Subject: RE: large numbers of classed anonymous users

From: [email-masked]
Date: Mon, 23 Jan 1995 13:56:33 -0800 (PST)

>I'm working to set up an ftp server for our customers, and the support
>people wish to have the archive divided such that customers can only get
>to subdirectories that correspond to the products that they're paying

Check out the 'guestgroup' directive in ftpaccess; it allows you to log in as a 
non-anonymous user, but you will be dropped into the middle of the directory as if you 
were in root (/); you can then maintain the directory tree from there on down.  Pay 
attention to protection and owner and group settings for security reasons; essentially 
set it up like the anonymous account, but in another directory tree location.

You will also need to put either a direct copy of 'ls' or a hard link to 'ls' into a 
./bin directory underneath the user's login directory, as well as tar or gzip/compress if 
you want to allow tar and compress on the fly.

You will also need to put a ./etc in the login directory with 'group' and 'passwd' files. 
This will give you owner and group names on the directory listings.

I have bin and etc set up with 0111 protections, owned by the user and user's group; 
files in bin are also 0111 protection, files in etc are 0444.  This means the user cannot 
see the files, and the files in bin cannot be copied; the files in etc can be copied if 
the user knows they are there, and the ones that can get into your system illegally will, 
so don't leave any valid information (passwd, login account, etc) other than the user 
name laying around in there.

Hope this helps - 

---------------
Michael Brennen                    Intecom, Inc.
[email-masked]               5057 Keller Springs
(214) 447-8074                     Dallas,  TX  75248

---

From: Anthony D'Atri <[email-masked]>
Date: Mon, 23 Jan 1995 12:32:20 -0800 (PST)

>Check out the 'guestgroup' directive in ftpaccess

That still requires that I add a couple of thousand entries to my normal
sitewide password/group database, though, doesn't it?