this parameter is 500.  This should probably be changed to 1000 to agree with current default value in /etc/login.defs.  Just in case someone has a lot of system accounts.

Thanks.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Fedora Admin XMLRPC Client 2012-01-11 10:35:19 UTC

This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

Comment 2 Jaromír Cápík 2012-03-13 15:40:05 UTC

Hello Tom.

My system has the UID_MIN set to 500. That's probably because of updating from older releases of Fedora. I'm unsure with the right approach now. Changing the value to 1000 is probably safer, but it will cause confusions and I'm sure some people will fill bugs against that. Anyway, I like safer world and thus gonna change that to 1000. We'll see how that ends up.

Thanks for reporting.

Regards,
Jaromir.

Comment 3 Fedora Update System 2012-03-13 17:59:45 UTC

pure-ftpd-1.0.35-2.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/pure-ftpd-1.0.35-2.fc16

Comment 4 Fedora Update System 2012-03-13 18:00:01 UTC

pure-ftpd-1.0.35-2.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/pure-ftpd-1.0.35-2.fc17

Comment 5 Fedora Update System 2012-03-15 02:31:52 UTC

Package pure-ftpd-1.0.35-2.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing pure-ftpd-1.0.35-2.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-3758/pure-ftpd-1.0.35-2.fc16
then log in and leave karma (feedback).

Comment 6 Fedora Update System 2012-03-21 19:11:00 UTC

pure-ftpd-1.0.35-2.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2012-04-22 03:34:39 UTC

pure-ftpd-1.0.35-2.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.