Subject: Providing Upload Areas

From: "Steve Maybo" <[email-masked]>
Date: Fri, 28 Jul 1995 10:28:48 PST

FTP Administrators !!

I would like to get some feedback on policies that current wu-ftpd 
administrators set up when using an anonymous "incoming" area (an 
anonymous FTP directory that allows users "write" access).

We are a software developer that currently provides demos and
upgrades via anonymous FTP.  Many of our customer's have requested
that we provide an area on our anonymous FTP area that would allow
users to "put" related files there such as conversion utilities,
drivers, tips, etc.  I'm concerned that users that venture into this
"third-party" area would expect that our company is responsible for
making sure these third-party utilities,etc. work properly
regardless of how many disclaimers we force upon them when they
enter this area.

I'm concern that users could put utilities there that contain 
viruses that could either wipe out our UNIX box OR wipe out the 
customers system.

The wu-ftpd logs don't really give us a direct trace back to the 
person that loaded the file (unless they actually put in there "true" 
email address as their password)

I'm also concerned that users could try to put very large files in
there that would take up all our available space and possibly crash
our host.

I think a safer solution is to setup a separate FTP acount or a 
special anonymous password to direct them to another area where they 
could only "put" stuff.  Then our tech support dept could review the 
incoming file, scan for viruses, make sure it's a valid item, and 
move it to the anonymous area.

Then there is still the concern of users blaming us for the what the 
utility does regardless of how many disclaimers we have saying "we're 
not responsible".  Are we still legally responsible in some way since 
we are providing these files to users ??

....or should we have one of our customers setup this kind of
service on their own host and have them handle it.

Anyone know of any documents out there that talk anout this kind of 
issue (RFC, etc.)

Any thoughts/experiences you have on this are greatly appreciated.  
Sorry that this posting is really a "policy" type posting and not a 
"functional/technical" posting about wu-ftpd....so please send them 
directly to me if you feel this is not appropiate for the list.

Thank you.
* ------------------------------------------------------------*
     _/_/_/    _/_/_/   _/_/_/    Steve G. Maybo
    _/   _/     _/    _/          Network Systems Analyst
   _/_/_/      _/     _/_/_/      RESEARCH INFORMATION SYSTEMS
  _/   _/     _/          _/      email: [email-masked]
 _/    _/  _/_/_/   _/_/_/        WWW: http://www.risinc.com
* ------------------------------------------------------------*

---

From: John Andrea <[email-masked]>
Date: Sat, 29 Jul 1995 10:35:20 -0300 (ADT)

> there that would take up all our available space and possibly crash

You could limit inputs to an imcoming directory only,
and mount a separate filesystem over that directory.
Only that filesystem could be filled if someone decided to upload lots.

__________________________________________________________________
John Andrea                         St. Francis Xavier Univ.
University Computer Services        Antigonish, NS, CANADA B2G 2W5
http://www.stfx.ca/people/jandrea/