Subject: UPLOADS Area

From: [email-masked] (SARAO)
Date: Wed, 01 Mar 1995 10:08:56 -0500

Good morning,

        We are wondering how other people running FTP sites use their UPLOADS
area. Most of all do people use cron jobs to pull down the files left out 
there, do you allow access by users to go out on the UPLOADS area and pull 
down the files..? Do you scan files for viruses. Basically what we're 
looking for is how the industry handles file uploaded to your FTP site and 
how does and end user access the files....?

                                                        /Sarao
           ************************************************
           *    The lone wolf travels fastest.            *
           *                         -NN09-               *
           ************************************************

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Thu, 02 Mar 1995 10:24:30 +0000 (WET)

In a previous message, you wrote :

> down the files..? Do you scan files for viruses.

Since I think spreading illegal software via Internet is the biggest misuse
of Internet I'm very strict on the incoming dir. This site is very small
also, two people fill it.
The dir is rwx-wx-wt and owned by user root and group ftp. Files put in there
get owned by user root and group daemon and mode 600. Mkdirs are totally
disabled. Most other dangerous commands are also forbidden for anonymous
users.
Files that are in there have to be in there for a reason or else they get
deleted.

I also wrote a script which mails me a daily report of the ftp site usage,
with a detailed listing of the incoming anonymous files (the complete lines
from xferlog) and totals of outgoing anonymous files and realuser traffic.
It also creates a htmlpage of the traffic (anonymous totals only) and most
ftped files.

I got bitten once by illegal software via a dotspacetabwhatever subdir in
my incoming (previous version of wu-ftpd). Within 36 hours the ftpdisk was
filled until it's maximum.
The most sad thing was that when I mailed al the admins of domains from
which illegal files were transferred I got one or two responses like 'yeah,
so what ?'.

Sorry about ranting on but that's the idea. If people are interested in the
log-analyzing script I'll mail it or mail it to the list. You can view the
html-output at http://www.cetis.hvu.nl/ftpusage.html

                                                    Grtx. KH

-- 
| Koos van den Hout,     Unixer, Internetter                    and BBS SysOp |
| Home:[email-masked]      BBS Koos z'n Doos (+31-3402-36647 28k8 vfc) |
| Work:[email-masked] * finger [email-masked] for PGPkey * (+31-3402-56619 14k4) |
| URL: http://www.hvu.nl/users/koos  I'm looking for a lic.plate with RFC 822 |
|   GCS d- p(-) c++(+++) l+ u+++ e++ m+(-) s+/- !n h f+ g+ w(++) t+ r !y(*)   |

---

From: Juergen Christoffel <[email-masked]>
Date: Thu, 02 Mar 1995 14:14:08 +0100

Date: Wed, 01 Mar 1995 10:08:56 -0500
   From: [email-masked] (SARAO)

	   We are wondering how other people running FTP sites use
   their UPLOADS area. [...] Basically what we're looking for is how
   the industry handles file uploaded to your FTP site and how does
   and end user access the files....?

We're not "industry", but here's how we manage our uploads area:

To make sure our FTP filesystem won't get flooded by malicious guests,
we keep the /incoming directory in a small filesystem by itself which
is mounted into the "real" ftp filesystem. The /incoming directory is
monitored for space by a crontab job which deletes files based on age,
size and free capacity of the filesystem.

Uploads in /incoming get chown'ed and chmod'ed by the server so no
anonymous user may overwrite (e.g. implant trojan horses into existing
files) or even read the files (this prohibits anonymous sharing of
copyrighted software or other nasty things). Directories below
/incoming belong to various local users (and files uploaded therein
get chown'ed to their account) and thus local users can decide what
happens with files in their uploads directory. And there's the crontab
job mentioned above monitoring /incoming to make sure nobody forgets
to clean their directories.

	--jc