Subject: non-anonymous users and standalone daemon

From: Felix Tran <[email-masked]>
Date: Thu, 2 Oct 1997 12:31:30 -0400 (EDT)

1) Lee McLoughlin wrote some modifications to the code to make the ftpd
   daemon run without the need of inetd.  It works really well and I'de
   like to thank him for his help, I'm wondering tought, is there any 
   chance that this feature will be officially implemanted in a 
   soon to come new release of wu-ftpd ?
2) I've tried to add up users and restrict them to the ftp home directory
   as the base directory but it's not working and they are able to
   go back pass the ftp base directory...
   Do I have to add up a feature ? or is it impossible for a non-anonymous
   user to have a restricted base directory ?
   Here was my entry in the /etc/passwd if it's needeed...

   felix:x:100:100:Felix Tran:/data/ftp/./felixhome:/bin/false

Thanks :)

/Felix

---

From: Michael Brennen <[email-masked]>
Date: Thu, 2 Oct 1997 11:44:09 -0500 (CDT)

>    user to have a restricted base directory ?

guest howto, FAQ, and mailing list archives will answer this.

   -- Michael

This is the location for the latest wu-ftpd.  You can't see the
directory contents, but get the file anyway.  It's there.

ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-15.tar.Z

wu-ftpd FAQ:  http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
              OR
              send mail to [email-masked]
              with a subject line: send faq

guest howto:  ftp://ftp.fni.com/pub/wu-ftpd/guest-howto
              OR
              send mail to "[email-masked]"
              (immediate autoresponder; subject does not matter)

wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

There are additional security references in the above docs.

---

From: Michael Douglass <[email-masked]>
Date: Thu, 2 Oct 1997 16:44:48 -0500

> guest howto, FAQ, and mailing list archives will answer this.

Let me just say this...  If they do, I wish, perhaps, you would point
him _and_ myself in the right direction inside these faqs....  I would
love to have this feature myself, but nowhere that I've read does it
explain to me how to do this--perhaps I haven't read the right FAQ and
whatnot since there seem to be quite a few, and all quite lengthy...

-- 
Michael Douglass
Texas Networking, Inc.

  "For all that you see, there is much hidden from your view;
   for all that you know, there is truth yet to be learned."
    - Me, some years ago.

---

From: Michael Douglass <[email-masked]>
Date: Thu, 2 Oct 1997 16:43:16 -0500

On Thu, Oct 02, 1997 at 12:31:30PM -0400, Felix Tran said:

I did this for one of our web sites.  It has been a while since
doing this--I hacked alot of work into the code base to make it
work.  I may be redoing my efforts again with an updated version
of wu-ftpd soon.  If there is a way of doing this without having
to do a bunch of hacks in the code, I'd love to know!

-- 
Michael Douglass
Texas Networking, Inc.

---

From: Michael Brennen <[email-masked]>
Date: Thu, 2 Oct 1997 17:53:35 -0500 (CDT)

> whatnot since there seem to be quite a few, and all quite lengthy...

DING!  Round 2.....

If you can't get it out of reading the material, another explanation won't
do it either.  If the steps spelled out for creating a chroot'ed account
don't make sense from what is already documented, write a better document
-- PLEASE!!! 

If you don't know what a chroot'ed account is (and I think you do): 

man 2 chroot
man 8 chroot

It tells you *exactly* how to do it, and many people over the past 2+
years can attest to that. 

Read it.  Do it.  Test it.  If it doesn't work, go to start of line. 

If after N iterations of the above it does not work, ask the list.  With
few exceptions it will work if you will follow it closely.

I've got a business to run.  If you want technical support, call me for a
contract and I'll teach you one on one until we're both blue in the face. 

   -- Michael

---

From: Michael Douglass <[email-masked]>
Date: Thu, 2 Oct 1997 19:30:13 -0500

On Thu, Oct 02, 1997 at 05:53:35PM -0500, Michael Brennen said:

Then you haven't read the question correctly.. DING, DING!!! Round three...
The question, as I have read it, and from what I would like is just as 
this fine person wrote it: "restrict them to their home directories"...
Now, a chrooted environment works nifty if you are doing ANONYMOUS FTP...
But that is not what we want--we want an ftp server that restricts people
to working in their home directory...  But we don't want to setup an
etc/ bin/ lib/ for every person on the planet... In otherwords, an ftpd
level restriction __not__ a lets-cheat-and-use-chroot level... For anonymous
ftp, chrooting is perfect...

> years can attest to that. 

I'm not an idiot...  I've done anonymous ftp before.. That's not what we
are asking about. Like he said is this a pre-done feature, or do we have
to program it in ourselves???

Simple, understand the question before giving a stock reply that doesn't
answer the question...

-- 
Michael Douglass
Texas Networking, Inc.

---

From: Jim Davis <[email-masked]>
Date: Thu, 2 Oct 1997 21:08:06 -0700 (MST)

On Thu, 2 Oct 1997, Michael Douglass wrote:

> level restriction __not__ a lets-cheat-and-use-chroot level...

I can't imagine you can program an ftpd-level restriction that's going to
be anywhere near as secure as one the kernel enforces -- ie, using chroot. 
Calling that a "cheat", is, well, weird.

(In fact it's not at all clear to me that's even possible with the current
ftpd code, but I haven't studied it at length.)

Now if the objection to the obvious (and well-tested) chroot solution is
the potential need to populate each /home/user with libraries and such,
then at least on some systems you may be able to dodge that.  On some
systems you may be able to build ls (or whatever you need them to run) 
statically; other systems, like Solaris, have 'loopback mounts' that let
you set up one directory of libraries and simply mount it under each
/home/user directory.  And on still other systems you may be able to use
hard links from one directory of libraries to each /home/user/lib, and
so on.

---

From: Michael Brennen <[email-masked]>
Date: Thu, 2 Oct 1997 23:11:55 -0500 (CDT)

> Then you haven't read the question correctly.. DING, DING!!! Round three...

I understood the question.  You haven't understood the answer. 

> this fine person wrote it: "restrict them to their home directories"...

Read the docs and get a clue.  chrooted environments for REAL user logins
are defined to be guest ftp, and it restricts them to their home
directories. 

Can it be said any more plainly? 

> Now, a chrooted environment works nifty if you are doing ANONYMOUS FTP...

A chrooted environment works nifty if you are a real user; it is called
guest FTP. 

Yes, anonymous FTP is chrooted; not all chrooted FTP is anonymous.  This
is not anonymous FTP. 

> to working in their home directory...  But we don't want to setup an

Read the docs and get a clue.  This is called guest ftp. 

> ftp, chrooting is perfect...

Setting up ~/etc, ~/bin, ~/lib is not absolutely necessary to the chroot. 

Some level of file structure is required to get an external ls and other
utilities to work, depending on whether or not ls is statically linked and
whether or not you want names or numbers to show for uid/gid in the ls. 

Read the guest howto; this is all covered in there. 

An FTP server cannot restrict people to their home directories
independently of the OS.  That is why chroot is necessary; it is an OS
level control.

Once you chroot, nothing outside the chroot point is available, including
/bin/ls.  That is why ~/bin/ls and so forth are necessary.

> to program it in ourselves???

This is not anonymous FTP.  Never has been.  Yes, it is a predone feature. 
Guest ftp has been available for a long time; you don't have to program a
thing.  All you have to do is read the existing documentation and do it. 

> Simple, understand the question before giving a stock reply that doesn't

Better yet, understand the answer that has been given by those that
understood the question long before you did. 

The question was understood and answered long ago.  The answers are stock
because the question is stock.  All you have to do is read the stock
answer and apply the stock solution. 

   -- Michael