Subject: WU-FTP & ls

From: Anthony McGarr <[email-masked]>
Date: Tue, 08 Jul 1997 15:18:41 -0400

Hello.

What we are trying to establish, is, to have each one of our users be 
chrooted to their home directory when FTPing onto our box. The problem
is 
space confindment. We have over 3000 users and it would require about
1/2 
meg, in each $HOME dir to set up the "~/bin/ls" ( and any other
executable 
needed ) so they would be able to view the contens of their directory.

We have tried makeing a symbolic link to ls but once chrooted, the user 
would not be able to use "ls" bc the symbolic link would not cross the 
chroot directory. 

We have tried hard linking the ls but that to increase disk space. 

We have tried to put the user $HOME dir underneath (above ? -> format: 
/home/ftp/$HOME ) the anonymous ftp directory tree. Made the proper 
changes in the etc/passwd 
( user:passwd:uid:gid:geco:/home/./ftp/$HOME:shell )
to allow access, once chrooted, to the ls needed ( in /home/ftp/bin )
but that did not seem to work.

Is there any way we can allow our users to use "ls" ( plus other 
executables ) without having to "cp" or hard linking the executables in 
question in their $HOME directory ???

thanks in advance

---

From: Ben Mehlman <[email-masked]>
Date: Tue, 8 Jul 1997 19:04:22 -0400 (EDT)

> question in their $HOME directory ???

Someone out there has a "built-in ls" patch..  but I didn't know about it
when I was facing the same problem as you are.  In my case I have -way- too
many users for links to be a reasonable option.  So what I did was get the
gnu ls source, change the name of main() to ls_main(), and modify the gnu
makefile to build just the libraries it needs and ls.o, but not the
executable.  I link the result into ftpd.  In popen.c, I put in a test just
before the exec.  If it's /bin/ls, I call ls_main() instead of exec.  Works
like a charm.  One caveat- you must add -n to the list of ls options in
ftpd.c, or ls acts very erratic when it can't find /etc/passwd.   

-Ben

---------------------------------------------------------------------------
Ben Mehlman                                   Vladimir: Well?  Shall we go?
Prodigy Services Company                      Estragon: Yes, let's go.
[email-masked]                                   (They do not move).

---

From: [email-masked] (Oskar Pearson)
Date: Wed, 9 Jul 1997 12:24:06 +0200

Hi

> needed ) so they would be able to view the contens of their directory.
We did the following:

/home/some-customer
/home/some-other
/home/lib
/home/bin
/home/etc

...

We then chrooted them to /home and used the ACL feature in solaris...
thus they can't change to anyone else's directories in /home, and they
can't fiddle in the real /bin /usr/bin etc...

man getfacl and man setfacl I belive.

Also check for "acl" on www.sun.com's web site

Oskar