Subject: help with IRIX 6.2 & 6.4

From: Matt Cohen <[email-masked]>
Date: Mon, 09 Feb 1998 15:16:05 -0800

Hi all,

This posting is a thank you of sorts and a way for me to help out others
who are just installing wu-ftp and guest accounts.  Thanks again to all
who withstood my onslaught of questions.

Here is a help sheet for SGI of WU-FTP and guest ftp accounts for IRIX
6.2 & 6.4.

This what worked for me (I hope I didn't leave anything out...)

Installing WU/FTP

1) Download the installer from:
 ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-16.tar.Z
 (the "16" reflects the version.  Check to see which release is the most
current)
2) Uncompress it in a logical directory.
3) Read and follow the instructions in INSTALL.
3a) DO NOT copy the .gen files to .sgi as indicated
3b) from the directory you uncompressed wu-ftp, issue: ./build sgi
 you may get some warnings, but no errors
3c) make a backup of your existing ftp daemon (probably in
/usr/etc/ftpd)
3d) issue: ./build install
 This creates a new ftpd.  It may be helpful to create a new path for
this new ftpd and reflect this in /etc/inetd.conf.  An example is
/usr/etc/wuftp/ftpd.  You'll copy the newly created ftpd to this
directory and keep the original in its current location.  This is
helpful for debugging.
4) Edit /etc/inetd.conf to point to the new ftp deamon.  This file
should look something like this:
....
#ftp stream  tcp     nowait  root    /usr/etc/ftpd            ftpd -d
ftp     stream  tcp     nowait  root    /usr/etc/wuftp/ftpd      ftpd
-dla
...
* for chrooted guest accounts, be sure to run it with the -a option
5) restart inetd.conf by issuing the following command:
 /etc/killall -HUP inetd
6) copy the "ftponly" shell to your shell directory. Something like
/bin/ftponly.
 change the permissions to 755
7) edit /etc/shells to register this shell with the system.  It should
look like:
...
/bin/ftponly
/bin/csh
/bin/sh
...
8) Create this directory:
 /usr/local/lib/ftpd/
9) Create the ftpaccess file within /usr/local/lib/ftpd/
 It should look very similar to this:
...
guestgroup client

limit   all     10      Any             /etc/msgs/msg.dead

readme  README* login
readme  README* cwd=*

message /welcome.msg login
message .message            cwd=*

compress         yes             all
tar              yes             all

log commands real
log transfers anonymous,real inbound, outbound

shutdown         etc/shutmsg
email            [email-masked]

path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
...
*NOTE: The group you specify in 'guestgroup' (in this case, client) must
exist in /etc/group.
All of the guest users will be a part of this group.
10) create the ftpusers file within /usr/local/lib/ftpd/
 This file is blank and is not used in this application.
11) create the directory /usr/local/lib/ftpd/pids
12) create the file 'all' within /usr/local/lib/ftpd/pids
 this file is also blank, but the ftpd process ID is written here.
13) check your system for the following libraries:

c_dev.sw.speclib
compiler_dev.sw.specllib

These libraries are necessary for the ls command to function properly in
a chrooted environment.
If you do not have these, consult your SGI utility disks or the SGI
site.

14) Download the latest gnu fileutilities
15) Read the INSTALL file for instructions
15a) issue: ./configure
15b) Edit the src and lib Makefiles.
Make sure the CFLAGS and LDFLAGS are set to "-non_shared" before
building
 OR
setenv CFLAG -non_shared
setenv LDFLAG -non_shared
* NOTE: If you run configure after you make these changes, your changes
will be reset to the original default values.
15c) run make
15d) Within the src directory you should have created a new ls
excecutable.  issue 'file ls' and make sure it returns this file type:

ls: ELF 32-bit MSB mips-2 excecutable (not stripped) MIPS version1
*NOTE: you will copy this version of 'ls' to the /bin directory of each
chrooted guest's directory.

Creating chrooted guest accounts

16) edit /etc/group to create a group account for which all guest users
will be associated.
 example:
...
client::103:
...
17) edit /etc/passwd to create a guest user.
 example:
...
myguest:x:1000:103:guestftp:/your_system_root.../.../.../doc_roots/your_clients_doc_root/./:/bin/ftponly

...
*NOTE: the '/./' indicates the directory that will be chrooted.
18) Within chroot of your guest's account, create the following
directories:

~/myguest/bin dev lib etc
*change permissions to 555 for each.  Change ownership to root for each

19) in ~myguest/etc, create a passwd and group file.
 These should be very scaled down for security and really only include
the 1 line you added to the system's group and passwd files.  Change
permissions on these files to 444.  Change ownership to root.
20) in ~myguest/bin, copy the version of ls you made in step 15d.
 Change permissions to 755 and wonership to root.
21) in ~myguest/dev, issue the following command:
 mknod zero c 37 0
 Change permissions to 444.
22) To insure that all of this was configured correctly, an 'ls -l ./*'
at ~myguest should yeild:
ps 7% ls -l ./*
./bin:
total 544
-rwxr-xr-x    1 root     sys       275036 Feb  6 16:51 ls

./dev:
total 0
crw-r--r--    1 root     sys       37,  0 Feb  4 12:11 zero

./etc:
total 16
-r--r--r--    1 root     sys           64 Feb  6 14:36 group
-r--r--r--    1 root     sys           49 Feb  6 14:37 passwd
23) Add the following security touches:

cd to ~myguest
touch .rhosts .forward
chown root.root .rhosts .forward

Good Luck!
Matt Cohen - [email-masked]

---------------------------------------------------------