Subject: Group controls not working

From: Neil Movold <[email-masked]>
Date: Thu, 27 Apr 1995 15:54:40 -0400 (EDT)

I have been following the instructions on Group Controls on page 80 of the
book "Managing INTERNET Information Services", but a few things don't work
the way they are mentioned.  I want to create a group and user that will 
allow the user to FTP into the system and be in a restricted directory, 
but not allow them to telnet into the same system.  The problems are as 
follows : 

1) it is mentioned that after creating the appropriate group in the 
   /etc/group file, that an entry in the /etc/passwd file can be made of 
   the following form :

		...:Guest FTP user:/users/guests/./guest1:/bin/false

   However, the sintax of the "/./" does not work and is ignored. The user
   still gets logged into the user's login directory instead of the the
   directory specified in the first pathname.

2) the shell "/bin/false" causes the account of the special user to be
   denied.  I want to be able to let the user ftp in but not telnet into
   my system.  I assume this is what the /bin/false does.  I tried 
   writing a restricted shell script in Perl which works great for the
   telnet restriction, but still gives me the same denied access when
   ftping in.

I am running on a Digital AXP system running OSF/1 V3.0b.  Everything 
compiled just fine and all other aspects of the server work as described 
in the book and documentation. 

If anyone has any suggestions, I look forward to hearing them.

		Neil :-)

                     \\\//
                     (o o)
------------------ooO-(_)-Ooo-----------------------------------------
Neil Movold                     Phone  : +1 809 296-1800      
Special Operations Consultant   Fax    : +1 809 295-7269     
 ( i.e. the guy who has to 
        make it all work :-) )
Internet (Bermuda) Limited      E-mail : [email-masked]     
P.O. Box HM2445
Hamilton, Bermuda
HM JX

---

From: Vidiot <[email-masked]>
Date: Thu, 27 Apr 1995 14:12:02 -0500 (CDT)

<1) it is mentioned that after creating the appropriate group in the 
<   /etc/group file, that an entry in the /etc/passwd file can be made of 
<   the following form :
<
<		...:Guest FTP user:/users/guests/./guest1:/bin/false
<
<   However, the sintax of the "/./" does not work and is ignored. The user
                 ^^^^^^
A sin tax? :-)

<   still gets logged into the user's login directory instead of the the
<   directory specified in the first pathname.

But, it does work and I have a system set up to prove it.

Where is /users/guests?  Is it in the configured ftp home area?  If not,
it could be the problem.  If your anonymous ftp area is, for example, /usr/ftp,
then your guests could be set up as: /usr/ftp/./guests/guest1

You would then have a real path of /usr/ftp/guests/guest1.  But, the guest
would only see /usr/ftp as / and start out in /guests/guest1.

<2) the shell "/bin/false" causes the account of the special user to be
<   denied.  I want to be able to let the user ftp in but not telnet into
<   my system.  I assume this is what the /bin/false does.  I tried 
<   writing a restricted shell script in Perl which works great for the
<   telnet restriction, but still gives me the same denied access when
<   ftping in.

Make sure that /bin/false is in your /etc/shells (or equivalent).  Until
I had it in mine, as well as a class for the guest group, I too was denied
access.

MB
-- 
System Administrator - Extrel FTMS - Madison WI.
e-mail: [email-masked]
phone: (608) 273-8262  fax: (608) 273-8719  voice-mail: (800) 426-6488 ext 6293
Visit - http://www.ftms.com/vidiot/  (Your link to the world of Star Trek)