Subject: Help with Groups

From: Mike Gonzalez <[email-masked]>
Date: Thu, 14 Sep 1995 22:04:44 -0600

Hello,
        I installed the wu_ftpd daemon on our Sun OS 4.1.3 and would like to know where I can find some good info on setting up groups, guests etc... There isn't must doc that comes with the ftpd package.

Thanks

--Mike Gonzalez
[email-masked]

---

From: Steve Jones <[email-masked]>
Date: Fri, 15 Sep 1995 09:03:24 -0400 (EDT)

>         I installed the wu_ftpd daemon on our Sun OS 4.1.3 and would like to know where I can find some good info on setting up groups, guests etc... There isn't must doc that comes with the ftpd p…

I have for some time practically begged for precisely that
bit of information and have gotten *no* responses at all
from this list.  If you get an answer, I'd be very grateful
if you let me in on the secret!

Thanks,

Steve Jones
CASE Tool Analyst
ANSYS, Inc.
VOX (412) 873-3067
FAX (412) 873-3118
[email-masked]

---

From: [email-masked] (Ketan Shah)
Date: Fri, 15 Sep 1995 09:36:21 -0400

Once you install the man pages.
do a man on ftpd, ftpaccess,  ftpcount, ftpshut, ftpconversion...
also within the wu-ftp dir there is a sub directory doc/examples
where some of the files have been setup.

Go to http://iss.net/~iss you will find sufficient info to get you thru the
basics.

I also suggest going thru the directories in wu-ftpd ...you will find more
stuff.

-- 
Ketan Shah ([email-masked])
	
Varimetrix Corporation
2350 Commerce Pk. Dr., No. 4
Palm Bay, FL 32905
Tel. No.(407)-676-3222

---

From: "Steve R. Harding" <[email-masked]>
Date: Fri, 15 Sep 1995 06:46:27 -0700 (PDT)

> > I installed the wu_ftpd daemon on our Sun OS 4.1.3 and would like to know
> > where I can find some good info on setting up groups, guests etc... 
> > There isn't must doc that comes with the ftpd package.
> > 
> > --Mike Gonzalez
> 

Chapter 5 of the O'Reilly & Assoc. book "Managing Internet Information 
Services" is all about setting up the wu-ftpd.  That, plus the man page on
ftpd was enough to get me going.

Of course, I _am_ subscribed to this list, which means I am _still_ 
having problems.  Yes, a faq or other set of docs would be good, but I 
don't think they exist.
-------------------------------------------------------------------------------
Steve Harding                                      Email: [email-masked]
TACTech, Inc.                                      Voice: (714) 974-7676 ext.15
Yorba Linda, CA

---

From: Steve Jones <[email-masked]>
Date: Fri, 15 Sep 1995 13:46:32 -0400 (EDT)

> having problems.  Yes, a faq or other set of docs would be good, but I 

Well, my message was a little caustic and not intended for
the list but I goofed.  I had meant to respond to Mike
privately; behind your backs, as it were ;^).  But it does
reflect a little of my frustration over this.  I wasn't sure
my questions were even being posted.

To recap, I've read the O'Reilly material (over and over),
I've read the manpages, I've scoured the net looking for
FAQs or whatever.  I've watched this list closely and have
seen posts by others asking the same question; I have asked.
But if the question is ever answered, it's not posted to the
list (someone *may* be responding off-list, but not to me).

I've still not seen a single, complete, *nominal* example of
how to set and *use* an account with special privileges
(groups ?).  I'm not trying to do anything fancy (yet).
Please, just one, full example?

My thanks to the kindly person who takes the time (I know
you're all busy),

Steve Jones
CASE Tool Analyst
ANSYS, Inc.
VOX (412) 873-3067
FAX (412) 873-3118
[email-masked]

---

From: "Steven K. Womble" <[email-masked]>
Date: Fri, 15 Sep 95 14:20:36 -0600

I recently posted this same question and have not heard back other than
from people that say "I've asked the same question, tell me if you find
out the answer." I did receive a message from someone who said he needed
more information and that autogroup was probably not needed, but I have
not heard back from him after giving him more information.

Maybe what we are trying to do what can't be done, but maybe myself and 
others haven't explained what we want in layman's terms. I'll assume the
latter, so here goes:

I have setup three users - Moe, Larry, and Curly. Each of these users'
primary group is named 'stooge'. The 'stooge' group is defined as a
guestgroup which gives Moe, Larry, and Curly restricted access to their
home directory called /numskulls.

Below the directory /numskulls there are three directories called
/numskulls/yuk-yuk, /numskulls/bad-hair, and /numskulls/poke-n-eye. 
Now I want to set up the users Moe, Larry, and Curly with different
accesses to these directories. Say, Moe with access to poke-n-eye and
bad-hair and no access to yuk-yuk. Larry with access to bad-hair and no
access to yuk-yuk and poke-n-eye. And Curly with access to yuk-yuk and 
no access to bad-hair and poke-n-eye.

Is this possible using the access permissions, user and group setups, 
and wu-ftpd capabilities? If this is not possible, myself and others 
will have to live with what we have. If it is, then I would like an
answer so that my superiors will stop bugging mw to fix this problem.

I hope this explains the problem myself and others want solved.

Steve
-------------------------------------------------------------------------
     Steve Womble                              [email-masked]

---

From: Michael Brennen <[email-masked]>
Date: Fri, 15 Sep 1995 15:35:33 -0500 (CDT)

> (groups ?).  I'm not trying to do anything fancy (yet).

I had a writeup on this a long time ago, but I think I dumped it.  I
oughta turn this into a GROUPS-LS-DIR-HOWTO type thing.

In faq, let's do that.  Please go over this thing carefully, as I may have
missed something crucial.  Correct any problems and add anything to it
that I left out and send all that back to me.  I'll put it in the master. 

In particular, send me anything that is OS specific that is not included
here.  Those are some of the most pesky posts on this list.  I run a linux
box, so I described that.  I also found a post that gave some help for
Solaris users.  Any specifics for Sun, SGI, AIX, Win95 (just seeing if
you're awake...) etc. are appreciated. 

Thanks,

Michael Brennen

**************************************************************************
The working example here will be as if it were a directory under a Web
tree, /home/web.  The Web account will be maintained remotely by FTP.  The
remote user is Mortimer.  Mortimer's account name is "mort", group
"client". 

(Yes, there is some droll humor here for the French speakers...)

1. Do the /etc hacks.  Create Mort's entry in /etc/passwd and add the 
   /etc/group entry.  (Or adduser or whatever you use.)  Add the 
   entries to /etc/ftpaccess.

/etc/passwd:
mort:*:403:400:Mortimer Snerd:/home/web/mort/./:/etc/ftponly
                                            ^^^
   The /./ sequence determines where the chroot() is done to.  If you 
   want the chroot() done to the web directory and a chdir() to mort,
   it would look like this:

mort:*:403:400:Mortimer Snerd:/home/web/./mort/:/etc/ftponly
                                       ^^^

   --------> (make sure "/etc/ftponly" is in /etc/shells.)

/etc/group:
client::400:mort

Set Mort's password as you wish, or better yet use S/KEY.

/etc/ftpaccess:
class   local   real,guest,anonymous ......
...                  ^^^^^
...                    +----------- define 'guest' in the proper classes;
...                                 this is site dependent.
...
...
delete     no   anonymous,guest               # delete permission?
overwrite  no   anonymous,guest               # overwrite permission?
rename     no   anonymous,guest               # rename permission?
chmod      no   anonymous,guest               # chmod permission?
umask      no   anonymous,guest               # umask permission?
...                       ^^^^^
...                         +------ decide if guest should be in this 
...                                 permission list; this is site dependent.
...
...
path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
...
guestgroup client
...

2. Create Mort's home directory and set its ownership and protections.

mkdir /home/web/mort

chown mort.client /home/web/mort

chmod 755 /home/web/mort

3. Build the directory structure under Mort's account.

cd /home/web/mort

mkdir etc bin [dev lib]   (dev and lib are optional and are OS dependent.)

chown root.daemon etc bin

chmod 111 etc bin

4. Build the contents of the ~/bin directory.

USE STATICALLY LINKED COPIES OF ALL UTILITIES IF POSSIBLE -- YOUR LIFE
(AND EVERYONE ELSE'S ON [email-masked]) WILL BE SIMPLER. 

cp /.../bin/ls bin

Optional for on the fly compression and tar:

cp /.../bin/gzip bin
cp /.../bin/tar  bin

If the utilities are not static, create the necessary devices in ~/dev and 
copy the necessary libraries into ~/lib.  Check the man page for ftpd that 
comes with your system; it may be of help.

5. Build the contents of the ~/etc directory.

Edit "passwd" to contain the following:

root:*:0:0::/:/etc/ftponly
mort:*:403:400::/home/web/mort/./:/etc/ftponly

Edit "group" to contain the following:

root::0:root
client::400:mort

chown root.daemon passwd group

chmod 444 passwd group

6. Add some extra security touches

cd /home/web/mort
touch .rhosts .forward
chown root.root .rhosts .forward
chmod 400 .rhosts .forward

You should now be the proud owner of a working guest group FTP login. 
Connect to the machine via FTP and login as "mort".  You should end up in
Mort's account with a current directory of "/".

If not, go over it carefully again, as there is a lot of detail here.  If
you still can't get it to work, yell for help on [email-masked]. 

**************************************************************************

OS DEPENDENCIES / QUIRKS

LINUX:

Linux does not need a ~/dev dir.  It does need the ~/lib dir if the
utilities in ~/bin are dynamically linked. 

Use the 'ldd' command to find out what libraries are necessary for a given
dynamically linked utility. 

SOLARIS: 

(This was culled from another post by Tom Leach to the wu-ftpd list.)

For people who are having problems with ls -al and dir on solaris 2.x
systems, you might try the following to find out what's missing... 

truss -f chroot ~ftp /bin/ls

This will run the ls command in the same chroot'd environment that
anonymous FTP runs in.  The truss will show you what
files/libraries/devices are accessed and where the ls is looking for them. 

Tom Leach
[email-masked]

**************************************************************************

For extra tips on security see Christopher Klaus's FAQ:

http://www.iss.net/iss/faq.html

**************************************************************************

If you run across some special trick required to get guest access to run
on your OS, or some security cleanup, please let me know and I will update
the master of this document. 

Don't contact me individually for help.  Go through the wu-ftpd list for
that and I will see the post there.

Michael Brennen
[email-masked]

---

From: Steve Jones <[email-masked]>
Date: Fri, 15 Sep 1995 17:04:55 -0400 (EDT)

> that I left out and send all that back to me.  I'll put it in the master. 

Halleleujah!! (sp?)

My hope is renewed!  I will give this a thorough spin!

On behalf of all the uninitiated,

   Thank You, Michael!!

[sorry for all the !'s]

Steve Jones
CASE Tool Analyst
ANSYS, Inc.
VOX (412) 873-3067
FAX (412) 873-3118
[email-masked]