> Assume now that I have a tcp wrapper that does the chroot for ftpd > _whenever_ it's invoked. This is true for non-anonymous as well as > anonyous logins; it happens before the ftpd is ever exec'ed. > Furthermore, assume that the chrooted-to volume is mounted > nosuid,nodev. Can a trojaned ftpd be used to compromise or harm the > system outside of the ftp hierarchy? If your ftpd can authenticate users while locked into the chrooted volume, and you're not using kerberos or something, then user passwords have to be stored in the chrooted area where ftpd can read them. USER root PASS NULL PORT .... RETR /etc/shadow ... or whatever Now you've got something to start cracking on. If you add kerberos, I think that may fix things. -- Tom Fitzgerald Wang Labs Lowell MA, USA 1-508-967-5278 fitz@wang.com Pardon me, I'm lost, can you direct me to the information superhighway?