Subject: Restricting users on virtual servers

From: Jens Hamisch <[email-masked]>
Date: Sun, 11 Aug 1996 22:28:49 +0200 (MET DST)

Hello,

I've successfully installed wu-ftpd-2.4.2-academic-beta11 on our systems.
I'm using the VIRTUAL servers feature. This enables us providing single
FTP servers for allof our customers.

The only thing missing is a powerfull restriction of valid FTP logins on
these virtual servers. If user_a and user_b have different virtual servers
on the same machine, I don't want to enable user_b to log in to user_a's
virtual server with his account and password. This is required, because
different users are charged for the traffic of their ftp servers.

Therefore I've applied another patch to the FTPD. This patch introduces a
new token in the ftpaccess file:

	virtual aa.bb.cc.dd pass pass-file

assigning a password (style) file to the virtual FTP server at IP aa.bb.cc.dd.

Any user attempting to log in to the server is checked against the UID field
in this file. Access will only be granted, if the users name is found. There's
no evaluation of the remaining fields in that file.

I've appended my patch to this mail:

-----------------------------------------------------------

--- src/ftpd.c.orig	Sun Aug 11 11:36:08 1996
+++ src/ftpd.c	Sun Aug 11 15:44:57 1996
@@ -216,6 +216,7 @@
 char virtual_root[MAXPATHLEN];
 char virtual_banner[MAXPATHLEN];
 char virtual_logfile[MAXPATHLEN];
+char virtual_passfile[MAXPATHLEN];
 #endif
 
 int data;
@@ -379,6 +380,7 @@
 #ifdef VIRTUAL
       int virtual_len;
       int set;
+      virtual_passfile[0] = '\0';
 #endif
 
 #ifdef FACILITY
@@ -667,6 +669,8 @@
            strncpy(virtual_banner, ARG2, MAXPATHLEN);
          if(!strcmp(ARG1, "logfile")) 
            strncpy(virtual_logfile, ARG2, MAXPATHLEN);
+         if(!strcmp(ARG1, "pass")) 
+           strncpy(virtual_passfile, ARG2, MAXPATHLEN);
        }
       }
     }
@@ -840,6 +844,37 @@
     if ((p = getpwnam(name)) == NULL)
         return (p);
 #endif  /* M_UNIX */
+
+#ifdef VIRTUAL
+    if(virtual_mode) {
+	if( *virtual_passfile) {
+	    FILE *vpasswdf;
+	    if((FILE *) NULL != (vpasswdf = fopen( virtual_passfile, "r"))) {
+		char *vpassline, vpassbuf[ BUFSIZ];
+		char *vpasstok;
+		int found = 0;
+		while( !feof( vpasswdf) && !found) {
+		    vpassline = fgets( vpassbuf, BUFSIZ, vpasswdf);
+		    vpasstok = strtok( vpassline, ":");
+		    if( !strcmp( vpasstok, name))
+			found = 1;
+		}
+		fclose( vpasswdf);
+		if( !found) {
+		    syslog(LOG_NOTICE,
+			"VirtualFTP LOGIN REFUSED (name %s not in %s)",
+			name, virtual_passfile);
+		    return((struct passwd *) NULL);
+		}
+	    } else {
+		syslog(LOG_NOTICE,
+		    "VirtualFTP LOGIN REFUSED (passfile %s not found)",
+		    virtual_passfile); 
+		return((struct passwd *) NULL);
+	    }
+	}
+    }
+#endif
 
     if (save.pw_name)   free(save.pw_name);
     if (save.pw_gecos)  free(save.pw_gecos);
--- src/newvers.sh.orig	Sun Aug 11 15:49:09 1996
+++ src/newvers.sh	Sun Aug 11 15:50:23 1996
@@ -21,7 +21,7 @@
 if [ ! -r edit ]; then echo 0 > edit; fi
 touch edit
 awk '	{	edit = $1 + 1; }\
-END	{	printf "char version[] = \"Version wu-2.4.2-academ[BETA-11](%d) ", edit > "vers.c";\
+END	{	printf "char version[] = \"Version wu-2.4.2-academ[BETA-11.v1](%d) ", edit > "vers.c";\
 #LANG=
 #LC_TIME=
 		printf "%d\n", edit > "edit"; }' < edit

---------------------------------------------------------------

To install it:

    1.  save the patch in a file
    2.  unpack the wu-ftpd-2.4.2-academ-beta11 package
    3.  cd into the wu-ftp package root directory
    4.  install the patch using
	patch < <your_patch_file>
    5.	compile wu-ftpd as usual. Don't forget to turn on VIRTUAL support
    6.  add the new token to your ftpaccess file
    7.  enjoy ;-)

Notes:

    The ftp.pass file referenced in the ftpaccess should be of the same
    format as a /etc/passwd file, except that everything but the user
    name is void. 
    On some machines, the strcmp function may bounce if it is called with
    a NULL parameter. This will happen, if the strtok doesn't find a ':'.
    So the ftp.pass file at least should contain a ':' after all its
    user names.

    If you want to grant anonymous ftp access to the virtual server, the
    'user names' ftp and anonymous should occur in the ftp.pass file, too.

cu on the bitstream
-- Jens

--------------------------------------------------------------------------------
     /
 +##+|##+   STRAWBERRY                  Jens Hamisch
+v#+v v##+  EDV-Systeme GmbH            Managing director
/ v    v\v
| . .  . |  Brauneckweg 2               Car (Voice):  (+49 172) 81 04 162
|     .  |  D-82549 Koenigsdorf         Voice:        (+49 8179) 5278 Q, Fax
 | .     |                              Email:        [email-masked]
 \   .  /   Tel./Fax: (+49 8179) 5278                 [email-masked]
  \____/    [email-masked]   Home (Email): [email-masked]