Subject: How to restrict access in ftp ?

From: Fabricio de Paula Campolina <[email-masked]>
Date: Tue, 10 Sep 1996 21:12:55 +0000 (GMT)

Hi all,

Is  possible to configure wu-ftp to alow users ftp only to theirs home 
directory and also let this users to login with a shell. I knows about wu-ftp
 guest count but with it I only could use false shell .

thank's

---

From: Alain Magloire <[email-masked]>
Date: Wed, 11 Sep 1996 16:28:57 -0400 (EDT)

>  guest count but with it I only could use false shell .

I'm not following ?
Why would you restrict ftp access and 
then allowing full login capabilities ???

It's like locking the windows but
leaving the front door wide open.

Guest accounts are cumbersome to maintain
you must provide the dev/* lib/* etc/* 
depending on the OS, because of the chroot().

The easiest way out is probably to create 
distinct accounts.

/home/guess/./foo1
/home/guess/./foo2

where the hierarchy(dev, lib, etc) in /home/guess is
already set so you don't have to create it for
every guess accounts

> thank's

hmmm.. I don't think I really help
just comments ;-)

---

From: Monika Lie Larsen <[email-masked]>
Date: Thu, 12 Sep 1996 08:25:32 +0200

Alain Magloire wrote:
[someone else wrote:]
> leaving the front door wide open.
Agreed. But what if he wants his guests to change their own passwords -
how do you smart guys do that?

Monika
-- 
+-------------------+---------------------+---------------------------+
|                   | Andoya Rocket Range | Tel.:   +47 76141644      |
| Monika Lie Larsen | Box 54              | Fax.:   +47 76141857      |
| System Analyst    | N-8480 Andenes      | e-mail: [email-masked] |
|                   | NORWAY              |                           |
|                   |                     | private: +47 76142092     |
|-------------------+---------------------+---------------------------|
|                WWW URL:  http://www.arr.nsc.no                      |
+---------------------------------------------------------------------+

---

From: Alain Magloire <[email-masked]>
Date: Thu, 12 Sep 1996 14:19:55 -0400 (EDT)

> how do you smart guys do that?

You are unfair Monica :)

  all I was trying to point out is that he is using the wrong
tool. FTP, is a protocol for "Transfering Files", not change
passwd, or having shell capabilities. If you want to
restrict shell access then rsh(restricted shell) login would 
be preferable then trying to make it fit inside Ftpd.

  Wu-ftpd added to the protocol nice/unnecessary extensions
UMASK 
IDLE
CHMOD 
HELP 
GROUP
GPASS
EXEC
[De]Compression on the fly 
etc ...

  And having a very busy Ftp site(We transfer over 1 Gig a day..),
I can't go back to plain Ftpd.

Marcus Ranum made the comment in a newsgroup:
"FTP is dead we should turn to HTTP"

My question to this list is .. Is he right ?
Is FTP a dead protocol ?
Should we move to HTTP ?

Should we spend our time patching Ftp and adding new
features(like changing passwd or what ever) ?

Beta-11 is interresting because it added the
virtual patch and compensate for the PORT command, is
that enough/"too much" ?

I would certainly like to hear from all of you

--
bye, alain

---

From: Michele Trotta <[email-masked]>
Date: Thu, 12 Sep 1996 20:50:42 +0200 (MET DST)

> be preferable then trying to make it fit inside Ftpd.
<--->Skip!
> Should we move to HTTP ?
Use 'em both! :)) Just kidding....

You could try to use (on a Unix?) some capabilities offered by
mailreaders as Eudora. Your guests should be able to use it to
change their pw. You have to install the sw.
You could setup a CGI if you'll run a HTTPD.... but uhm.. I love
FTP clients!
Or maybe think about kinda robot capable to read PGPed E-mails.

                                 Michele (<-- a male name in Italy :) )
                                 ftpadmin of ftp.flashnet.it

P.S. Thanks a lot to all that guys who helped me with the weird
     stuff happened with some releases of Linux (it rulez!).
     Your support has been really important.

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Thu, 12 Sep 1996 22:54:54 +0200 (MET DST)

Quoting Alain Magloire, who wrote :

[snip]

> My question to this list is .. Is he right ?

FTP is not dead. Heck, there are webservers out there that use ftp instead
of http.

Ftp is mostly i/o+network bound, http is more cpu bound.

What I do see is more of making files available via both ftp and http and
throwing BIG machines at it (e.g. sunsite)

> features(like changing passwd or what ever) ?

ftp servers (most notably wu-ftpd) can be restricted in how much load
they are allowed to put on your system/network. I haven't yet seen a
webserver where I can say that it cannot use up more then N cputime
during the day and no more then 2N cputime at night.

I talked to someone about setting up a webserver on a low budget. The
only way to regulate what amount of cpu is used and how much network
traffic flows by is by a choice of what contents is available on the
webserver.

ftp servers are 'older' and therefore have better features coming from
a time when cpu power, memory and bandwidth costed real money and lots
of it too.

I work with both. I use wu-ftpd to run a small ftp site for our department,
and for some reason it still gets an unusual high number of ftp requests per
day (compared to the number of files available). I also work on the
technical side of some webservers.

Both have their advantages and disadvantages. But ftp is alive and kicking.
The virtualhosting patches show it can even cope with the latest
developments in the selling of internet services.

                                     Grtx KH

-- 
  Koos van den Hout,     Internetter, Unix freak, ISFJ and BBS SysOp at large
  [email-masked] (Home)        BBS Koos z'n Doos (+31-30-6036637 28k8)
  [email-masked] (Work)  <-- finger -l for PGPkey    (+31-30-6056619 14k4)
  http://www.hvu.nl/~koos (WWW)    Looking for a license plate with "RFC 822"
  Quando Omni Flunkis Moritati (If all else fails - play dead)     KH106-RIPE

---

From: Bertrum Carroll <[email-masked]>
Date: Fri, 13 Sep 1996 08:02:17 -0500

I've tried this on a Solaris machine and can't seem to get it to work.
Has anyone gotten chroot to work for non-anonymous users?
Bert Carroll
Deere & Company
[email-masked]

--

---

From: Bertrum Carroll <[email-masked]>
Date: Fri, 13 Sep 1996 08:06:39 -0500

I haven't gotten chroot to work but I have a method to allow users
to change their own passwords.  Instead of a false shell; they get 
the passwd command as their shell. (must put the command in the shells
file).  When they telnet to the server they login then are prompted to
change their password.  Upon compleation they are kicked out.

So far it works pretty well.

--

---

From: Bertrum Carroll <[email-masked]>
Date: Fri, 13 Sep 1996 08:12:03 -0500

I must have missed something, We teach our lower end users to use
Netscape to ftp files from our ftp server. 

instead of http:\\www.something.sometype
use ftp:\\[email-masked]
If you really feel brave use
ftp:\\userid:[email-masked].

When my PC users use Netscape they don't need to know ftp commands;
they just drag and drop to the screen uploads and downloads.
So far it's so easy they can't find anything to complain about (smile)

Bert Carroll
[email-masked]

--

---

From: Monika Lie Larsen <[email-masked]>
Date: Fri, 13 Sep 1996 14:29:30 +0200

Did you remember to add the line

guestgroup [name of your guestgroup]]

to your ftpaccess file? And run the server with the -a option?

> Has anyone gotten chroot to work for non-anonymous users?

Yep. :)

-Monika

---

From: zero cool <[email-masked]>
Date: Fri, 13 Sep 1996 12:02:02 -0700 (PDT)

> ftp:\\userid:[email-masked].

Just a note, if you're teaching your users this, you sould use the proper
URL.  i.e. http://www.dom.ain/

Use forward slashes, and terminate with a slash.  If you don't terminate
with a slash, the http protocol issues a redirect and appends the final
slash.  Therefore, you've done two accesses instead of one.

David

---

From: Alain Magloire <[email-masked]>
Date: Fri, 13 Sep 1996 15:50:58 -0400 (EDT)

> So far it's so easy they can't find anything to complain about (smile)

nope you're not missing anything. Web browser can talk to an ftp server
by doing

ftp://machine/the_file  # forward slash on Unix

The Browser will map the URL to FTP commands

USER ftp
PASS foo@..
PASV | PORT   # depending on the implementation
RETR the_file
QUIT

Must of the time the browser will do PASV and ask the ftp server
to open a passive connection, this highlight a weakness in some
ftpd were you can open as many passive connections you want, and 
sometimes ftpd would not even close the sockets when finish(hang..).
It was corrected in the beta-xx as the PORT command ... flexibility.

I'm slowly erasing those comics characters ;-)
Veronica, Archie(this one should survive :), Jughead ...

Last year I've kill an old relic .... WAIS :)

this year I'm taking to the gallows poles ... GOPHER

Must of our public data is available via HTTP
it's more flexible and I don't have to do all
that arm twisting with guestgroup, guestaccounts
file permissions, ftpaccess etc... to make it behave.

so .. I'm thinking .. about the gallows and FTP.

Koos van den Hout seems to say that FTP is alive and
kicking ... compare to what ... Gopher ?

--
alain

---

From: Jayme Cox <[email-masked]>
Date: Mon, 16 Sep 1996 11:05:05 -0700 (PDT)

Hi,
	I'm running a very busy ftp server on a Linux 2.0.x box. I had
to add the following line to the config.lnx file to get 2.4.2-beta-11
to compile:

#define DIRENT_ILLEGAL_ACCESS

Everything seems to be working just fine except for the fact that this
error keeps occuring:

Sep 16 11:20:36 un inetd[83]: ftp/tcp server failing (looping),
service terminated

Of course after this happens, no one is able to ftp in untill I give
the inetd a HUP. I've tried setting the max suffix to the wait
statement in inetd.conf up from the default of 40 requests per minute,
but I have to set it at about 180 for it to work. However, when it's
set that high, the machine eventualy just hangs after a day or two.

Is there a way to run a stand alone ftp daemon that spawns off ftp
daemons for each request?

Thanks,
			--Jayme

--
Jayme Cox <[email-masked]>
Voice:  (805) 882-2373
Fax:    (805) 899-4316

---

From: [email-masked] (Pedro Melo)
Date: Tue, 17 Sep 1996 11:30:17 GMT

>alain

hmms... I will only see HTTP replace FTp when HTTP let's me continue an
abort transfer. Till then, my shop will always speak FTP for public files.

HTTP times out, and when it times out after transfering 1Mbyte and missing
only 50k left, it's a waste of resources to bring that first Mbyte again.

See ya!

melo
--
************** Pedro Melo ([email-masked]) BOFH ******************
*   TELENET, Servicos de Telecomunicacoes, SA - Tel +351 1 3871010   *
* finger [email-masked] or search key servers for PGP key *
*           It's management's job to support the geniouses,          *
*                      not to tell them what to do                   *
**********************************************************************