Subject: Re: chroot problem..

From: [email-masked] (Bob Myers)
Date: Fri, 27 Dec 1996 13:20:27 -0800

On Dec 24,  9:29, Alan Halachmi wrote:
} Subject: chroot problem..
> I setup a virtual ftp site and it works great.  However, I need a user to 
> be able to access his own dir and manipulate its contents.  I seem to 
> have set everything up correctly because when he logs in it says `User 
> hisusername logged in.  Access Restrictions Apply`.  However, the server 
> isn't doing a chroot!  I have the passwd files that say /his/dir/./ but 
> that isn't working.  I've built the appropriate bin and etc dirs... 
> What's not working...I'm happy to field questions as to certain 
> configurations, but I think I've done it all correctly... Is there a bug 
> in the beta-11 verion?
> 
> Alan Halachmi
> [email-masked]
>-- End of excerpt from Alan Halachmi

Beta 11, using the "virtual ftp" feature, chroot's to the virtual chroot dir
for both anonymous and guest users, regardless of passwd file entries.

I consider this a bug, personally, but this is open to opinion on how virtual
ftp servers should operate.  I patched Beta-11 to use the passwd /./ directory
preferentially over the virtual ftp chroot dir.

Here is my patch (previously posted) to fix this:

*** ftpd.c.~1~	Sun Apr 14 22:51:11 1996
--- ftpd.c	Wed Aug  7 23:26:22 1996
***************
*** 1430,1441 ****
      if (anonymous || guest) {
          /* We MUST do a chdir() after the chroot. Otherwise the old current
           * directory will be accessible as "." outside the new root! */
  #ifdef VIRTUAL
!       if (virtual_mode) {
!         strcpy(pw->pw_dir, virtual_root);
!       }
  #endif 
-         if (anonymous) {
              if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) {
                  reply(550, "Can't set guest privileges.");
                  goto bad;
--- 1445,1456 ----
      if (anonymous || guest) {
          /* We MUST do a chdir() after the chroot. Otherwise the old current
           * directory will be accessible as "." outside the new root! */
+         if (anonymous) {
  #ifdef VIRTUAL
! 	    if (virtual_mode) {
! 	        strcpy(pw->pw_dir, virtual_root);
! 	    }
  #endif 
              if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) {
                  reply(550, "Can't set guest privileges.");
                  goto bad;

---

From: Thom Dunaway <[email-masked]>
Date: Mon, 30 Dec 1996 17:40:00 -0600

The how-to for guest accounts says to "compile the source to use
/etc/ftpaccessby default (comes turned off)"

How do I do this?

*******************************
"A man can receive only what is given him from heaven."
thom dunaway
[email-masked]
*******************************

---

From: Bob Myers <[email-masked]>
Date: Mon, 30 Dec 1996 17:08:05 -0800

Thom Dunaway wrote:
> 
> Michael sent me the "guest accounts" how-to last week because I was trying
> to create user accounts and restrict their ability to snoop around.  I have
> a few questions concerning that how-to.
> 
> The how-to says to assign "/etc/ftponly" as their shell.  Is "ftponly" an
> actual shell (I couldn't find it) and if so does that mean that this method
> will only allow these users ftp access.  (If so this will not work for me)
> 
> What do you change to complie the source to use /etc/ftpaccess by default.
> 
> Would Bob Meyers' fix, posted last week and quoted below, be a solution
> which would allow my users to have any shell I wish.
> 

That patch has nothing to do with this.

It doesn't hurt if /etc/ftponly does not exist.
It does need to be listed in /etc/shells though.