Subject: [387] Re: [386] Add restrictions to anonymous ftp access

From: [email-masked] (Daniel Melnechuk)
Date: Fri, 19 Aug 1994 15:05 -0400 (EDT)

Howard,

The basic feature of wu-ftpd that allows you to set up specific name login/password ftp access to a chroot'ed directory structure is called 'guestgroup'. When a ftp client connects and logs in as a specific username and password, wu-ftpd checks to see if the group the user is in is specified by the 'guestgroup' keyword in the 'ftpaccess' file. If so, wu-ftpd does a 'chroot()' call to the prefixed part of directory that comes before a '.' specified as the user's homedir in the password file. After the chroot, the user then has access to only that directory structure.

Important to note that the directory structure to support this needs to be set up as if it was an anonymous ftp directory structure.

Below are examples from the various files that need to be modified. The example sets up two logins, 'guest1' and 'guest2' that can ftp in and have access to their own home directory structure under '/ftp/guests'. The example adds restrictions in the 'ftphosts' file that 'guest1' must connect from 'host1.domain1.com' and 'guest2' from 'host2.domain2.com' - this is optional - defaults to connections from anywhere. The example also sets up a class in the 'ftpaccess' file for the guests called 'guestgroup' and then sets limits access to 10 users to times between 7:00AM through 7:00PM, Moday through Friday - this is optional - defaults to access anytime.

All this is contained in the documentation. While i have tried to make the examples accurate, they should serve as a guide along with the documentation. I will say that it does work, and well at that.

Example ftpaccess entry:
___________________________________________________________________________
guestgroup	ggroup
class	remoteguest	guest			host1.domain1.com
class	remoteguest	guest			host2.domain2.com
limit	remoteguest  10  Wk0700-1900        /opt/local/etc/ftpmsgs/msg.toomany
limit	remoteguest   0  SaSu|Any1900-0700  /opt/local/etc/ftpmsgs/msg.closed
___________________________________________________________________________

Example ftphosts entry for restricting access:
___________________________________________________________________________
allow   guest1             host1.domain1.com
allow   guest2             host2.domain2.com
___________________________________________________________________________

Example password entries for guestgroup users that would share the same chroot'ed directory structure:
___________________________________________________________________________
guest1:x:501:201::/ftp/guests/./home/guest1:/etc/ftponly
guest2:x:501:201::/ftp/guests/./home/guest2:/etc/ftponly
___________________________________________________________________________

Example group file entry for guestgroup 'ggroup':
___________________________________________________________________________
ggroup::201:
___________________________________________________________________________

Good luck.

Daniel Melnechuk                                          Intex Solutions, Inc.
Systems Administrator                                     35 Highland Circle
voice: 617-449-6222                                       Needham MA 02194
fax: 617-444-2318
[email-masked]

---

From: [email-masked] (Howard Yeung)
Date: Mon, 22 Aug 1994 10:27:31 +0500

Hi Daniel,

Thanks for your message.

I have the following settings in ftpaccess, /etc/group and /etc/passwd
files:

ftpguest:x:30001:556:Restricted Ftp:/opt/ftp/./private/larry:/etc/ftponly

ggroup::556:

guestgroup      ggroup
guestserver     athena.nchgr.nih.gov

However, when I login to the server and after I type in the login name, 
immediately I get a loin denied message.

If I took the 'ggroup' out from guestgroup, I can finish a normal login.
But I can 'cd' to parent directories.

Any help would be appreciated.

Howard Yeung
Unix Admin, NCHGR/NIH

-----screen capture-----
220-
220 athena.nchgr.nih.gov FTP server (Version wu-2.4(8) Thu Aug 4 13:59:46 EDT 1994) ready.
Name (athena:hyeung): ftpguest
530 User ftpguest access denied....
Login failed.
ftp> 
-----end----------------