Subject: Re: guest user setup

From: Alain Magloire <[email-masked]>
Date: Thu, 20 Feb 1997 11:56:53 -0500 (EST)

According to `Michael Brennen':
> 
> On Thu, 20 Feb 1997, Subu Rama wrote:
> 
> > Plus if you don't care about on-the-fly tar/compress, you don't need
> > most of the stuff in bin.
> 
> You probably should not have tar in there anyway; at least with GNU tar
> you can give a shell escape on the tar command line. 
> 

To add to Michael comments:
 gtar have an option --rsh-command that will allow to send arbitrary
commands, so you don't want it in _PATH_EXECPATH.
Gtar can also do it's own globing "*" '?' etc .. on the
archive, I don't think its a danger(then again :-),
the ftpconversion file is very much static.

Note: this is not a security hole from gtar nor wu-ftpd,
 one should always watch what they put in _PATH_EXECPATH.

IMHO
The Net is already loaded why untarring on the fly.
Tarring, do it manually it takes a few seconds and
release the server from the load.

> 
> > If you "build in" your ls in ftpd you don't need the bin directory at
> > all ?
> 
> True -- if you don't want to allow people to add extra parameters such as
> -l, -CF, etc.
> 

In fact, if you don't need all the fancy globing, recursive search(-R) and
options(all the good stuff:), you can write an ls that will hold in one
page. The server will benifit from this, no need to popen()/exec("/bin/ls")

Of course if you down rewriting ls from scrath with all of it's features
you're better of with popen("/bin/ls")

> 
> > rtfm.mit.edu gives out a greeting that says "rtfm ftpd with built in ls".
> > Is this version generally available or has MIT modified the ftpd source
> > to do this ?
> 

There is a patch lying around see the archive
  - Jedipatch3(Frank Denis) Don't know the status
  - Emil had a patch for static ls on solaris(GNU fileutils)
    I don't remember the status either.

-- 
au revoir, alain
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
POIRE: Premature Optimization Is the Root Of all Evil
                      D.K or is it B.K ? maybe A.M ;-)

---

From: Subu Rama <[email-masked]>
Date: Thu, 20 Feb 1997 09:36:17 -0500 (EST)

If you have a large number of guest users, and you don't really care
about the names showing up in replies to "ls" or "dir" do you really
need the etc directory for each user ?

(Copying these executables for each guest user just takes up space and
you might forget to do this for a given user !)

Subu Rama
[email-masked]

---

From: Michael Brennen <[email-masked]>
Date: Thu, 20 Feb 1997 09:58:19 -0600 (CST)

> you might forget to do this for a given user !)

1: don't copy them; use hard links instead.

2: don't manually do this; custom sh/perl scripts work wonders.

> Is this version generally available or has MIT modified the ftpd source

No idea.

   -- Michael

---

From: [email-masked] (Lars Wessels)
Date: Thu, 20 Feb 1997 15:08:06 +0100

Am 18.02.1997 schrieb Ed Stone zum Thema "wu-ftpd set up problems":

> 1) I can't seem to set up a user for "guest" ftp without setting up a
> directory for the user. I want to set up guest1, guest2 etc., for ftponly,
> no telnet...
> 2) my ftpaccess file causes the proper chroot for guest1, but does not do
> chdir as directed in passwd; also, there is no listing of files found in
> the chroot directory...

Encountered the same Problem (I think) last night and solved it ...  ;-)

Remember that your entry in /etc/passwd results in a chroot() environment
which requires its own /bin and /etc in /var/www/acme/ if you don´t share
this directory with you anonymous ftp setup.

Still, the above is just a wild guess, but creating /bin and /etc and copying
the required files (ls, tar, gzip, passwd, ...) made my ftp guest accounts
work. Before I had the same problems with files and dirs not showing up.

Greetings from Germany,
Lars

------------------------------------------------------------------
Lars Wessels    Institute for Economic Policy Research (IWW)
                University of Karlsruhe, Germany
                Phone: +49 721 608 4780/6172  Fax. +49 721 607376
                eMail: [email-masked]