Subject: Re: Regarding virtual server design spec. Was:Re: [ACADEM-SW-SUPPORT #154] Re: Status of 2.4.2-academ[BETA-12] release (fwd)

From: "Karl O. Pinc" <[email-masked]>
Date: Fri, 17 Jan 1997 14:07:16 -0600

>Now you agree with wht I'm asking for?  The chroot problem of the
>virtualFTP is in the code of the ftpd, that's why there is no easy way to
>fix it.  All I want is for the virtualftp to run EXACTLY like the real
>ftp server, passwd file chroting and all.

I guess what the problem is depends on your perspective. There's no easy
way to fix it because the chroot of the _regular_ anonymous ftp is coded
into the server.  Tcpwrapper can manage the virtual ftp without using _any_
virtual directives.  This is awfully round the barn, but this should work:

[What we are doing here is fool ftpd into using a separate passwd file for
each virtual server, just to get the right anonymous ftp directory for each
virtual server.  We use tcpwrapper and each virtualftp runs EXACTLY like
the real ftp server, because it _is_ a real ftp server as far as it knows.
That is the virtue of tcpwrapper, no special cases.  It would probably be
easier to code a "set-anonymous-ftp-root" directive, install the -a patch,
and have tcpwrapper run ftpd with a different config file for each virtual
server than go through the hassles of setting things up as below.  In fact,
it probably could have been done in the time it's taken to write all this
correspondance with you.  :-( ]

Install gnu chroot, a shell command which chroots.

Install tcpwrapper, compile with everything turned on.

Configure inetd to run tcpwrapper on port 21 (as is usual with tcpwrapper)

Configure tcpwrapper to look at the ip on the server side of the
connection, and then run two commands (use TWIST to do this).

The first command is a chroot <somewhere>.  There should be a <somewhere>
directory for each virtual server; tcpwrappers should direct chroot to the
appropriate directory based on the ip number to which the ftp client is
connecting.  <somewhere>/etc/passwd should have a ftp user defined, with
the appropriate home directory for anonymous ftp to that virtual server.
It must also have users defined as appropritate for that virtual server,
with the /./ in the home directory for guestgroup users and so forth.
<somewhere>/etc/ftpaccess should be a valid ftpd configuration file, one
that does not contain the "virtual" directive.  (It can probably be the
same configuration file for all the virtual servers.)  <somewhere>/lib
should contain all the libraries needed to run ftpd, and all the other
incidentals associated with executing things chroot should be attended to.
The guestgroup users directories should also be beneath <somewhere>, or
you're faced with the prospect of hardlinking directories.

The second command runs wu-ftpd.

<Lots of stuff snipped out, see the earlier parts of the thread.>

Karl

May the Legos (TM) always be swept from your path in the night.