Subject: GUESTGROUP vs. PRIVATE? ...

From: "David G. Mills" <[email-masked]>
Date: Tue, 14 Oct 1997 07:57:34 -0700

Howdy, Folks!

We're setting up a new server with a number of groups in our organization
that want anon ftp to the world, both read and write access. Each group
wants to maintain its privacy with respect to the others, and each wants to
ensure that only designated parties outside our org can see (and write)
their data.

I've been scratching my little noggin over the best way to enable certain
members of each group to post files into their group space while tightly
controlling who has write access to certain directories in my anon ftp
filespace.

I've been pondering the relative merits of using the ftpaccess "guestgroup"
directive vs. the "private yes" + "site group / gpass" method of
segregating users and filespace.

When would you tend to use one mechanism over the other?

All comments welcome, and THANKS!

david
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
David G. Mills / Systems Admin 

ISG (IPAC Systems Group) / Caltech

[email-masked]

626-397-7241

---

From: Michael Brennen <[email-masked]>
Date: Tue, 14 Oct 1997 17:08:27 -0500 (CDT)

> ensure that only designated parties outside our org can see (and write)
	
"Immovable Object Meets Irresistible Force"......

Sounds like you don't want anon ftp; you just want others outside the org
to have tightly controlled access to the FTP site. 

Very loose security would be to create different classes in ftpaccess from
different IP addresses / host names and restrict access that way.  That is
only as good as physical access to the machines allowed access, or
availability of an address block (from an ISP, for example). 

You could create guest accounts and distribute a username and password; 
you could also define multiple guest logins to a given account, with read
and write access based on owner and group permissions.  'yuk' seems an
appropriate descriptor for the ongoing admin headaches. 

If access must be really tight, I think there is a hack somewhere to use a
SecurID OTP dongle for authentication.  That adds to the per user cost,
but it is effective. 

Those are off the top of my head; more focused attention might turn up
more options that I've forgotten. 

   -- Michael