Subject: minor problem with guestgroup

From: Michael Douglass <[email-masked]>
Date: Tue, 11 Nov 1997 21:31:06 -0600

This user's home dir is '/web/www/htdocs/users/./t/test'.  Everything works
as designed--except for this one command--seems it's trying to use the
wrong side of the /./ for ~. :)

ncftp>cd ~
/web/www/htdocs/users: No such file or directory.

-- 
Michael Douglass
Texas Networking, Inc.

 "The past is a foreign country; they do things differently there."
      L. P. Hartley, British author. The Go-Between, Prologue (1953).

---

From: Jenice Darner <[email-masked]>
Date: Wed, 12 Nov 1997 07:56:41 -0500

> /web/www/htdocs/users: No such file or directory.

Why is his path set to '/web/www/htdocs/users/./t/test' and not to
'/web/www/htdocs/users/t/test/./'? Is there a reason for this? The whole
problem is that the path is expected to kave the current working dir at
the end of the line, ie '.'. putting it in the middle makes the program
(whatever is reading into /etc/passwd) think that at '.' the path is
complete.

You should pick up the O'Reilly book on Esential System Administration.
Reading it will help you understand these problems instead of guessing
at paths.

---

From: Michael Douglass <[email-masked]>
Date: Wed, 12 Nov 1997 08:56:22 -0600

On Wed, Nov 12, 1997 at 07:56:41AM -0500, Jenice Darner said:

You people don't understand.... You just don't understand, don't tell
me that I should really pick up the Essential System Administration
book...  I am _NOT_ guessing at paths..... ___I___ read the documentation
that came with wu-ftpd.... I states that you use the /./ to separate the
chrooted dir on the left-hand-side with the new-chrooted-home-dir on
the right hand side...  Before criticizing someone, make sure you
understand what they are talking about....

If there is still confusion, here is what I just sent to someone privately:

You misunderstand... The users 'test' has a home directory of
'/web/www/htdocs/users/./t/test'.  When he logs into the ftp
server, it does a chroot /web/www/htdocs/users, and then cds
into /t/test.  That works perfectly fine.  The user can cd all
over the place in the newly chrooted environment...  But cd ~
(to return to his home directory) causes the error shown below
because it is tryingo to cd to /web/www/htdocs/users (which
does not exist in the already chrooted environment).  It should
try to cd to /t/test as that is the 'full-path home dir' in the
chrooted environment.

-- 
Michael Douglass
Texas Networking, Inc.

---

From: Jenice Darner <[email-masked]>
Date: Wed, 12 Nov 1997 10:04:12 -0500

> understand what they are talking about....

key phrase here: the new-chrooted-home-dir on the right hand side... 

what does chrooted imply?

since you aren't going to take the advice you asked for seriously...and
as you stated to me, you are a "unix expert", then figure it out
yourself.

---

From: Ming Lu <[email-masked]>
Date: Wed, 12 Nov 1997 10:14:01 -0500 (EST)

On Wed, 12 Nov 1997, Michael Douglass wrote:

If the restricted user is "test", then it should be:

/web/www/htdocs/users/./test instead of /web/www/htdocs/users/./t/test

_ming

->On Wed, Nov 12, 1997 at 07:56:41AM -0500, Jenice Darner said:
->
->You people don't understand.... You just don't understand, don't tell
->me that I should really pick up the Essential System Administration
->book...  I am _NOT_ guessing at paths..... ___I___ read the documentation
->that came with wu-ftpd.... I states that you use the /./ to separate the
->chrooted dir on the left-hand-side with the new-chrooted-home-dir on
->the right hand side...  Before criticizing someone, make sure you
->understand what they are talking about....
->
->If there is still confusion, here is what I just sent to someone privately:
->
->You misunderstand... The users 'test' has a home directory of
->'/web/www/htdocs/users/./t/test'.  When he logs into the ftp
->server, it does a chroot /web/www/htdocs/users, and then cds
->into /t/test.  That works perfectly fine.  The user can cd all
->over the place in the newly chrooted environment...  But cd ~
->(to return to his home directory) causes the error shown below
->because it is tryingo to cd to /web/www/htdocs/users (which
->does not exist in the already chrooted environment).  It should
->try to cd to /t/test as that is the 'full-path home dir' in the
->chrooted environment.
->
->> Michael Douglass wrote:
->> > 
->> > This user's home dir is '/web/www/htdocs/users/./t/test'.  Everything works
->> > as designed--except for this one command--seems it's trying to use the
->> > wrong side of the /./ for ~. :)
->> > 
->> > ncftp>cd ~
->> > /web/www/htdocs/users: No such file or directory.
->> 
->> Why is his path set to '/web/www/htdocs/users/./t/test' and not to
->> '/web/www/htdocs/users/t/test/./'? Is there a reason for this? The whole
->> problem is that the path is expected to kave the current working dir at
->> the end of the line, ie '.'. putting it in the middle makes the program
->> (whatever is reading into /etc/passwd) think that at '.' the path is
->> complete.
->> 
->> You should pick up the O'Reilly book on Esential System Administration.
->> Reading it will help you understand these problems instead of guessing
->> at paths.
->
->-- 
->Michael Douglass
->Texas Networking, Inc.
->
-> "The past is a foreign country; they do things differently there."
->      L. P. Hartley, British author. The Go-Between, Prologue (1953).
->

============================================================================
Ming Lu                                              Email: [email-masked]
Network Tech Consulting Engineer                     Phone: 703-689-5290 (w)
Engineering Division                                        703-855-4194 (m)
Global One Telecommunications, LLT.                         703-716-0872 (h)
============================================================================  
"Do not pay attention to every word people say, or you may hear your
 servant cursing you ---- for you know in your heart that many times you
 yourself have cursed others."

---

From: Michael Douglass <[email-masked]>
Date: Wed, 12 Nov 1997 09:12:48 -0600

> as you stated to me, you are a "unix expert", then figure it out

Please see the post by "Alan J Rosenthal"... Uh, and he is the one that
put 'unix expert'...  You might want to grab those reading glasses
that you used to read that book you suggested.  You know, I don't
even understand where you are getting this fire under your butt
from...  But you have more than annoyed me.. I have given a
full-detailed-explanation of what WU-FTPD's documentation states
the guestgroup should work...  And you obviously can't read it....
Please leave this thread alone--unless you read and understand
it...

-- 
Michael Douglass
Texas Networking, Inc.

---

From: Michael Douglass <[email-masked]>
Date: Wed, 12 Nov 1997 09:19:40 -0600

> /web/www/htdocs/users/./test instead of /web/www/htdocs/users/./t/test

People... READ THIS!  This is from the damned documentation.  After you
read it, then try replying...  So far, only one person has verfied this
as a bug, and the rest has told me that I was setting it up wrong...

--DOCUMENTATION--
     guestgroup <groupname> [<groupname> ...]
          If a REAL user is a member of any of  <groupname>,  the
          session  is  set  up exactly as with anonymous FTP.  In
          other words, a chroot() is done, and  the  user  is  no
          longer  permitted  to issue the USER and PASS commands.
          <groupname> is a valid group from /etc/group (or  what-
          ever mechanism your getgrent(3) library routine uses).

          The user's home directory  must  be  properly  set  up,
          exactly  as anonymous FTP would be.  The home directory
          field of the passwd entry is divided  into  two  direc-
          tories.   The  first  field is the root directory which
          will be the argument to the chroot(2) call.  The second
          half  is the user's home directory relative to the root
          directory.  The two halves are separated by a "/./".

          Example:

          in /etc/passwd, the real entry:

          guest1:<passwd>:100:92:Guest
          Account:/ftp/./incoming:/etc/ftponly

          When guest1 successfully logs in, the ftp  server  will
          chroot("/ftp")  and then chdir("/incoming").  The guest
          user will only be able to access the  directory  struc-
          ture  under  /ftp  (which  will  look  and  act as / to
          guest1), just as an anonymous FTP user would.
--END DOCUMENTATION--

Now, the directory I choose to be the root of the chrooted environment
is /web/www/htdocs/users--why?  Because it is the highest-common-
directory in all of the home directories... So instead of setting up
/dev, /etc/, et al. in everyone's home directories I choose that one
directory--as it does what I want anyway.

Now, as for the right-hand-side being /t/test, just because the user's
login name is 'test', that doesn't mean that his home directory must
be 'test'.  We use the first letter to give a better distribution of
the home directories...  So the left-hand-side of /web/www/htdocs/users
tells wu-ftpd to chroot to that directory.  The right-hand-side gives
the chrooted-home-directory (ie the directory that you cd to for
that user's home directory)...

Understand?

Either way, I am done trying to get everyone to understand the problem--
it isn't _that_ big of an issue...  And as long as the people responsible
for coding understand (which I have a suspicion they will) that's the
important part.  But these postings have been to the list in an attempt
to explain the problem to the group at-large instead of answering all
of the private email I've gotten calling me a 'moron' and a 'lame person
who can't read FAQs'.

Thank you for your time,

--
Michael Douglass
Texas Networking, Inc.

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 12 Nov 1997 10:20:00 -0500 (EST)

Actually, some of us do look before we leap.

I've been playing and can verify that I'm seeing the same problem, and add
a little to it.

In the _users_ bin/etc/passwd the home directory should be relative to the
new chroot'd environment (in your case /t/test).

I played with cd ~, cd ~lundberg and cd ~testuser where all three exist in
the real system and in the chroot'd group and password files.  Without a
home directory entry in chroot'd passwd I get an error on all three forms.
With '/' (in my case) for home directories, cd ~ gives the error
'/home/users/lundberg does not exist .. it doesn't in the chroot
environment so cd ~ must be using the real /etc/passwd.  cd ~lundberg
works fine and moves me to '/'(chroot'd) as I'd expect so ~<name> uses the
chroot'd /etc/passwd.  cd ~testuser fails (unknown user name) when it
shouldn't (in my case I expected '/' also, but you might expect
/t/testuser in yours).  It appears there's confusion in the driver about
when to use which /etc/passwd for home directory searches and for ~<user>
lookups.

My testing was on my production server (beta 14) on Linux 2.0.30).  If I
ever get my testbed machine on the network again, I'll be re-testing on
beta 15 and 2.0.31

On Wed, 12 Nov 1997, Michael Douglass wrote:

> Date: Wed, 12 Nov 1997 08:56:22 -0600
> From: Michael Douglass <[email-masked]>
> To: [email-masked]
> Cc: WU-FTP discussion <[email-masked]>
> Subject: Re: minor problem with guestgroup
> 

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              email: [email-masked] [205.133.13.8]
Kettering, OH 45409-1615 USA    voice: +1 (937) 299-7653

---

From: Ming Lu <[email-masked]>
Date: Wed, 12 Nov 1997 10:24:31 -0500 (EST)

Hoops, it should be:

test:x:100:100:restrict user:/web/www/htdocs/users/./test/:/etc/ftponly

_ming
On Wed, 12 Nov 1997, Ming Lu wrote:

->On Wed, 12 Nov 1997, Michael Douglass wrote:
->
->If the restricted user is "test", then it should be:
->
->/web/www/htdocs/users/./test instead of /web/www/htdocs/users/./t/test
->
->_ming
->
->->On Wed, Nov 12, 1997 at 07:56:41AM -0500, Jenice Darner said:
->->
->->You people don't understand.... You just don't understand, don't tell
->->me that I should really pick up the Essential System Administration
->->book...  I am _NOT_ guessing at paths..... ___I___ read the documentation
[snip]

---

From: Ming Lu <[email-masked]>
Date: Wed, 12 Nov 1997 10:29:38 -0500 (EST)

I am engaging war here..:-) just try to help... I installed three guest
only servsers and had no such problem whatsoever... BTW, I ma using beta
15 and followed advices from:

ftp://ftp.fni.com/pub/wu-ftpd/guest-howto

Cheers

_ming

->On Wed, Nov 12, 1997 at 10:14:01AM -0500, Ming Lu said:
->
->> If the restricted user is "test", then it should be:
->> 
->> /web/www/htdocs/users/./test instead of /web/www/htdocs/users/./t/test
->
->People... READ THIS!  This is from the damned documentation.  After you
->read it, then try replying...  So far, only one person has verfied this
->as a bug, and the rest has told me that I was setting it up wrong...
->
->--DOCUMENTATION--
->     guestgroup <groupname> [<groupname> ...]
->          If a REAL user is a member of any of  <groupname>,  the
->          session  is  set  up exactly as with anonymous FTP.  In
->          other words, a chroot() is done, and  the  user  is  no
->          longer  permitted  to issue the USER and PASS commands.
->          <groupname> is a valid group from /etc/group (or  what-
->          ever mechanism your getgrent(3) library routine uses).
->
->          The user's home directory  must  be  properly  set  up,
->          exactly  as anonymous FTP would be.  The home directory
->          field of the passwd entry is divided  into  two  direc-
->          tories.   The  first  field is the root directory which
->          will be the argument to the chroot(2) call.  The second
->          half  is the user's home directory relative to the root
->          directory.  The two halves are separated by a "/./".
->
->          Example:
->
->          in /etc/passwd, the real entry:
->
->          guest1:<passwd>:100:92:Guest
->          Account:/ftp/./incoming:/etc/ftponly
->
->          When guest1 successfully logs in, the ftp  server  will
->          chroot("/ftp")  and then chdir("/incoming").  The guest
->          user will only be able to access the  directory  struc-
->          ture  under  /ftp  (which  will  look  and  act as / to
->          guest1), just as an anonymous FTP user would.
->--END DOCUMENTATION--
->
->Now, the directory I choose to be the root of the chrooted environment
->is /web/www/htdocs/users--why?  Because it is the highest-common-
->directory in all of the home directories... So instead of setting up
->/dev, /etc/, et al. in everyone's home directories I choose that one
->directory--as it does what I want anyway.
->
->Now, as for the right-hand-side being /t/test, just because the user's
->login name is 'test', that doesn't mean that his home directory must
->be 'test'.  We use the first letter to give a better distribution of
->the home directories...  So the left-hand-side of /web/www/htdocs/users
->tells wu-ftpd to chroot to that directory.  The right-hand-side gives
->the chrooted-home-directory (ie the directory that you cd to for
->that user's home directory)...
->
->Understand?
->
->Either way, I am done trying to get everyone to understand the problem--
->it isn't _that_ big of an issue...  And as long as the people responsible
->for coding understand (which I have a suspicion they will) that's the
->important part.  But these postings have been to the list in an attempt
->to explain the problem to the group at-large instead of answering all
->of the private email I've gotten calling me a 'moron' and a 'lame person
->who can't read FAQs'.
->
->Thank you for your time,
->
->--
->Michael Douglass
->Texas Networking, Inc.
->
-> "The past is a foreign country; they do things differently there."
->      L. P. Hartley, British author. The Go-Between, Prologue (1953).
->

---

From: Ming Lu <[email-masked]>
Date: Wed, 12 Nov 1997 10:43:15 -0500 (EST)

Here are my test results, followed with Gregory's test:

220 server1 FTP server (Version wu-2.4.2-academ[BETA-15](1)
Fri Nov 12:40:31 EST 1997) ready.
Name (19527.50.5:mlu):webuser
331 Password required for webuser.
Password:
230 User webuser logged in.  Access restrictions apply.
ftp> cd ~mlu
550 /home/mlu: No such file or directory.
ftp> pwd
257 "/webuser" is current directory.
ftp> cd ~
550 /home/web: No such file or directory.
ftp> cd ~anyone
550 Unknown user name after ~
ftp>  

Cheers

_ming

On Wed, 12 Nov 1997, Gregory A Lundberg wrote:

->Actually, some of us do look before we leap.
->
->I've been playing and can verify that I'm seeing the same problem, and add
->a little to it.
->
->In the _users_ bin/etc/passwd the home directory should be relative to the
->new chroot'd environment (in your case /t/test).
->
->I played with cd ~, cd ~lundberg and cd ~testuser where all three exist in
->the real system and in the chroot'd group and password files.  Without a
->home directory entry in chroot'd passwd I get an error on all three forms.
->With '/' (in my case) for home directories, cd ~ gives the error
->'/home/users/lundberg does not exist .. it doesn't in the chroot
->environment so cd ~ must be using the real /etc/passwd.  cd ~lundberg
->works fine and moves me to '/'(chroot'd) as I'd expect so ~<name> uses the
->chroot'd /etc/passwd.  cd ~testuser fails (unknown user name) when it
->shouldn't (in my case I expected '/' also, but you might expect
->/t/testuser in yours).  It appears there's confusion in the driver about
->when to use which /etc/passwd for home directory searches and for ~<user>
->lookups.
->
->My testing was on my production server (beta 14) on Linux 2.0.30).  If I
->ever get my testbed machine on the network again, I'll be re-testing on
->beta 15 and 2.0.31
->
[snip]

---

From: Michael Douglass <[email-masked]>
Date: Wed, 12 Nov 1997 09:42:54 -0600

On Wed, Nov 12, 1997 at 10:43:15AM -0500, Ming Lu said:

I thought that you didn't show the behavior?  Am I correct in saying
that webuser's home directory is listed as "/home/web/./webuser"?
Notice the cd ~ tries to cd to /home/web instead of /webuser.  That
is the error.

-- 
Michael Douglass
Texas Networking, Inc.

---

From: Brad Waite <[email-masked]>
Date: Wed, 12 Nov 1997 08:46:20 -0700

Michael, thanks for posting the documentation.  I was about to do the
same.  In my opinion, those who publicly (or privately) flame people,
and are found to be in error, should publicly (& privately) express
sincere apologies.  But that's just my opinion based on what I feel to
be common decency.  Of course, if decency was all that common, we
wouldn't have the flames we've seen today.

Now, as to your problem, I'm doing something of the same thing.  Here's
my passwd entries.

/etc/passwd:
    alex:<crypted word here>:2111:999:alex
FTP:/usr/ftpsite/./pub/uploads/users/alex:/dev/nul

/usr/ftpsite/etc/passwd:
    alex:x:2111:999:

When alex logs in, he's sitting in the real dir
"/usr/ftpsite/pub/uploads/users/alex".  cd'ing to "/" gets him to
"/usr/ftpsite".  Everything seems to be working just fine.  I'm running
beta-15, BTW

-Brad

---

From: Michael Douglass <[email-masked]>
Date: Wed, 12 Nov 1997 09:29:58 -0600

> test:x:100:100:restrict user:/web/www/htdocs/users/./test/:/etc/ftponly

Why?  Why would the following not work?  It's just adding one more
directorie's depth.

test:x:100:100:restrict user:/web/www/htdocs/users/./t/test/:/etc/ftponly

-- 
Michael Douglass
Texas Networking, Inc.

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 12 Nov 1997 10:58:10 -0500 (EST)

On Wed, 12 Nov 1997, Michael Douglass wrote:

> Date: Wed, 12 Nov 1997 09:42:54 -0600
> To: Ming Lu <[email-masked]>
> Cc: Gregory A Lundberg <[email-masked]>, [email-masked],
>     WU-FTP discussion <[email-masked]>

Cool.  Looks like there's two things going on here:

1) A bug in the interpretation of the home directory field of the passwd
   file.

2) A philosophy problem with which etc/passwd should be consulted.  I'd
   expect (more precisely, I'd prefer) the chroot'd etc/passwd be
   consulted.  I'd expect it because otherwise something is reaching
   outside the environment and that makes me a tad nervous.  I'd prefer
   it because that way the view of the environment is internally self-
   consistent and reveals nothing of the external environment.

   I use an automated script to set up new users and it's a rather
   simple thing for me to have it add the appropriate lines to two passwd
   files rather than just the one.

----

---

From: Michael Douglass <[email-masked]>
Date: Wed, 12 Nov 1997 10:09:57 -0600

>    consistent and reveals nothing of the external environment.

Agreed on both points.  However, I would ask that any 'fix' would ensure
that 'cd ~' would alway interpret based on the real /etc/passwd (store
the right-hand-side); and `cd ~username` use the chrooted etc/passwd.
Make sense to anyone else?

-- 
Michael Douglass
Texas Networking, Inc.

---

From: [email-masked] (Winfried Magerl)
Date: Thu, 13 Nov 1997 10:46:16 +0100 ("MET)

> test:x:100:100:restrict user:/web/www/htdocs/users/./t/test/:/etc/ftponly

It works !
I run a server with one chroot-directory and a lot of guest-users
with different home-directories.
It's exactly as described in the manpage and I see no problems.
The only difference to your line is, that I don't have a slash
following the home-directory (I think the only reason to have a
/ on the end ist to chroot to a home-directory, for example:
/web/www/htdocs/users/test/./)

Here a few lines from my /etc/passwd:

mp:x:115:111::/intranet/./intrahost/MP:/bin/true
oeatcit:x:116:112::/intranet/./docs/Mittel/KOeatcit:/bin/true
chestra:x:117:113::/intranet/./intrahost/chestra:/bin/true

regards

	winfried

-- 
Winfried Magerl - Internet Administration
Siemens Business Services, 81739 Munich, Germany
Internet-Mail: [email-masked]

---

From: Michael Douglass <[email-masked]>
Date: Thu, 13 Nov 1997 09:33:11 -0600

On Thu, Nov 13, 1997 at 10:46:16AM +0100, Winfried Magerl said:

What happens when you enter `cd ~`?

-- 
Michael Douglass
Texas Networking, Inc.

---

From: [email-masked] (Winfried Magerl)
Date: Thu, 13 Nov 1997 18:08:52 +0100 ("MET)

> What happens when you enter `cd ~`?

O.k., hier some things I try:

passwd-entry:
internet:x:105:1::/intranet/./intrahost:/bin/ksh

Name (intranet:internet): 
331 Password required for internet.
Password:
230 User internet logged in.  Access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd ~
250 CWD command successful.
ftp> pwd
257 "/intranet" is current directory.
ftp> cd /
250 CWD command successful.
ftp> cd ~
250 CWD command successful.
ftp> pwd
257 "/intranet" is current directory.

Hmmmm.....
realy suspicious .....
looks like ~ is expanded to the first part of the homedirectory
(there exist a real directory /intranet/intranet).
cd ~user works if you correct your <chroot>/etc/passwd.

I'm not shure how this problem should be solved.
Maybe something like this:
if you are a guest-user and the passwd has a "/./" then use the
second part of the homedirectory. But on the other side:
You are in a chroot-environment. Why should you reach
others homedirectory with ~user ???
Thats a feature which must only work for real users.
And yes, it works for real users ;-)

>From this point of view the only thing worth to fix is "cd ~".

regards

	winfried