Subject: Re: Giving users anonymouse ftp dirs

From: [email-masked] (Mark G. Lentczner)
Date: Wed, 28 Jun 1995 09:42:40 -0700 (PDT)

Folks-

Here is what I do on my system:  I need to offer the ability for some people
outside our local network to ftp files to and from our server.  We also offer
anonymous ftp.  We don't allow telnet or rlogin into the server.  Here is
how we set it up:

One time, we set up the following:

Add a new group 'ftpusers' to /etc/group:

	ftpusers::900:

Add the same group to the /etc/group file in the chroot'd ftp area (on my
system this is the file /home/ftp/etc/group):

	ftpusers:*:900:

Compile the program ftponly and put it in /bin.  ftponly is a small program
that simply prints out a warning banner and quits.  The entire source is:

	#include <stdio.h>

	int main()
	{
		printf("\n"
			   "*** \n"
			   "*** Your account is authorized for FTP access only.\n"
			   "*** \n"
			   "\n");
		exit(0);
	}

Add ftponly to the list of valid shells, in /etc/shells:

	/bin/ftponly

Add/Modify the ftpaccess file to support guest uses.  Here are my examples,
the first line must be verbatim, the others are based on your tastes.  You
might choose other options for logging and allowed operations for the extern
group as well...

	guestgroup	ftpusers
	class		extern guest *
	limit   	extern -1 Any /var/ftpd/msgs/msg.toomany
	message		/var/ftpd/msgs/welcome.msg login extern

To add a user:

The user, say 'fido', is added to /etc/passwd as follows:

	fido:*:901:900:Fido D. Dawg:/home/ftp/./home/fido:/bin/ftponly

where 901 is an new user number and 900 is the group 'ftpusers'.
Then a password is given to 'fido'.

In the ftp chroot area, (on my system /home/ftp), an entry is put in
/home/ftp/etc/passwd:

	fido:*:901:900:Fido D. Dawg:/home/fido:

In the ftp chroot area, the directories are created, chown'd and chmod'd
to the appropriate user, group and access privledges.  Here is a listing
part of a sample tree:

	/home/ftp:
	dr-xr-x--x   6 root     ftpusers     1024 Jun 20 15:55 home/

	/home/ftp/home:
	drwxr-xr-x   2 fido     ftpusers     1024 Jun 20 15:56 fido/
	drwx------   2 kitty    ftpusers     1024 Jun 27 15:31 kitty/

Note that the difference between fido's and kitty's directories is that
fido's is readable by the rest of the world (for example, the server
on the same machine has a symbolic link into fido's directory - this allows
fido to use ftp to maintain his web pages).  Kitty's, on the other hand,
is the only one that can get at the kitty directory.

-Mark

---

From: robert chea <[email-masked]>
Date: Wed, 28 Jun 1995 15:38:37 -0700 (PDT)

Mark,

Thanks for the tips on setting up chrooted guest accounts. I've followed your
instructions almost explicitly and i'm still having problems.  When i log in
as a guest, i'm chrooted alright, but i don't get the message that ftponly
is supposed to print, and i can't "put" any files.  i can mkdir alright.
anyways, any help would be greatly appreciated.

Robert

---

From: [email-masked] (Mark G. Lentczner)
Date: Wed, 28 Jun 1995 16:22:23 -0700 (PDT)

> anyways, any help would be greatly appreciated.

No, you only see that message if you actually try to log-in (console, telnet,
rlogin, etc) as that account on the system.  If you want a log-in message for
those accounts, see the message facility in ftpaccess.  Something like:

	message /var/ftpd/msgs/hello-ftp-only-folks	login extern

Where the file /var/ftpd/msgs/hello-ftp-only-folks has some nice welcome
message in it.

OOOOPS!  I forgot the upload enties you have to add, one per account:

	upload /home/ftp /home/fido yes fido ftpusers 0644 dirs
	upload /home/ftp /home/kitty yes kitty ftpusers 0600 dirs
	upload /home/ftp * no

Again, the difference 'tween fido and kitty is that we want everything fido
uploads to be visible, but kitty's files are to be shielded from view.

-Mark
 [email-masked]

---

From: robert chea <[email-masked]>
Date: Wed, 28 Jun 1995 18:58:05 -0700 (PDT)

Thanks Mark,

I've got my FTP setup done!!!

Robert Chea