Subject: Re: non-anonymous users and standalone daemon

From: Brian Pape <[email-masked]>
Date: Thu, 02 Oct 1997 10:28:51 -0700

At 12:31 PM 10/2/97 -0400, you wrote:
>
>1) Lee McLoughlin wrote some modifications to the code to make the ftpd
>   daemon run without the need of inetd.  It works really well and I'de
>   like to thank him for his help, I'm wondering tought, is there any 
>   chance that this feature will be officially implemanted in a 
>   soon to come new release of wu-ftpd ?
>2) I've tried to add up users and restrict them to the ftp home directory
>   as the base directory but it's not working and they are able to
>   go back pass the ftp base directory...
>   Do I have to add up a feature ? or is it impossible for a non-anonymous
>   user to have a restricted base directory ?
>   Here was my entry in the /etc/passwd if it's needeed...
>
>   felix:x:100:100:Felix Tran:/data/ftp/./felixhome:/bin/false

Are you using guestgroup?  see the man page for more information.

Brian Pape
Computer Resource Services
University California Los Angeles
[email-masked]

---

From: [email-masked] (Andy Church)
Date: Fri, 03 Oct 1997 02:23:53 EDT

>Okay okay.. So I choose my word 'cheat' badly.  How about 'clunky'?  And
>(unfortunately?) I am working on a Solaris box so...  That is where the
>'clunky' comes in.  Bad choice of words.

----------------------
#!/bin/sh
#
# Set up appropriate FTP files to allow chroot'd operation in a user's
# home directory.  This assumes the user is chroot'd to his/her home
# directory.  This also assumes a statically compiled `ls' is present in
# /bin/static/ls.

user=$1
if [ ! "$user" ] ; then
	echo >&2 "Usage: $0 <username>"
	exit 1
fi
pw=`grep \^${user}: /etc/passwd`
if [ ! "$pw" ] ; then
	echo >&2 "User $user not found!"
	exit 1
fi
dir=`echo $pw | cut -d: -f6`
if [ ! "$dir" -o ! -d "$dir" ] ; then
	echo >&2 Directory \""$dir"\"" for user $user does not exist!"
	exit 1
fi
mkdir $dir/bin
cp -p /bin/static/ls $dir/bin/ls
chmod 111 $dir/bin $dir/bin/ls
# If you're on Solaris, you'll need to uncomment the following lines:
#mkdir $dir/dev
#mknod $dir/dev/tcp c 11 42
#mknod $dir/dev/udp c 11 41
#mknod $dir/dev/zero c 13 12
#mknod $dir/dev/ticotsord c 105 1
#chmod 666 $dir/dev/*
#chmod 111 $dir/dev
----------------------

(Disclaimer: this may not work because I just wrote it in the last ten
minutes, including looking up the Solaris braindeath stuff.)

     Point:  chroot'd operation doesn't _have_ to be painful or "clunky".
A few extra files, even including a statically linked ls, is not going to
be significant compared to your average user's account size, and with
scripts like the above or programs which perform the setup automatically,
there's hardly any work involved.

  --Andy Church                  | If Bell Atlantic really is the heart
    [email-masked]       | of communication, then it desperately
    www.dragonfire.net/~achurch/ | needs a quadruple bypass.

---

From: Michael Brennen <[email-masked]>
Date: Fri, 3 Oct 1997 12:20:52 -0500 (CDT)

It will be quite clear from my response to Mr. Douglass that I was quite
angry.  I was very angry that for the second time in a week someone has
taken me to task for not handholding them through when a good body of
documentation has been built to answer exactly the questions asked. 

I have discussed this off list with Mr. Douglass.  I hold no unforgiveness
or anger against Mr. Douglass or any other person on this list, and I
genuinely hope that we can work to improve the quality of support.  This
stuff is not necessarily obvious, and people do run into questions. 

However: support on this or any other list is free, and it *MUST* have
limits. That is why the docs were written.  This is not Unix school; other
resources are available for that.  People are going to have to do the work
to learn it for themselves. 

No one on this list has *ANY RIGHT* to expect anything from other list
members.  This is a give and take list, and others' limits must be
respected.  Please approach the list with that attitude, and be willing to
work and even be frustrated to get your problems resolved -- just don't be
angry at other list members because we didn't answer your questions the
way you thought you deserved.

I give back where I can, because I have received from many others more
than I have ever given.  The guest howto is one way I try to give back. 
On the list I can usually give very little, very quickly, because I am
extremely busy running my own business first.  Mabye short answers seem
rude or curt;  they aren't meant to be. 

I have added the text below at the beginning of the guest howto to explain
more clearly what guest FTP is; hopefully this will make it more clear to
people new to wu-ftpd.  I would appreciate it if you would review it and
make suggestions that will make it more accurate or clear. 

   -- Michael

*******************************

There are three kinds of FTP logins that wu-ftpd provides:

  1: anonymous FTP
  2: real FTP
  3: guest FTP

Anonymous FTP is well known; one logs in with the username 'anonymous'
and an email type password.

Real FTP is when someone logs in with a real username and password and
has access to the entire disk structure.  This form of access can be
extremely dangerous to system security and should be avoided unless
absolutely necessary and well controlled.

Guest FTP is a form of real FTP; one logs in with a real user name and
password, but the user is chroot'ed to his home directory and cannot
escape from it.  This is much safer, and it is a useful way for remote
clients to maintain their Web accounts.

If you want to learn more about 'chroot', the following two commands
should help, as should any good Unix text.

man 2 chroot
man 8 chroot

This howto will describe in detail the steps necessary to set up a
guest FTP account.  It does not describe anonymous or real FTP setup,
though the procedures for setting up an operational 'ls' command will
apply equally to anonymous FTP because of the chroot'ed nature of
anonymous FTP.

(etc....)