Subject: User?

From: Alan Halachmi <[email-masked]>
Date: Sun, 22 Dec 1996 14:52:43 -0600 (CST)

I used the attached manual that was sent out a couple days ago to try and 
setup a chroot situation for a user.  Well, when my user logs into the 
ftp site it says," User myusername logged in.  Access restrictions apply."
However, it doesn't log into myusername's home dir.  IT does a chroot to 
the e anon ftp dir.  I have a passwd entry of 
myusername:*:193:10::/my/users/d/dir/./:/etc/ftponly
located in my /etc/passwd /my/users/dir/etc and /my/anon/ftpdir/etc/
I have group files with the text client::400:scienc in those same three 
places.  What's not working?  Ideas?

ASlan Halachmi

From [email-masked] Dec 22 14:40:37 1996
Date: Sat, 21 Dec 1996 14:45:32 -0600
From: Michael Brennen <[email-masked]>
To: Alan Halachmi <[email-masked]>
Subject: wu-ftpd guest accounts

**************************************************************************
The working example here will be as if it were a directory under a Web
tree, /home/web.  The Web account will be maintained remotely by FTP.  The
remote user is Mortimer.  Mortimer's account name is "mort", group
"client". 

(Yes, there is some droll humor here for the French speakers...)

1. Do the /etc hacks.  Create Mort's entry in /etc/passwd and add the 
   /etc/group entry.  (Or adduser or whatever you use.)  Add the 
   entries to /etc/ftpaccess.

/etc/passwd:
mort:*:403:400:Mortimer Snerd:/home/web/mort/./:/etc/ftponly
                                            ^^^
   The /./ sequence determines where the chroot() is done to.  If you 
   want the chroot() done to the web directory and a chdir() to mort,
   it would look like this:

mort:*:403:400:Mortimer Snerd:/home/web/./mort/:/etc/ftponly
                                       ^^^

   --------> (make sure "/etc/ftponly" is in /etc/shells.)

/etc/group:
client::400:mort

Set Mort's password as you wish, or better yet use S/KEY.

If you are using the Beta version of ftpd (HIGHLY RECOMMENDED) that
Stan Barber has put together, you must do one of two thing to properly
use /etc/ftpaccess:

1)  compile the source to use /etc/ftpaccess by default (comes turned off);
    hack the source to set use_accessfile = 1;

OR

2)  run the daemon with the -a option.

/etc/ftpaccess:
class   local   real,guest,anonymous ......
...                  ^^^^^
...                    +----------- define 'guest' in the proper classes;
...                                 this is site dependent.
...
...
delete     no   anonymous,guest               # delete permission?
overwrite  no   anonymous,guest               # overwrite permission?
rename     no   anonymous,guest               # rename permission?
chmod      no   anonymous,guest               # chmod permission?
umask      no   anonymous,guest               # umask permission?
...                       ^^^^^
...                         +------ decide if guest should be in this 
...                                 permission list; this is site dependent.
...
...
path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
...
guestgroup client
...

2. Create Mort's home directory and set its ownership and protections.

mkdir /home/web/mort

chown mort.client /home/web/mort

chmod 755 /home/web/mort

3. Build the directory structure under Mort's account.

cd /home/web/mort

mkdir etc bin [dev lib]   (dev and lib are optional and are OS dependent.)

chown root.daemon etc bin

chmod 111 etc bin

4. Build the contents of the ~/bin directory.

USE STATICALLY LINKED COPIES OF ALL UTILITIES IF POSSIBLE -- YOUR LIFE
(AND EVERYONE ELSE'S ON [email-masked]) WILL BE SIMPLER. 

cp /.../bin/ls bin
chown root.bin bin/ls
chmod 111 bin/ls

Optional for on the fly compression and tar:

cp /.../bin/gzip bin
cp /.../bin/tar  bin
chown root.bin bin/gzip
chown root.bin bin/tar
chmod 111 bin/gzip
chmod 111 bin/tar

If the utilities are not static, create the necessary devices in ~/dev and 
copy the necessary libraries into ~/lib.  Check the man page for ftpd that 
comes with your system; it may be of help.

REGARDING HARD AND SOFT/SYMBOLIC LINKS:

The chroot() obviates the use of soft links in this case.  However, it
it is possible to make these hard links back to the master copy of the
utilities rather than copies.  This can save some disk space if that is
a concern.

5. Build the contents of the ~/etc directory.

Edit "passwd" to contain the following:

root:*:0:0::/:/etc/ftponly
mort:*:403:400::/home/web/mort/./:/etc/ftponly

Edit "group" to contain the following:

root::0:root
client::400:mort

chown root.daemon passwd group

chmod 444 passwd group

6. Add some extra security touches

cd /home/web/mort
touch .rhosts .forward
chown root.root .rhosts .forward
chmod 400 .rhosts .forward

You should now be the proud owner of a working guest group FTP login. 
Connect to the machine via FTP and login as "mort".  You should end up in
Mort's account with a current directory of "/".

If not, go over it carefully again, as there is a lot of detail here.  If
you still can't get it to work, yell for help on [email-masked]. 

**************************************************************************

OS DEPENDENCIES / QUIRKS

LINUX:

Linux does not need a ~/dev dir.  It does need the ~/lib dir if the
utilities in ~/bin are dynamically linked. 

If using Slackware Linux, use the /home/ftp/bin/ls utility rather than
/bin/ls.  /bin/ls is dynamically linked, while /home/ftp/bin/ls is
statically linked.

Use the 'ldd' command to find out what libraries are necessary for a given
dynamically linked utility. 

SOLARIS: 

Solaris can't handle SETPROCTITLE, so turn the compile time option off.

(The following was culled from a post by Tom Leach to the wu-ftpd list.)

>For people who are having problems with ls -al and dir on solaris 2.x
>systems, you might try the following to find out what's missing... 

>truss -f chroot ~ftp /bin/ls

>This will run the ls command in the same chroot'd environment that
>anonymous FTP runs in.  The truss will show you what
>files/libraries/devices are accessed and where the ls is looking for them. 

>Tom Leach
>[email-masked]

SUN 4.1.x:

Create a ~dev/zero and ~dev/tcp device from the FTP directory as follows:

# cd dev
# mknod zero c  3 12
# mknod tcp  c 11 42
# cd ..
# chmod 555 dev

The resulting device should ls like this:

crw-r--r--  1 root        3, 12 Jul 27 17:48 zero
crw-r--r--  1 root       11, 42 Jul 27 17:48 tcp

Also, you probably need the following shared libraries:
~lib/ld.so
~lib/libc.so
~lib/libdl.so

BSDI:

Set 555 protections on the ~ftp/shlib and its contents if shared libraries
are used.

From Darci Chapman ([email-masked]):

The following directories and files need to be created in whatever
directory/ies are being chrooted to (~ftp for anon ftp or for whatever
directory guest users are chrooted): 

dr-xr-xr-x root/wheel        0 Nov  3 01:43 1995 bin/
-r-xr-xr-x root/wheel    12288 Nov  3 01:43 1995 bin/compress
-r-xr-xr-x root/wheel    45056 Nov  3 01:43 1995 bin/gzip
-r-xr-xr-x root/wheel    12288 Nov  3 01:43 1995 bin/ls
-r-xr-xr-x root/wheel    65536 Nov  3 01:43 1995 bin/pax
dr-xr-xr-x root/wheel        0 Nov  3 01:43 1995 etc/
-r--r--r-- root/wheel      793 Nov  3 01:43 1995 etc/group
-r--r--r-- root/wheel      817 Nov  3 01:43 1995 etc/localtime
-r--r--r-- root/wheel    40960 Nov  3 01:43 1995 etc/pwd.db
dr-xr-xr-x root/wheel        0 Feb  3 12:34 1995 pub/
dr-xr-xr-x root/wheel        0 Nov  3 01:43 1995 shlib/
-r-xr-xr-x root/wheel   298407 Nov  3 01:43 1995 shlib/libc_s.2.0

**************************************************************************

For extra tips on security see Christopher Klaus's FAQ:

http://www.iss.net/iss/faq.html

**************************************************************************

If you run across some special trick required to get guest access to run
on your OS, or some security cleanup, please let me know and I will update
the master of this document. 

Don't contact me individually for help.  Go through the wu-ftpd list for
that and I will see the post there.

Michael Brennen
[email-masked]

---

From: Michael Brennen <[email-masked]>
Date: Sun, 22 Dec 1996 19:44:05 -0600 (CST)

> located in my /etc/passwd /my/users/dir/etc and /my/anon/ftpdir/etc/

The guest password entry should not be in the /etc/passwd in the anonymous
directory.  Same with the group file.

You give two paths above; is it possible that there is some confusion
there? 

/my/users/dir/

/my/users/d/dir/./
          ^^
          ??

> places.  What's not working?  Ideas?

I've not seen this before; not sure what you are facing.

   -- Michael    ([email-masked])

---

From: Alan Halachmi <[email-masked]>
Date: Sun, 22 Dec 1996 20:54:57 -0600 (CST)

In order to aleviate some confusion I caused, I need to clarify some typos...

> /my/users/dir/
and
> /my/users/d/dir/./
are the same!  I miss typed the second entry.