Subject: guestgroup Access

From: Kevin Brandich <[email-masked]>
Date: 23 May 96 17:32:52

I am considering using the guestgroup access (top level 'anonymous' 
like structure, with individual unique home directories below).  Here's my 
problem...I need to control access between the group members. Does 
that mean I need to keep a passwd file with root/ftp AND all the group
members ?? I'm not really keen on that - unless there is a way I can 
eliminate the users ability to 'see' the chroot'ed passwd file, is there ??
(Short of a major hack)

I don't want each user to have their own chroot'ed environment, but
I can't give them the ability to get each others files, any other suggestions??

---

From: "W. James Showalter" <[email-masked]>
Date: Thu, 23 May 1996 18:33:54 -0400 (EDT)

Kevin,

I believe that the guestgroup, just like anonymous, only uses /etc/passwd
and /etc/group files for the initial setup and subsequent file creation
operations.  The group and passwd files for the group members are just to
allow the groups and userids to be expanded when doing an ls -lg. So just
copy the password files to the locations without the password in them.  In
fact, all you need is the username and userid with colons to fill out the
proper number of fields.  This allows a mapping of username (alpahnumeric)
to userid (numeric).  The same is true for the group file.  Or if you
don't care about this mapping, then just eliminate them.  Then the user
will see numbers (the numeric ids) when doing ls -lg rather than names. 

When you create files, the real /etc/passwd is consulted, not the 
local guestgroup ones. 

To use guestgroup to keep access I would just have different userids in the
/etc/password file to share the *same* chroot directory but different 
home directory.  Each user can be in a different group as dictated by the
*real* /etc/passwd and /etc/group files.  For this scenario, you would 
only use a single copy of the passwd and group files for the new root.  
This would apply to all users under that root.

Shared groups can be accomplished by modifying the /etc/group file
with the desired usernames.

I hope this helps,
Jim