Subject: Re: Guestgroup /bin/ls on IRIX5.3

From: "frans stekelenburg" <[email-masked]>
Date: Tue, 1 Apr 1997 11:30:00 +0100

On 31 Mar 97 at 21:05, Michael Brennen wrote:

> On Mon, 31 Mar 1997, Mark Bergstrom wrote:
> 
> > Maybe a title change will get somebody's attention.
> > 
> > I've been through ftpd.c over and over.  I can't see why only one command
> > '/bin/ls' is broken for the guestgroup.  The chroot and chdir obviously
> > work.  And as I have noted in my prior posts, '/bin/ls' is NOT broken for
> > anonymous or for real users.
> 
> Assuming you have installed a ~/bin/ls in the chrooted guest account, ls
> in the guest environment is usually broken because it does not have access to
> the necessary shared libraries or devices.  It is because the chroot works
> that the shared libraries in /lib, /usr/lib or wherever are no longer
> accessible. If you've not read it yet, this is explained in the guest howto
> (below).  One solution is a static linked ls if it is an option for you; you
> may still need ~/dev files, depending on the platform. 
> 
> The specifics for this are different for each OS; I've collected a few OS
> specifics at the end of the guest howto.  Some IRIX configuration data was
> added recently. 
> 
> 

True, *read the Irix updated in the guest Howto!*
Especially the /dev/zero (and /lib/...) files, will be of help to you.
Without these, I had this 'blindfolded-visitor' sensation. Interesting, but not 
really helpful indeed.

-gjs

---

From: "frans stekelenburg" <[email-masked]>
Date: Tue, 1 Apr 1997 11:40:59 +0100

> > The parallel discussion thread of various shells under IRIX6.2 seems to be
> > irrelevant here.  I am not seeing any 'type of shell' problems at all no
> > matter what I use for the guestgroup access.
> 
> True; the shells discussion is irrelevant for non operational ls. 
> 

Maybe a redundant remark; but important enough to underline to Irix users, 
concerning the 'shell'.

Best is IMHO to use a fake shell /bin/false & /bin/true i.o. /bin/csh.
Other 'shells' maybe used of course, but in any case THE SHELL MENTIONED MUST 
BE STATED IN '/etc/shells'. If not, the ftpd will disallow ftp access, too.
(Which maybe helpful in some cases)

In the case of /bin/true and/bin/false, you can decide who has 'ftp access, but 
no shell possibillity' or 'no ftp, access, and no shell (thus: NOTHING) 
access'. 
This maybe your answer for a possible security breach.

An example of the bin & false files mentioned:

/bin/true:
==========

#!/sbin/sh
#Tag 3840
#       Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T
#         All Rights Reserved

#       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF AT&T
#       The copyright notice above does not evidence any
#       actual or intended publication of such source code.

#ident  "@(#)true:true.sh       1.4"
#ident  "$Revision: 1.6 $"
#exit 0

/bin/false:
===========
#! /bin/sh
#Tag 3840
#       Copyright (c) 1984 AT&T
#         All Rights Reserved

#       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF AT&T
#       The copyright notice above does not evidence any
#       actual or intended publication of such source code.

#ident  "@(#)false:false.sh     1.3"
#ident  "$Revision: 1.5 $"
#exit 255
exit 1
With regards,
                                                    
 frans stekelenburg

* * * *

  mailto:[email-masked]
  http://www.knmi.nl/~stekelen
     _ + _   
     \\_//
    K N M I

---

From: [email-masked] (Jim Robinson)
Date: Tue, 01 Apr 1997 05:36:15 -0500

Sorry for the stupid question but I am running wu-ftpd on an IRIX 6.2
system and have tried using both of these shells you mentioned also listing
them in a directory called /etc/shells. Is this the source code for these
shells that you have included? Cheers....JR
Jim A Robinson
[email-masked]
www.fitertown.com
www.moneypitltd.com

---

From: "frans stekelenburg" <[email-masked]>
Date: Tue, 1 Apr 1997 17:19:30 +0100

On  1 Apr 97 at 5:36, Jim Robinson wrote:

> shells that you have included? Cheers....JR Jim A Robinson [email-masked]
> www.fitertown.com www.moneypitltd.com

Not stupid at all! Anyway, the shells mentioned (or any shell for that matter) 
goes in /bin. The _names_ of valid shells go in the _file_ /etc/shells.:

for example:

> less /etc/shells

/bin/sh
/bin/csh
/usr/bin/ksh
/usr/bin/sh5
/bin/true
/bin/tcsh
/usr/local/bin/tcsh

---
NOTE that /bin/false should NOT be in there.

Feel free to ask if anything still isn't clear (including me:))

--gjs

---

From: [email-masked]
Date: Tue, 1 Apr 1997 15:10:44 -0500 (EST)

I was under the impression that using /bin/false as a shell would
limit the user to only ftp commands and not let them do site exec
type things etc. I also thought /bin/false should go  in the
etc/shells, but I guess I'm mistaken. What is the proper way to use
/bin/false.

thanks in advance

Doug

-- 
Doug Courtney
[email-masked]
(908)949-3597

---

From: David Cox <[email-masked]>
Date: Tue, 01 Apr 1997 16:21:52 -0600

I am running FTP server wu-2.4 on an AIX 3.2.5

I need some advise on using the path filter.  We have some guest
accounts (about 90% of our accounts) that we want to only put file with
the names trsrpa, trspost, and trsny.  We can set this up with the path
filter, but the other guest accounts could upload any file names.  How
do I keep these from coming under the same restrictions.

thanks
doc