Subject: restricted ftp

From: Elizabeth Gill <[email-masked]>
Date: Wed, 9 Apr 1997 17:22:20 +0100

I am trying to set up a Solaris 2.5 system using wu-ftpd-2.4.2-beta-13
to provide a restricted-ftp service; that is, a 'guest' userid which is
chrooted and behaves like anonymous ftp. I'm sure this used to work under
Solaris 2.4; under 2.5 you can cd to directories higher than the chrooted one.
I have also tried to provide a 'guest' directory under the normal anon ftp
service using SITE GROUP and SITE GPASS, but it seems to take no notice of my
/etc/ftpgroups file; SITE GROUP recognises the entries but doesn;t ask for
a password although I have an encrypted password entry in the /etc/ftpgroups
file as specified.
Has anyone else upgraded a Solaris 2.4 service to 2.5 and a) found it stopped
working and b) fixed it?

-- 
Elizabeth Gill ([email-masked])
IT Solutions and Services (UNIX Systems Support)
Maclean Building,Crowmarsh Gifford,
Wallingford, OXON OX10 8BB
Tel: 01491-692346 Fax: 01491-692446

---

From: Alain Magloire <[email-masked]>
Date: Wed, 9 Apr 1997 14:00:31 -0400 (EDT)

Bonjour Mme Elizabeth Gill

> Solaris 2.4; under 2.5 you can cd to directories higher than the chrooted one.

Did you take a look at the guesthowto ?
it's rather complete.
Unfortunately I don't remember the URL :(
But it's in the FAQ, and the author Michael usually
read this list maybe, he can send it ... once more (Michael ?)

> /etc/ftpgroups file;

for SITE GROUP and SITE GPASS to take effect you must specified
in ftpaccess the directive:
private yes
and I believe with beta-1x's, you must at compilation(#undef NO_PRIVATE)
for this feature to take effect.

use ckconfig to see if the path is accesible to the server.

> SITE GROUP recognises the entries but doesn;t ask for

I don't thing that the server will ask specifically for a passwd
it will probably say something like 
220 group accepted
and it's up to you to send a
SITE GPASS xxxx
if the passwd is accepted then setegid() is done

If you only have one or two groups maybe
the autogroup directive(man ftpaccess) will be usefull
The setegid() is done automatically for certain type of clients
so no more site group/gpass

-- 
au revoir, alain
----
Aussi haut que l'on soit assis, on est toujours assis que sur son cul !!!

---

From: "Phong Duong" <[email-masked]>
Date: Wed, 9 Apr 1997 15:42:07 -0500

Hello,

I hope I understood your question.  Here goes...

I have set up something similar to what you've described as a "guest" ftp
account under Solaris 2.5.1.  I did not, however, use the /etc/ftpgroup feature
like you've mentioned.  I created an ftponly user id with the ftponly group id,
and utilize the "guestgroup" feature of ftpaccess.  This ftpguest user is
dropped into ~ftp/pub upon login, and about the only directories he/she can cd
into are the chroot /, pub, and incoming (see the cdpath entries in my
/etc/ftpaccess below).

Here's a shortened capture of some of our files:

/etc/passwd:
------------
(regular account info here...)
ftp:x:9998:999:Anonymous FTP:/usr/local/ftp:/bin/true
ftpguest:x:9997:999:Guest FTP:/usr/local/ftp/./pub:/bin/true

Note: notice the "/./" pattern in the home field (see ftpaccess(5)).

/etc/group:
-----------
(regular group info here...)
ftponly:*:999:ftp,ftpguest

~ftp/etc/passwd:
---------------
ftp:x:9998:999:Anonymous FTP:/usr/local/ftp:/bin/true
ftpguest:x:9997:999:Guest FTP:/usr/local/ftp/./pub:/bin/true

~ftp/etc/group:
---------------
ftponly:*:999:ftp,ftpguest

/etc/ftpaccess:
---------------
class       all            real,guest,anonymous  *
guestgroup  ftpguest
limit       all            5                      Any      /etc/msgs/msg.dead
readme      README*        login
readme      README*        cwd=*
banner      /welcome.msg   login
message     .message       cwd=*
compress    yes            local remote
tar         yes            local remote
log         commands       real
log         transfers      anonymous,real         inbound,outbound
shutdown    /etc/shutmsg
cdpath      /incoming
cdpath      /pub
cdpath      /
email       [email-masked]

/etc/ftphosts:
--------------
    allow   ftp       *
    allow   ftpguest  172.16.32.*
    deny    *         *

Note: we only allow internal usage of the ftpguest account.

Oh yes, remember to check if you are using NIS/NIS+ and reflect the account
info respectively.  Since our FTP user community is so static and small, we
have decided not to use NIS/NIS+.

Hope this help in someway...

-- 
+-------------------------------+----------------------------------+
| Phong D. Duong                |  Enron Capital & Trade Resources |
| Information Technology        |  1400 Smith Street               |
| mailto: [email-masked]  |  Houston, Texas 77002            |
|  voice: (713) 853-1459        |  EB-3416B                        |
+-------------------------------+----------------------------------+

---

From: "Phong Duong" <[email-masked]>
Date: Wed, 9 Apr 1997 16:15:04 -0500

Hi,

My apology for leaving something rather important out, and that is you must
start in.ftpd with the -a option so that it reads the /etc/ftpaccess file.

For example, here's my /etc/inetd.conf file:

(... snip ...)

# Ftp and telnet are standard Internet services.
#
ftp     stream  tcp     nowait  root    /usr/sbin/in.ftpd       in.ftpd -l -a
telnet  stream  tcp     nowait  root    /usr/sbin/in.telnetd    in.telnetd

(... snip ...)

Hope this helps in some way.

Cheers,