

X-DeFrom [email-masked] Fri Jan 27 14:39:08 1995
Date: Fri, 27 Jan 1995 16:38:57 -0500 (EST)
From: David Dombek <[email-masked]>
Subject: RE: large numbers of classed anonymous users
To: [email-masked], [email-masked]
Cc: [email-masked], [email-masked]
Reply-to: [email-masked]
Status: RO

Is the below saying that every time I want a user to see a specific area
of the file system that is unique, I need to define the entire chroot 
structure?  If I want 5 distinct areas of login I will need the same
tree structure of /bin, /etc /dev /pub for each area?????

On Mon, 23 Jan 1995 [email-masked] wrote:

> >I'm working to set up an ftp server for our customers, and the support
> >people wish to have the archive divided such that customers can only get
> >to subdirectories that correspond to the products that they're paying
> 
> Check out the 'guestgroup' directive in ftpaccess; it allows you to log in as a 
> non-anonymous user, but you will be dropped into the middle of the directory as if you 
> were in root (/); you can then maintain the directory tree from there on down.  Pay 
> attention to protection and owner and group settings for security reasons; essentially 
> set it up like the anonymous account, but in another directory tree location.
> 
> You will also need to put either a direct copy of 'ls' or a hard link to 'ls' into a 
> ./bin directory underneath the user's login directory, as well as tar or gzip/compress if 
> you want to allow tar and compress on the fly.
> 
> You will also need to put a ./etc in the login directory with 'group' and 'passwd' files. 
> This will give you owner and group names on the directory listings.
> 
> I have bin and etc set up with 0111 protections, owned by the user and user's group; 
> files in bin are also 0111 protection, files in etc are 0444.  This means the user cannot 
> see the files, and the files in bin cannot be copied; the files in etc can be copied if 
> the user knows they are there, and the ones that can get into your system illegally will, 
> so don't leave any valid information (passwd, login account, etc) other than the user 
> name laying around in there.
> 
> Hope this helps - 
> 
> ---------------
> Michael Brennen                    Intecom, Inc.
> [email-masked]               5057 Keller Springs
> (214) 447-8074                     Dallas,  TX  75248
> 
>