Subject: passwd file

From: "Fredrick D. Rappuhn" <[email-masked]>
Date: Fri, 05 Dec 1997 13:15:33 -0500

I have setup WU-FTPD Beta 15 and it seems to be working great on my
BSDI
 box.  I have setup about 5 virtual domains and so far so good.  The
 question that I have is this.  Is there anyway to have WU-FTPD use a
 different passwd file???  I would like to have my virtual domains to be

 totally separate.

 If this is possible, is it secure???

Plus, if it is not available, does anyone know when it might be?

 Thanks

 Fred Rappuhn

---

From: Kent Landfield <[email-masked]>
Date: Fri, 5 Dec 1997 12:39:20 -0600 (CST)

#  I have setup WU-FTPD Beta 15 and it seems to be working great on my BSDI
#  box.  I have setup about 5 virtual domains and so far so good.  The
#  question that I have is this.  Is there anyway to have WU-FTPD use a
#  different passwd file???  I would like to have my virtual domains to be
#  totally separate.
# 
#  If this is possible, is it secure???
# 
# Plus, if it is not available, does anyone know when it might be?

It is not currently possible but work is on-going with the newvirt-040
version of virtual domain support. (http://www.landfield.com/wu-ftpd/newvirt)
I are hoping to have it integrated shortly. (Hopefully within the next week.)

What I'm doing is wrappering the getpwnam(), endpwent(), getgrnam(),
endgrent() and the getgroups() functions. If you are using virtual_mode
and an alternate passwd/and or group file exists in that domains config
directory then it is used instead of the system one.

There is a problem here that can be easily dealt with via policy (and maybe
via software but I haven't figured that out yet unless I just forbid it).  

The problem is uid/gids.  If you have a virtual domain, the user and group 
ids used in the alternate password file better either not exist in the system 
passwd or group file or match the same user or group.  You would not want to 
this virtual domain software to create a new way to do group sharing... ;)  
If you could allocate a block of UIDs and GIDs to a single domain ...

As always I'm open to suggestions.

-- 
Kent Landfield                        Phone: 1-817-545-2502             
Email: [email-masked]             http://www.landfield.com/
Email: [email-masked]                   http://www.nfr.net/
Please send comp.sources.misc related mail to [email-masked]
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/

---

From: "Fredrick D. Rappuhn" <[email-masked]>
Date: Fri, 05 Dec 1997 14:00:21 -0500

Sounds great.  I look forward to installing it.  I am using BSDI 3.1, so I will
let you know if I have any problems on that platform.

In regards to the UID/GID issue, I am not a UNIX expert so forgive me if this
doesn't make sense.  What I am trying to accomplish is that I want to have many
virtual domains on my system.  I want each one to be able to have their own FTP
account and POP3 accounts.  I would like to allow them to add FTP/POP3 accounts
on their own.  And that these would stay only in their password file.  This would
allow each domain name to have say a username of george.  Plus it would prevent
someone from using a username and password that works on one domain and use it
with another domain on my system.  Since this password file is not the "real"
password file, couldn't each of the usernames have the same UID/GID in the domain
password file???

Are you going to post a message in this message group when the new version is
done???  I am willing to test it for you on BSDI 3.1...

Thanks

Fred Rappuhn

---

From: Kent Landfield <[email-masked]>
Date: Fri, 5 Dec 1997 15:02:52 -0600 (CST)

# Sounds great.  I look forward to installing it.  I am using BSDI 3.1, so I will
# let you know if I have any problems on that platform.

Thanks. I'll take you up on that. ;)

# In regards to the UID/GID issue, I am not a UNIX expert so forgive me if this
# doesn't make sense.  What I am trying to accomplish is that I want to have many
# virtual domains on my system.  I want each one to be able to have their own FTP
# account and POP3 accounts.  I would like to allow them to add FTP/POP3 accounts
# on their own.  And that these would stay only in their password file.  This would
# allow each domain name to have say a username of george.  Plus it would prevent
# someone from using a username and password that works on one domain and use it
# with another domain on my system.  

Hmm. I can't help you with the pop3 stuff.  Their configuration would need to be
altered to support this.  You could have different george accounts but the uid and
gid should not be the same.  If they were then one george could possibly overwrite
another's file if their uid was the same. 

#                                        Since this password file is not the "real"
# password file, couldn't each of the usernames have the same UID/GID in the domain
# password file???

>From ftp's perspective, the accounts will be real but separated. The system will
use the uids and gids as if they were real.

# Are you going to post a message in this message group when the new version is
# done???  I am willing to test it for you on BSDI 3.1...

Yes, I will post a message when it is available.  The first few sites will need to
be very brave. ;)  This will definitely need to be looked at by others before I'll
feel comfortable.

---

From: Duncan Sterling <[email-masked]>
Date: Fri, 5 Dec 1997 16:54:22 -0500 (EST)

I've just set up guest FTP on a RedHat Linux box, using wu-ftp
2.4.2b11-11. The set up went well, and guest FTP worked exactly as
advertised re: chroot, restricted cd, and so forth.

However, once this was set up, regular FTP user could no longer
successfully execute /bin/ls on their home directories, nor could they cd
above them! They could, however, put and get files.

I had only changed 3 things in /etc/ftpaccess from it's default settings: 

1) allowing overwrite permissions to guests and anonymous

2) adding the line: 

	"path-filter guest /etc/pathmsg ^[-A-Za-z0-9_\.]*$ ^\.  ^-"

3) adding the line:

	"guestgroup ftponly"

Eliminating these 3 lines from /etc/ftpaccess returns FTP access for real
users back to normal, but also allows guest users to cd out of their
assigned directories. 

Is this a bug in 11-11 which requires an upgrade, or am I getting
something totally goofed up here?  Any pointers would be greatly
appreciated... 

TIA,

--Duncan

Here's the full listing of my /etc/ftpaccess:
--------------------------------------------------------------------

class   all   real,guest,anonymous  *

email root@localhost

loginfails 5

readme  README*    login
readme  README*    cwd=*

message /welcome.msg            login
message .message                cwd=*

compress        yes             all
tar             yes             all
chmod		no		guest,anonymous
delete		no		guest,anonymous
overwrite	no		guest,anonymous
#overwrite      yes             guest,anonymous
rename		no		guest,anonymous

log transfers anonymous,real inbound,outbound

shutdown /etc/shutmsg

passwd-check rfc822 warn

#path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-

#guestgroup ftponly
---------------------------------------------------------------

---

From: "Fredrick D. Rappuhn" <[email-masked]>
Date: Fri, 05 Dec 1997 18:16:41 -0500

I would love to be one of those first few sites.  This will help out hosting companies
greatly and I really appreciate the effort you are putting into this.

Fred Rappuhn

---

From: Philip Gwyn <[email-masked]>
Date: Fri, 05 Dec 1997 19:56:15 -0500

At 12:39 PM 12/5/97 -0600, Kent Landfield wrote:
>It is not currently possible but work is on-going with the 
>newvirt-040 version of virtual domain support. 
>(http://www.landfield.com/wu-ftpd/newvirt) I are hoping to have 
>it integrated shortly. (Hopefully within the next week.)
>
>What I'm doing is wrappering the getpwnam(), endpwent(), 
>getgrnam(), endgrent() and the getgroups() functions. If you are 
>using virtual_mode and an alternate passwd/and or group file 
>exists in that domains config directory then it is used instead 
>of the system one.

Wouldn't it be a better idea to use PAM rather than re-inventing the wheel?

-Philip

---

From: "Fredrick D. Rappuhn" <[email-masked]>
Date: Fri, 05 Dec 1997 19:55:04 -0500

What exactly is PAM?  Never heard of that.

Fred

---

From: Kent Landfield <[email-masked]>
Date: Fri, 5 Dec 1997 22:19:25 -0600 (CST)

# At 12:39 PM 12/5/97 -0600, Kent Landfield wrote:
# >It is not currently possible but work is on-going with the 
# >newvirt-040 version of virtual domain support. 
# >(http://www.landfield.com/wu-ftpd/newvirt) I are hoping to have 
# >it integrated shortly. (Hopefully within the next week.)
# >
# >What I'm doing is wrappering the getpwnam(), endpwent(), 
# >getgrnam(), endgrent() and the getgroups() functions. If you are 
# >using virtual_mode and an alternate passwd/and or group file 
# >exists in that domains config directory then it is used instead 
# >of the system one.
# 
# Wouldn't it be a better idea to use PAM rather than re-inventing the wheel?

Implementing PAM would require total rewrites to the user authentication
section to accomadate it.  This is not something that I have time for at
the present time.  I do have time for the wrapper extensions as there are
so few places that I have to replace calls and so little code to write.

PAM is a good idea. This is exactly the type of thing I was talking about
the other day when I said things need to start moving faster.  I'd really
like to see it done but I have a problem to solve. And from the non-reaction
I received from my rant it doesn't look as if I'm going to get much help.
So I'll do it this way for now. If I'm the only one using it, so be it.
When people find time to think about doing it right we'll probably find a
near total code reorg is in order.

If this sounds bad I apologize. It was not meant to.  It's been a long day and
I nearly have the wrappers done...

---

From: Kent Landfield <[email-masked]>
Date: Fri, 5 Dec 1997 22:21:10 -0600 (CST)

# What exactly is PAM?  Never heard of that.

For more information on PAM take a look at

    http://www.rdg.opengroup.org/infosrv/XSSO/HTML/toc.htm