Subject: How to set up ftp guest accounts w/o entries in /etc/passwd?

From: Michael Hucka <[email-masked]>
Date: Fri, 15 Nov 1996 04:05:01 GMT

Please excuse what may be a simple question for the experts on this list:

We're using the wu-ftpd 2.1 server on a SunOS system.  I need to restrict
access to certain directories to a group of users.  Ideally, I'd like those
users to be able to log in using a specific group name and a password.  Is it
possible to accomplish this *without* creating an actual /etc/passwd account
on the machine hosting the ftp daemon?  I.e., is there some way to configure
the ftp server itself to recognize user names and passwords, without also
creating entries in /etc/passwd just for purposes of ftp access?

I've been looking through the documentation supplied with wu-ftpd for nearly
an hour and can't see a way, though I see there are mechanisms that deal with
groups and authentication.  However, those *seem* to work only with SITE
commands, after you've already logged in using a real account.  That's not
what I would like to do.  But on the other hand, the wu-ftpd configuration
features (especially ftpaccess) are convoluted enough that I might have
misunderstood them and missed a way to accomplish this.

If someone would point me in the right direction, I'd appreciate it.  You can
tell me to RTFM, just tell me which FM :-).

-- 
Mike Hucka        [email-masked]        http://ai.eecs.umich.edu/people/hucka
 Ph.D. candidate, computational models of human visual processing, U-M AI Lab
     UNIX admin & programmer/analyst, EECS Dept., University of Michigan

---

From: Evan Champion <[email-masked]>
Date: Thu, 14 Nov 1996 23:44:32 -0500 (EST)

> creating entries in /etc/passwd just for purposes of ftp access?

You can't with wu-ftpd.
 
Unfortunately almost everything of use to an ISP eventually gets tied 
back to /etc/passwd.  You could very easily authenticate users using 
other means ie: Kerberos, RADIUS, etc., but most programs rely on either 
home directories or using the OS filesystem rights which, of course, 
requires /etc/passwd entries.

Programs like cyrus use Kerberos authentication, but then require you to 
add entries to a special file (in the case of cyrus, via an 
administration program).  If you only have to deal with cyrus, it isn't 
so bad, but imagine what would happen when you have other services done 
the same way -- cyrus, a ftpd, an httpd, radiusd and Kerberos to do the 
authentication for everything, it gets to be a little crazy.

Somewhere, someone must have thought of a better way...  Until someone 
lets me in on the secret, I'll probably continue to add users to /etc/passwd.

Evan
--
Evan Champion            * Director, Network Operations
mailto:[email-masked] * Directeur, Exploitation du reseau
http://www.synapse.net/  * Synapse Internet

---

From: Michael Hucka <[email-masked]>
Date: Fri, 15 Nov 1996 06:57:12 GMT

>>>>> On 14 Nov 1996, Evan Champion <[email-masked]> wrote:

  evanc> You can't with wu-ftpd.
 
Foo.

Guess I'll have to add a dummy user to /etc/passwd...

Mike

---

From: Alain Magloire <[email-masked]>
Date: Fri, 15 Nov 1996 11:01:10 -0500 (EST)

Hello `Mike Hucka':
[..deleted..]
> what I would like to do. 

The person can logging anonymous and
then do
SITE GROUP foo
SITE GPASS ****

with that you won't have to mess with /etc/passwd ...but
with ftpgroups ;-)

The only havoc of this deal is that the directories must be
in the ~ftp hierarchy. So you can have directories readable only by 
a particular group(ftpgroup).

> But on the other hand, the wu-ftpd configuration

I've been using wu-ftpd for quite sometimes ... and still learning
new things everyday in this list ;-)

> tell me to RTFM, just tell me which FM :-).

`Michael Brennen' use to include in his post(usually the second post, he always
get it wrong the first time ;-) an good set of links for info about guestgroup
the new version of wu-ftpd etc ...
I'm Ccing this to him maybe he can resend(two times as usual ;-)

--
ciao, alain

---

From: Michael Brennen <[email-masked]>
Date: Fri, 15 Nov 1996 10:39:13 -0600 (CST)

C'est moi.  Yup.  All too often it takes twice -- once to practice the
keystrokes, once to really do it. :)

Following Koos's lead, I've also added an autoresponder so people can get
the howto by mail.  Further info is below. 

   -- Michael

On Fri, 15 Nov 1996, Alain Magloire wrote:

> `Michael Brennen' use to include in his post(usually the second post, he
> always get it wrong the first time ;-) an good set of links for info
> about guestgroup the new version of wu-ftpd etc ...  I'm Ccing this to
> him maybe he can resend(two times as usual ;-) 

This is the location for the latest wu-ftpd.  You can't see the
directory contents, but get the file anyway.  It's there.

ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-11.tar.Z

wu-ftpd FAQ:  http://www.hvu.nl/~koos/wu-ftpd-faq.html
              OR
              send mail to [email-masked]
              with a subject line: send faq

guest howto:  ftp://ftp.fni.com/pub/wu-ftpd/guest-howto
              OR
              send mail to "[email-masked]"
              (autoresponder; subject does not matter)

There are additional security references in the above docs.

---

From: Michael Hucka <[email-masked]>
Date: Fri, 15 Nov 1996 16:52:05 GMT

>>>>> On 15 Nov 1996, Alain Magloire <[email-masked]> wrote:

  AM> The person can logging anonymous and then do SITE GROUP foo SITE GPASS
  AM> ****

This is exactly what I said I didn't want to resort to :-)

---

From: Alain Magloire <[email-masked]>
Date: Fri, 15 Nov 1996 12:33:45 -0500 (EST)

> This is exactly what I said I didn't want to resort to :-)

Let me get this straight:

 you want a person with __NO__ entry in
__ANY__ file on your system __not even as anonymous__, to logging
and issue commands.

Sorry, I can't help. Maybe someone else.

--
bonne journe'e, alain