Subject: Re: setting up guestgroups

From: [email-masked]
Date: Thu, 19 Sep 96 12:14:32 edt

Hi,
     
     I am trying to do something similar(?) to this also with no luck. We 
     need the ability for a real user to ftp and be given a specific path
     as "/". They would need the capability to "cd /Down/Deeper" within
     the path they are assigned, but not be able to do a "cd ../higher"
     or "cd /somewhere/else". Has anyone listening implemented this 
     scenario and if so be willing to instruct me on how to set it up?
     
     Thanks in advance,
     
     Greg Piney
     The McGraw-Hill Companies

______________________________ Reply Separator _________________________________
Subject: setting up guestgroups
Author:  [email-masked] at CCNODE
Date:    09/19/96 12:07 PM

Hi there.  I'm hoping somebody can help me with my problem.  Here's what I want 
to do:  ftp to my anonymous ftp server but log 
in using a specific userid and password (non-anonymous) yet have the ftpd do the
     
chroot and other good stuff that wuftpd provides.  So I believe I need to setup 
a guestgroup in my wu-ftpd server.  
     
I'm trying to follow the guest-howto page but after ftping in as the user, I do 
a 'pwd' and it didn't say '/', instead it had the full path of the user's home 
directory and I was able to cd back to other directories that I shouldn't have 
access to.  So there is something wrong in my setup.  I have some questions 
about the guest-howto:
     
 1. step 1 says to make changes to /etc/passwd, /etc/group and add 
  entries to /etc/ftpaccess.
     
  question:  Are you referring to the actual system /etc/passwd 
   and group files?  So there's going to be 2 passwd and 
   group files (one for the system and one in the 
   userid's home directory/etc/, correct?)
     
   Also, I don't have 'ftponly'.  Could I use
   /bin/false or /bin/true instead?  I only want this user 
   to ftp, no telnet, etc.
     
 2. step 2 says to compile the source to use /etc/ftpaccess by default or
  to run the daemon with the -a option.
     
  question:  Since I can't compile the source, how do I run the
   daemon with the -a option?  Can I force it to 
   run with the -a option in /etc/inetd.conf?
     
   Now for the /etc/ftpaccess file.  Mine currently looks 
   like this:

  ********* start of ftpaccess file ***************
     
class   anonymouses    anonymous             *
class   guests         guest                 *.bmc.com,*.peer.com 
CLASS   LOCAL        REAL,GUEST      *.BMC.COM,*.PEER.COM
class   all            real,guest,anonymous  *
     
GUESTGROUP  GUESTS,PART19,X3T3
private    no
     
limit   all   10   Any  /usr/local/etc/msg.toomany
     
passwd-check   trivial   enforce
     
delete          no      anonymous,GUEST 
overwrite       no      anonymous,GUEST 
rename          no      anonymous,GUEST 
chmod           no      anonymous,GUEST 
umask           no      anonymous,GUEST
     
upload  /bmc/local/data/ftp  *             no 
upload  /bmc/local/data/ftp  /             no
upload  /bmc/local/data/ftp  /incoming     yes     root    daemon  0600 nodirs 
upload  /bmc/local/data/ftp  /bmc          no
upload  /bmc/local/data/ftp  /bin        
     
upload  /bmc/local/data/ftp  /etc          no 
upload  /bmc/local/data/ftp  /dev          no 
upload  /bmc/local/data/ftp  /pub          no
upload  /bmc/local/data/guest  *             yes     guest  guest  0644 dirs 
upload  /bmc/local/data/guest  /             no
upload  /bmc/local/data/guest  /incoming     no
upload  /bmc/local/data/guest  /bmc          yes     guest  guest  0644 dirs 
upload  /bmc/local/data/guest  /bin          no
upload  /bmc/local/data/guest  /etc          no 
upload  /bmc/local/data/guest  /dev          no
upload  /bmc/local/data/guest  /pub          yes     guest  guest  0644 dirs
     
compress        no             local remote 
tar             no             local remote
     
banner   /usr/local/etc/msg.banner
message  .contents cwd=*
     
log transfers anonymous,real inbound,outbound
     
email [email-masked]
     
*************************end of ftpaccess file*************
     
The uppercase words/lines are what I changed to allow userid part19 with group 
of part19.  Also for userid x3t3 and group x3t3. 
     
Question:  what is the 'path-filter guest /etc/pathmsg ...' ???
    is my class set right?
    is the 'guestgroup' line correct ?  I don't understand why it was
     'guestgroup guests' in the first place.
     
    do I need to change the upload lines?
     
Thank you so much for your help.  The person who compiled and installed this 
application quit and left this for me.
     
I hope what I"ve written makes sense.  
     
Thanks, Thuy

---

From: [email-masked]
Date: Fri, 20 Sep 96 13:40:48 edt

Hi all,
     
     I took Michael Brennans suggestion an acquired the guest-howto. I 
     followed it the best I could. Still no luck. I get a "530 Access 
     Denied" message before being prompted for my password. I feel I really 
     need some hand-holding. The following is my 'ftpaccess' file.

     ***************** Start of ftpaccess ******************
     
     class   local real,guest    *.mcgraw-hill.com

     limit   all   10   Any              /etc/msgs/msg.dead
     limit   local 50   Any
     
     guestgroup gcpgroup
     readme  README*    login
     readme  README*    cwd=*
     path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
     
     message /welcome.msg            login
     message .message                cwd=*
     
     compress        no              local remote
     tar             no              local remote
     
     log commands real
     
     shutdown /usr/local/etc/shutmsg
     
     ***********End of ftpaccess *******************

     Don't assume I have done everything in the guest-howto correctly, but 
     I think I did.

     Thanks in advance
     
     Greg Piney