Subject: Re: Help: I'm troubled with WareZ

From: Michael Brennen <[email-masked]>
Date: Mon, 1 Dec 1997 10:47:04 -0600 (CST)

On Sat, 29 Nov 1997, Yuan John Jiang wrote:

> My problem is that the uid, gid, mode and "nodirs" settings in
> the "upload" line seem to have no effect, and
> 1. WareZ guys can always create subdirectories under /incoming
> if /incoming has write permission for user "ftp";
> 2. Files uploaded and directories created under /incoming
> always has 0664 mode.

Put a line in ftpaccess like

upload /ftp_root_path /incoming yes root daemon 0400 nodirs

That way they cannot create directories and cannot read back or
overwrite any uploaded files.  If you can still create directories,
something may be wrong with the daemon. 

> My only defense is the OS mode setting of 0333 on the
> "/incoming" directory.  Then, I can't serve legitimate upload.

Set /incoming to 0733, owned by root.daemon or some other non
anonymous user.group.  That way they can create files but cannot read
the contents of the directory back. 

   -- Michael

---

From: "Gregory A. Parmer" <[email-masked]>
Date: Tue, 2 Dec 1997 11:39:55 -0600 (CST)

On Sat, 29 Nov 1997, Yuan John Jiang wrote:
> <snip>...
> How do I prevent creating subdirectories?  The "mkdir" line does
> not work.
> <snip...>

John,
  I got hit by them on Thanksgiving myself. The line that took care
of it for me (I think and hope) was...
upload /public/ftp /incoming yes ftp  other 0640 nodirs

  Our FTP site is primarily for local use, so I also defined "local"
and "remote" classes (set via IP address) and limited remote connections
to 5. If nothing else, this will slow down their progress if they should
get back in.

  I thought I had followed the setup instructions pretty closely, but
if I did and this wasn't in it I'd like to see this added.  BTW--Major
THANKS to the setup contributors! If Sun's docs were only half this
good....

later,
-greg

Greg Parmer
Network Engineer
AAES/ACES/COA at Auburn University, AL