Subject: Chroot'd server denying access to files

From: Leif Sawyer <[email-masked]>
Date: Tue, 7 Oct 1997 16:37:25 -0800

I'm trying to figure out how to deny user access to certain files.

I've got my system set up as a chroot'd server, and i've killed read
permissions on all the secured directories.  However, any user
can still type

> get /etc/passwd

and have the full password list.   Is there a way to secure this?

---

From: Michael Brennen <[email-masked]>
Date: Tue, 7 Oct 1997 19:58:49 -0500 (CDT)

> and have the full password list.   Is there a way to secure this?

In /etc/ftpaccess:

# Hobbit's debian extensions
noretrieve /etc/passwd /etc/group /etc/ /bin/ core

This is covered in the documentation included in the beta distribution. 

Read permissions have to do with reading the directory contents, not files
in the directory.  There is a big difference. 

As explained in the guest howto, you shouldn't have the full password list
in the chrooted account anyway.  It should be the absolute bare minimum,
with either bogus passwords or * where the passwords normally are. 

Are you sure the account is chrooted?

   -- Michael