Subject: Re: non-anonymous users and standalone daemon

From: [email-masked] (Andy Church)
Date: Fri, 03 Oct 1997 00:21:36 EDT

>The question, as I have read it, and from what I would like is just as 
>this fine person wrote it: "restrict them to their home directories"...
>Now, a chrooted environment works nifty if you are doing ANONYMOUS FTP...
>But that is not what we want--we want an ftp server that restricts people
>to working in their home directory...  But we don't want to setup an
>etc/ bin/ lib/ for every person on the planet... In otherwords, an ftpd
>level restriction __not__ a lets-cheat-and-use-chroot level...

     "Cheat"?  That's what chroot is _designed_ for.  Imagine that wu-ftpd
_did_ have an option for a "restricted chdir", leaving the filesystem root
alone (no, it doesn't actually have such an option)... how long do you
think it would be before crackers found holes in it?  We have no trouble
whatsoever putting a copy of bin/ls in each user's anonymous FTP directory;
if you can't afford the space for that, get a bigger hard disk.  (And yes,
bin/ls is all you need [not counting Solaris dev/* braindeath].  Hint:
gcc -static)

  --Andy Church                  | If Bell Atlantic really is the heart
    [email-masked]       | of communication, then it desperately
    www.dragonfire.net/~achurch/ | needs a quadruple bypass.

---

From: Michael Douglass <[email-masked]>
Date: Fri, 3 Oct 1997 00:52:34 -0500

> bin/ls is all you need [not counting Solaris dev/* braindeath].  Hint:

Okay okay.. So I choose my word 'cheat' badly.  How about 'clunky'?  And
(unfortunately?) I am working on a Solaris box so...  That is where the
'clunky' comes in.  Bad choice of words.

-- 
Michael Douglass
Texas Networking, Inc.

  "For all that you see, there is much hidden from your view;
   for all that you know, there is truth yet to be learned."
    - Me, some years ago.