Subject: RE: Many unanswered questions

From: [email-masked]
Date: Tue, 28 Mar 95 16:59:06 PST

Looks to me like you've got the basics figured out.

>I have several questions that are driving me crazy.  Here goes:
>
>1) When I've set up an anonymous user with the following line:
>
>ftp:*:20004:20000:Anonymous FTP Account:/opt/net/anonftp/./pub:/bin/false
>
>I would think that when I log in, I would be automatically placed in
>the "pub" directory.  Shouldn't I be able to "cd .." from here and see
>everything else in my "root" directory of /opt/net/anonftp.  When I
>"cd .." it keeps me in /pub.

I know I have seen this on one of my file systems, that it kept me in /pub; by now I can't 
reproduce it.  On my present 1.2.1 Linux, cd .. does work.  Don't know how to explain the 
difference, as I can't reproduce.

>2) I am really confused about guest users.  Being that this is one
>of the 3 types of users defined in the ftpaccess file it must be 
>important.  
>
>	- Is a guest user a user that can only use ftp but can't 
>	  log in?

True if you give a bogus shell; with a real shell a guest user can log in.  Think of it as a 
cross between real and anonymous FTP.  You use a name and password to gain access to a 
restricted part of the file tree (thus something like a real user), but you are chroot()ed 
into the tree so you are restricted to one area only (thus like anonymous).

>	- How do I define a guest user in the passwd file and in
>	  the ftpaccess file?

Just like below...   :-)

>-------------------------
>In an attempt to understand how to define a guest user I've done the
>following:
>
>/etc/passwd:
>guest:Encryped PW HERE:20005:20000:Guest FTP Account:/opt/net/guest/./pub:/bin/false
>
>/etc/shells:
>/bin/false
>
>/etc/group:
>ftponly:*:20000:
>
>ftpaccess:
>guestgroup ftponly
>------------------------
>This disallows logins to guest and gives the following message in 
>/var/adm/messages:
>
>Mar 28 17:14:56 nexus ftpd[27548]: FTP LOGIN REFUSED (bad shell) FROM chaos [IP Addr here], 
guest
                                                       ^^^^^^^^^

This is where to start looking.  I'll have to think about this.  In the meantime try 
changing to '/etc/ftponly' in the /etc/shells and /etc/passwd files - the file does not have 
to exist.  Does that work any differently?

Next post you might indicate your OS, etc.  Hope some of this helps -

Michael

---

From: [email-masked]
Date: Wed, 29 Mar 1995 08:16:16 +0200

rh>
rh>I have several questions that are driving me crazy.  Here goes:
rh>
rh>1) When I've set up an anonymous user with the following line:
rh>
rh>ftp:*:20004:20000:Anonymous FTP Account:/opt/net/anonftp/./pub:/bin/false
rh>
rh>I would think that when I log in, I would be automatically placed in
rh>the "pub" directory.  Shouldn't I be able to "cd .." from here and see
rh>everything else in my "root" directory of /opt/net/anonftp.  When I
rh>"cd .." it keeps me in /pub.

No. You are trying to use a guestgroup feature (/chroot-path/./cd-path)
for anonymous. In the anonymous case the complete path will be used
as a chroot-path.

rh>
rh>2) I am really confused about guest users.  Being that this is one
rh>of the 3 types of users defined in the ftpaccess file it must be 
rh>important.  
rh>
rh>	- Is a guest user a user that can only use ftp but can't 
rh>	  log in?
rh>	- How do I define a guest user in the passwd file and in
rh>	  the ftpaccess file?
rh>-------------------------
rh>In an attempt to understand how to define a guest user I've done the
rh>following:
rh>
rh>/etc/passwd:
rh>guest:Encryped PW HERE:20005:20000:Guest FTP Account:/opt/net/guest/./pub:/bin/false
rh>
rh>/etc/shells:
rh>/bin/false
rh>
rh>/etc/group:
rh>ftponly:*:20000:
rh>
rh>ftpaccess:
rh>guestgroup ftponly
rh>------------------------
rh>This disallows logins to guest and gives the following message in 
rh>/var/adm/messages:
rh>
rh>Mar 28 17:14:56 nexus ftpd[27548]: FTP LOGIN REFUSED (bad shell) FROM chaos [IP Addr here], guest
rh>
rh>
rh>

Looks OK, but I don't know whether you can use the same group for ftp
(anonymous) as for a guestgroup. Try to give the guestgroup a group of
it's own. This also gives you more options playing with permissions.

I hope this helps.

Ronald.

__
// Ronald Hello  ([email-masked])
// University of Twente
// Department of Computer Science
// The Netherlands