Subject: chrooting regular users in 2.4.2 Academ BETA 5?

From: "Chadwick A. Dubuque" <[email-masked]>
Date: Wed, 6 Sep 1995 12:06:52 -0500 (CDT)

I've looked through the source, and it appears that the rules have changed
from before as they pertained to chrooting users. I'd like it so that users
are chrooted according to their home, for instance:

/home/./cdubuque

would chroot me in the /home directory, but still set my $HOME to
/home/cdubuque. I'm pretty sure this worked in the past versions, but hasn't
been included in this version.

Note that this is for *REAL SYSTEM USERS*, not for users just set up in the
ftp files. So, the /etc/passwd file we're talking about is the real
//etc/passwd.

-- 
Chadwick A. Dubuque            [email-masked]
http://www.acm.ndsu.NoDak.edu/~cdubuque/   finger for PGP pub. key 
postal:USA/58105-5164/ND/Fargo/IACC 258 NDSU Box 5164/Chad Dubuque

---

From: "Chadwick A. Dubuque" <[email-masked]>
Date: Wed, 6 Sep 1995 12:21:30 -0500 (CDT)

> been included in this version.

Ooops, I guess this would make my $HOME just /cdubuque, but everything else
still stands. (Mental note: engage brain before typing...)

> ftp files. So, the /etc/passwd file we're talking about is the real

I'm pretty sure this is/was possible, wasn't it?

---

From: Chris Woods <[email-masked]>
Date: Wed, 6 Sep 1995 15:24:28 -0400 (EDT)

> been included in this version.

Works just fine. What we have done here is put all "real" users (i.e.,
customers) in a group, and "guestgroup" that group in /etc/ftpaccess,
chroot them to $HOME, put a statically-compiled `ls' in $HOME/bin, and it
works fine. 

There is no other way to chroot "real" users, without putting them into a 
separate group, and guestgrouping them. That has always been the only way 
to chroot() a user, as far as I know.

     Chris Woods     Senior System Administrator       USAinternet, Inc.
     GCS/CM/IT d- s++:+ a- C++++$ ULS++++$ P+++$>++++  L++++$ E W$ N+ !o
     K++ !w--- !O !M-- !V-- PS+? !PE !Y+>++ PGP+ t+@ !5 X !R tv? b+ DI++
     D+@ G++ e h---- r+++ y++++
     [email-masked]	      http://www.usa1.com	    508-774-4700

---

From: "Chadwick A. Dubuque" <[email-masked]>
Date: Thu, 7 Sep 1995 00:51:07 -0500 (CDT)

> > are chrooted according to their home, for instance:
[...]
> chroot them to $HOME, put a statically-compiled `ls' in $HOME/bin, and it

So, all these users being chrooted are in a group, say "ftponly", which is a
group in /etc/group, and then the line in the ftpaccess should read:

# specify which group of users will be treated as "guests".
guestgroup ftponly

Is there anything else in the /etc/ftp* files that needs to be changed? I've
done what's listed so far, and the thing still doesn't work right.

---

From: Chris Woods <[email-masked]>
Date: Thu, 7 Sep 1995 09:21:02 -0400 (EDT)

> done what's listed so far, and the thing still doesn't work right.

I didn't change anything else relevant. When you say "still doesn't work
right", does that mean that these guest users are not being chroot()'ed
properly, or that they cannot login at all via ftp, or what? Also, make
sure that you have a statically-compiled version of `ls', and any other
binaries you'll want the guests to have access to from ftp, like maybe
tar, gzip and compress. Note that `/bin/ls' is relative to the new $ROOT,
after the guest is chroot()'ed. For example, guestuser's /etc/passwd entry
looks something like: 

guestuser:*:6943:120:Guest User:/home/./guestuser:/etc/ftponly

(120 is defined as `ftponly' in /etc/group)

They're chroot'ed to /home, and chdir'ed to /home/guestuser. In this case,
there must be a /home/bin/ls, and preferably statically-compiled, unless
you want to get all the necessary runtime libs and put them into
/home/lib, and also create /home/dev/zero, /home/usr/lib, etc. I tried
that at first, but I could _not_ get a directory listing, since one of the
libs apparently necessary was libdl, which I could *not* find for linux.
So I compiled ls statically, and everything works.