Subject: accessing other directories with anonymous ftp

From: [email-masked]
Date: Wed, 26 Apr 1995 19:56:13 -0400 (EDT)

hi,

	i running wuarchive Version wu-2.4(4), everything works great;
with ~ftp pointing to /networking/ftp.

i am also running an http server; the main directory is /cwis/httpd,
and there's lots of docs i want people to access that is mounted on
/atg/stuff (all of these are different partitions with different
mount points, of course).  files on /atg/stuff have soft links in
/cwis/httpd.  

i'd like to allow folks to specify ftp://ftp.nyu.edu and have access
to /cwis/httpd and all of its links, including the files on /atg/stuff.
trouble is, anonymous ftp does a chroot, so it sees its own directory
and down; softlinks down there do not work.  anyone have a way of
making it work, or suggestions for another way?  i can't fit everything
on one disk, so that option is out.

					gary

---

From: [email-masked] (Patrick Salsbury)
Date: Thu, 27 Apr 95 10:52:22 PDT

-	i running wuarchive Version wu-2.4(4), everything works great;
-with ~ftp pointing to /networking/ftp.
-
-i am also running an http server; the main directory is /cwis/httpd,
-and there's lots of docs i want people to access that is mounted on
-/atg/stuff (all of these are different partitions with different
-mount points, of course).  files on /atg/stuff have soft links in
-/cwis/httpd.  
-
-i'd like to allow folks to specify ftp://ftp.nyu.edu and have access
-to /cwis/httpd and all of its links, including the files on /atg/stuff.
-trouble is, anonymous ftp does a chroot, so it sees its own directory
-and down; softlinks down there do not work.  anyone have a way of
-making it work, or suggestions for another way?  i can't fit everything
-on one disk, so that option is out.
-
-					gary
-
	I'm having just the opposite problem. I've installed ftp on a new
machine, and in testing, have found that the guest account can 'cd /' and get
out of the chroot and to the actual root directory!
	Anyone know what might be wrong? Obviously, it's something that needs
fixing before the new machine is unveiled.

	Thanks in advance!

Pat (Heading back to RTFM...)
-------------------------------------------------------------------------------
	  Patrick Salsbury 	              SCO/IXI/Visionware           
	Sys Admin/Webmaster                   330 Encinal Street
	Voice: 408-429-4529	             Santa Cruz, CA 95060
	 FAX: 408-427-5460	      X/UNIX/PC Integration Specialists
 Check out <A HREF="http://www.visionware.com/">The Visionware Homepage</A>

---

From: Vidiot <[email-masked]>
Date: Thu, 27 Apr 1995 13:26:14 -0500 (CDT)

Pat:

You have a sig without an e-mail address.

<	I'm having just the opposite problem. I've installed ftp on a new
<machine, and in testing, have found that the guest account can 'cd /' and get
<out of the chroot and to the actual root directory!

Did you set it up as a ftp guest type user or a real user?  I finally got
mine going and you need to make sure of some things.

In you ftpaccess file you need a couple of lines that contains:

class   local    real,guest  *
guestgroup guest

Of course you can expand upon the class.  I have the anonymous ftp login
set up for a remote class, so that I can limit the number of users.

You then need to set up the system /etc/password and /etc/group files:

passwd:

guest1:passwdgoeshere:5001:5000:Guest FTP account:/usr/ftp/./:/bin/false

group:

guest:*:5000:guest1

You need /bin/false in your /etc/shells file (or equivalent).

It works for me.  The user logs in and the chroot takes over.  If you try
logging in as a regular user, the process fails, since there isn't a shell
to use.

Hope this helps.

MB
-- 
System Administrator - Extrel FTMS - Madison WI.
e-mail: [email-masked]
phone: (608) 273-8262  fax: (608) 273-8719  voice-mail: (800) 426-6488 ext 6293
Visit - http://www.ftms.com/vidiot/  (Your link to the world of Star Trek)

---

From: [email-masked] (Patrick Salsbury)
Date: Thu, 27 Apr 95 12:04:37 PDT

-Pat:
-You have a sig without an e-mail address.
	That's because it's on the top of every message I send out. Why repeat
info? (Conserve bandwidth, and all that rot... ;^)  )

-<	I'm having just the opposite problem. I've installed ftp on a new
-<machine, and in testing, have found that the guest account can 'cd /' and get
-<out of the chroot and to the actual root directory!
-
-Did you set it up as a ftp guest type user or a real user?  I finally got
-mine going and you need to make sure of some things.
	Yeah, I had it working on another machine, but this is a new one. 

-You then need to set up the system /etc/password and /etc/group files:
-
-passwd:
-guest1:passwdgoeshere:5001:5000:Guest FTP account:/usr/ftp/./:/bin/false
	Had this.

-group:
-guest:*:5000:guest1
	That was the problem. I had created the group, but hadn't added the
account TO the group.

-Hope this helps.
-MB
--- 
-System Administrator - Extrel FTMS - Madison WI.
-e-mail: [email-masked]
-phone:(608) 273-8262  fax: (608) 273-8719  voice-mail: (800) 426-6488 ext 6293
-Visit - http://www.ftms.com/vidiot/  (Your link to the world of Star Trek)

	Very much so! Thanks a million! :)

Pat

---

From: Vidiot <[email-masked]>
Date: Thu, 27 Apr 1995 14:26:16 -0500 (CDT)

Pat:

<-You have a sig without an e-mail address.
<	That's because it's on the top of every message I send out. Why repeat
<info? (Conserve bandwidth, and all that rot... ;^)  )

On top of the message?  Not in the copy that I got.  It must get stripped out
from the display that I get.  SO, it may be there, I just don't see it.
It is much safer to put the e-mail address in the .sig.  

<-group:
<-guest:*:5000:guest1
<	That was the problem. I had created the group, but hadn't added the
<account TO the group.

The wu-ftpd software must not use the info in the password file to check on
the user.  It must only use the group file.  I guess we are used to not
putting the names in the /etc/group file.  I never do for normal Unix users.
BSD Unix (SunOS) compairs the name in the password file to the group number
and then gets the group name from the group file.  The wu-ftpd software must
not do that.

<-Hope this helps.
<
<	Very much so! Thanks a million! :)

No problem.  I was helped by this mailing list, so I could at least return the
favor.

MB

---

From: Vidiot <[email-masked]>
Date: Thu, 27 Apr 1995 14:50:08 -0500 (CDT)

Pat:

I have found the reason.  Here is part of the e-mail's headers:

Date: Thu, 27 Apr 95 12:04:37 PDT
Reply-To: [email-masked]
Sender: [email-masked]
From: [email-masked] (Patrick Salsbury)
To: [email-masked]
Cc: [email-masked]

You name is in the From: line, but the Reply-To: line takes precidence(?) over
the From: line.  That is why you should always include your e-mail address
as part of your signature.

MB