Subject: setting up guestgroups

From: [email-masked] (Thuy Tran)
Date: Thu, 19 Sep 1996 10:44:45 -0500

Hi there.  I'm hoping somebody can help me with my problem.  Here's what I want to do:  ftp to my anonymous ftp server but log 
in using a specific userid and password (non-anonymous) yet have the ftpd do the 
chroot and other good stuff that wuftpd provides.  So I believe I need to setup 
a guestgroup in my wu-ftpd server.  

I'm trying to follow the guest-howto page but after ftping in as the user, I do 
a 'pwd' and it didn't say '/', instead it had the full path of the user's home 
directory and I was able to cd back to other directories that I shouldn't have 
access to.  So there is something wrong in my setup.  I have some questions 
about the guest-howto:

	1. step 1 says to make changes to /etc/passwd, /etc/group and add 
		entries to /etc/ftpaccess.
		
		question:  Are you referring to the actual system /etc/passwd 
			and group files?  So there's going to be 2 passwd and
			group files (one for the system and one in the 
			userid's home directory/etc/, correct?)
			
			Also, I don't have 'ftponly'.  Could I use
			/bin/false or /bin/true instead?  I only want this user
			to ftp, no telnet, etc.
			
	2. step 2 says to compile the source to use /etc/ftpaccess by default or
		to run the daemon with the -a option.
		
		question:  Since I can't compile the source, how do I run the
			daemon with the -a option?  Can I force it to
			run with the -a option in /etc/inetd.conf?
			
			Now for the /etc/ftpaccess file.  Mine currently looks
			like this:

		********* start of ftpaccess file ***************
			
class   anonymouses    anonymous             *
class   guests         guest                 *.bmc.com,*.peer.com
CLASS   LOCAL	       REAL,GUEST	     *.BMC.COM,*.PEER.COM
class   all            real,guest,anonymous  *
 
GUESTGROUP 	GUESTS,PART19,X3T3
private    no
 
limit   all   10   Any  /usr/local/etc/msg.toomany
 
passwd-check   trivial   enforce
 
delete          no      anonymous,GUEST
overwrite       no      anonymous,GUEST
rename          no      anonymous,GUEST
chmod           no      anonymous,GUEST
umask           no      anonymous,GUEST
 
upload  /bmc/local/data/ftp  *             no
upload  /bmc/local/data/ftp  /             no
upload  /bmc/local/data/ftp  /incoming     yes     root    daemon  0600 nodirs
upload  /bmc/local/data/ftp  /bmc          no
upload  /bmc/local/data/ftp  /bin        
		
upload  /bmc/local/data/ftp  /etc          no
upload  /bmc/local/data/ftp  /dev          no
upload  /bmc/local/data/ftp  /pub          no
upload  /bmc/local/data/guest  *             yes     guest  guest  0644 dirs
upload  /bmc/local/data/guest  /             no
upload  /bmc/local/data/guest  /incoming     no
upload  /bmc/local/data/guest  /bmc          yes     guest  guest  0644 dirs
upload  /bmc/local/data/guest  /bin          no
upload  /bmc/local/data/guest  /etc          no
upload  /bmc/local/data/guest  /dev          no
upload  /bmc/local/data/guest  /pub          yes     guest  guest  0644 dirs
 
compress        no             local remote
tar             no             local remote
 
banner   /usr/local/etc/msg.banner
message  .contents cwd=*
 
log transfers anonymous,real inbound,outbound
 
email [email-masked]

*************************end of ftpaccess file*************

The uppercase words/lines are what I changed to allow userid part19 with group 
of part19.  Also for userid x3t3 and group x3t3. 

Question:  what is the 'path-filter	guest	/etc/pathmsg ...' ???
	   is my class set right?
	   is the 'guestgroup' line correct ?  I don't understand why it was
	   	'guestgroup	guests' in the first place.
	   	
	   do I need to change the upload lines?
	   
Thank you so much for your help.  The person who compiled and installed this 
application quit and left this for me.

I hope what I"ve written makes sense.  

Thanks, Thuy

---

From: Michael Brennen <[email-masked]>
Date: Thu, 19 Sep 1996 13:13:17 -0500 (CDT)

> 			userid's home directory/etc/, correct?)

The actual /etc/passwd.  Yes -- there are 2 /etc/passwd files.  The one in
the ftp tree should be stripped of all non essential data, as covered in
the howto.

****** Make sure the /./ is at the end of the path in the user's account
in /etc/passwd.  This is indicated in the howto, and that is what
determines where the chroot is done.  If you are seeing a full path, then
the chroot is not being done properly. 

> 			/bin/false or /bin/true instead?  I only want this user

/etc/ftponly should not exist.  Just put "/etc/ftponly" in /etc/shells and
as the shell on the guest user's account in /etc/passwd. 

> 			run with the -a option in /etc/inetd.conf?

Should be sufficient to run with -a in /etc/inetd.conf; the ftp line in
inetd.conf should look something like this: 

ftp  stream  tcp nowait root /usr/sbin/tcpd  /usr/sbin/wu.ftpd -a -t300

> The uppercase words/lines are what I changed to allow userid part19 with
> group of part19.  Also for userid x3t3 and group x3t3. 

Should be okay if I've not missed some detail.

> Question:  what is the 'path-filter	guest	/etc/pathmsg ...' ???

Set path-filter to the following:

# path-filter...
path-filter  anonymous  /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
path-filter  real       /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-

> 	   	'guestgroup	guests' in the first place.

"guestgroup guests" assumes the existence of a group "guests" in
/etc/group.  The howto assumes and demonstrates a group of "clients" in
/etc/group.  Looks like you've got it set right.

Just understand that with the above line uploaded files will be created
with ownership and group of "guest.guest".  You may not want that, so
change the "guest   guest" part to be a user and group on your system that
you want. 

Hope this gets you operational,

   -- Michael

---

From: David Lewis <[email-masked]>
Date: Thu, 19 Sep 1996 14:53:01 -0400 (EDT)

I actually got a setup like this working yesterday (on a Solaris 2.4
system).  The tricky part (and the only thing I noticed wrong with your
general procedure) is in the "guestgroup" line of ftpaccess -- don't use
commas to separate the group names, only spaces.  For example, you would
want the line to look like this in your ftpaccess: 

guestgroup	guests part19 x3t3

Also, you'll need to add these guest groups (and your guest users) to the
actual system group (and passwd) files, not the ones under the ftp
directory.

I hope this helps.

David Lewis
Communications Development Inc.
email: [email-masked]
web: www.cdinet.com