Subject: Setting of further guest ftp-accounts - looking for more info

From: "wuftpd - adee.net" <[email-masked]>
Date: Mon, 25 Sep 1995 00:20:03 +0100

Hi,

I have problems to set guest ftp-accounts (wu-ftpd-2.4/Solaris 2.4/SPARC).
It simply does not work ("530 User guest1 access denied...").
The anonymous/ftp account works fine.

I already red few times the 'Managing INTERNET Information Services'
and tried many times different entries to find out what I am doing wrong,
but I was not successfull and did not find anything.

Where could I find more details or a kind of "cookbook" for setting
such further guest accounts? Does a kind of FAQ exist?

Thank you in advance for your help!

rgds, Mark Schneider

---

From: [email-masked]
Date: Mon, 25 Sep 1995 09:45:15 +0100

Hi,

I am new to this list so escuse me if I ask already asked questions.

I have problems to set guest ftp-accounts (wu-ftpd-2.4 on SunOS 4.1.4)
It simply does not work ("530 User guest1 access denied...").

Where can I find more information to solve this problem.

Thanks in advance.

Catherine.
--
Catherine Chat, INRIA Rocquencourt, Direction du Developpement, bat 25, 
BP 105, 78153 LE CHESNAY cedex, FRANCE

---

From: Michael Brennen <[email-masked]>
Date: Mon, 25 Sep 1995 10:25:22 -0500 (CDT)

Just for the record to the wu-ftpd list, any time a guest account help
request comes across I will turn a copy of my recent guest account howto
around to them.

Please look the howto over for specific OS tips (esp. Sun/Solaris /dev 
and /lib requirements) that could be added to make it more complete.

Michael Brennen

> Where can I find more information to solve this problem.

**************************************************************************
The working example here will be as if it were a directory under a Web
tree, /home/web.  The Web account will be maintained remotely by FTP.  The
remote user is Mortimer.  Mortimer's account name is "mort", group
"client". 

(Yes, there is some droll humor here for the French speakers...)

1. Do the /etc hacks.  Create Mort's entry in /etc/passwd and add the 
   /etc/group entry.  (Or adduser or whatever you use.)  Add the 
   entries to /etc/ftpaccess.

/etc/passwd:
mort:*:403:400:Mortimer Snerd:/home/web/mort/./:/etc/ftponly
                                            ^^^
   The /./ sequence determines where the chroot() is done to.  If you 
   want the chroot() done to the web directory and a chdir() to mort,
   it would look like this:

mort:*:403:400:Mortimer Snerd:/home/web/./mort/:/etc/ftponly
                                       ^^^

   --------> (make sure "/etc/ftponly" is in /etc/shells.)

/etc/group:
client::400:mort

Set Mort's password as you wish, or better yet use S/KEY.

If you are using the Beta version of ftpd (HIGHLY RECOMMENDED) that
Stan Barber has put together, you must do one of two thing to properly
use /etc/ftpaccess:

1)  compile the source to use /etc/ftpaccess by default (comes turned off);
    hack the source to set use_accessfile = 1;

OR

2)  run the daemon with the -a option.

/etc/ftpaccess:
class   local   real,guest,anonymous ......
...                  ^^^^^
...                    +----------- define 'guest' in the proper classes;
...                                 this is site dependent.
...
...
delete     no   anonymous,guest               # delete permission?
overwrite  no   anonymous,guest               # overwrite permission?
rename     no   anonymous,guest               # rename permission?
chmod      no   anonymous,guest               # chmod permission?
umask      no   anonymous,guest               # umask permission?
...                       ^^^^^
...                         +------ decide if guest should be in this 
...                                 permission list; this is site dependent.
...
...
path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
...
guestgroup client
...

2. Create Mort's home directory and set its ownership and protections.

mkdir /home/web/mort

chown mort.client /home/web/mort

chmod 755 /home/web/mort

3. Build the directory structure under Mort's account.

cd /home/web/mort

mkdir etc bin [dev lib]   (dev and lib are optional and are OS dependent.)

chown root.daemon etc bin

chmod 111 etc bin

4. Build the contents of the ~/bin directory.

USE STATICALLY LINKED COPIES OF ALL UTILITIES IF POSSIBLE -- YOUR LIFE
(AND EVERYONE ELSE'S ON [email-masked]) WILL BE SIMPLER. 

cp /.../bin/ls bin
chown root.bin bin/ls
chmod 111 bin/ls

Optional for on the fly compression and tar:

cp /.../bin/gzip bin
cp /.../bin/tar  bin
chown root.bin bin/gzip
chown root.bin bin/tar
chmod 111 bin/gzip
chmod 111 bin/tar

If the utilities are not static, create the necessary devices in ~/dev and 
copy the necessary libraries into ~/lib.  Check the man page for ftpd that 
comes with your system; it may be of help.

REGARDING HARD AND SOFT/SYMBOLIC LINKS:

The chroot() obviates the use of soft links in this case.  However, it
it is possible to make these hard links back to the master copy of the
utilities rather than copies.  This can save some disk space if that is
a concern.

5. Build the contents of the ~/etc directory.

Edit "passwd" to contain the following:

root:*:0:0::/:/etc/ftponly
mort:*:403:400::/home/web/mort/./:/etc/ftponly

Edit "group" to contain the following:

root::0:root
client::400:mort

chown root.daemon passwd group

chmod 444 passwd group

6. Add some extra security touches

cd /home/web/mort
touch .rhosts .forward
chown root.root .rhosts .forward
chmod 400 .rhosts .forward

You should now be the proud owner of a working guest group FTP login. 
Connect to the machine via FTP and login as "mort".  You should end up in
Mort's account with a current directory of "/".

If not, go over it carefully again, as there is a lot of detail here.  If
you still can't get it to work, yell for help on [email-masked]. 

**************************************************************************

OS DEPENDENCIES / QUIRKS

LINUX:

Linux does not need a ~/dev dir.  It does need the ~/lib dir if the
utilities in ~/bin are dynamically linked. 

Use the 'ldd' command to find out what libraries are necessary for a given
dynamically linked utility. 

SOLARIS: 

(This was culled from another post by Tom Leach to the wu-ftpd list.)

For people who are having problems with ls -al and dir on solaris 2.x
systems, you might try the following to find out what's missing... 

truss -f chroot ~ftp /bin/ls

This will run the ls command in the same chroot'd environment that
anonymous FTP runs in.  The truss will show you what
files/libraries/devices are accessed and where the ls is looking for them. 

Tom Leach
[email-masked]

**************************************************************************

For extra tips on security see Christopher Klaus's FAQ:

http://www.iss.net/iss/faq.html

**************************************************************************

If you run across some special trick required to get guest access to run
on your OS, or some security cleanup, please let me know and I will update
the master of this document. 

Don't contact me individually for help.  Go through the wu-ftpd list for
that and I will see the post there.

Michael Brennen
[email-masked]