Subject: Guest permissions

From: Paul Gamble <[email-masked]>
Date: Mon, 18 Aug 1997 11:28:52 +0200

I am running wu-ftp v2.4 on solaris2.5.1

I am trying to setup two ftp guest accounts that have the same
home directory location, but with differing ftpaccess permissions.

The first guest account should not be able to delete, chmod, etc,
while the second account (intended as an "admin" account) should
be able to do those things.

However, it appears as if the ftpaccess "permissions" can only be made
to apply globally to all guest accounts, i.e.:

# all the following default to "yes" for everybody
delete          no      guest,anonymous         # delete permission?
overwrite       no      guest,anonymous         # overwrite permission?
rename          no      guest,anonymous         # rename permission?
chmod           no      guest,anonymous         # chmod permission?
umask           no      guest,anonymous         # umask permission?

My "admin" guest account needs to be able to at least delete files.

Is there any way around this? Any assistance / advice would be
gratefully accepted.

Thanks,
-- 
Paul Gamble
SAIX System Administration
E-mail	: [email-masked]
Tel	: +27-21-414-4722
Fax	: +27-21-414-4706

---

From: Michael Brennen <[email-masked]>
Date: Mon, 18 Aug 1997 09:32:46 -0500 (CDT)

chmod the chrooted directory to 1775 permissions -- that is, turn the
sticky bit on.  Set all users with access to the account into an exclusive
group.  Set the upload directive to make all uploads to that account are
owned by the admin user, permissions 755. 

With the directory set 1775, all members of the group can do uploads, but
with the sticky bit set only the admin user will be able to delete files,
since that account owns the files. Test this to make sure it works on your
Unix. 

   -- Michael

On Mon, 18 Aug 1997, Paul Gamble wrote:

> Assign ownership of the files and chrooted directory to the admin
> account, file permissions 755. The other won't be able to write up
> because of permission failures.  Too simple? 
> 
>    -- Michael
> 
> That's the problem: The "other" account still needs to write files. It
> just musn't be able to delete them as the account is used by multiple
> "real"  users.