Subject: guest account problems

From: Ming Lu <[email-masked]>
Date: Wed, 25 Mar 1998 14:26:24 -0500 (EST)

Hi all:

I sent this problem yestoday and so far has no answer. I guess that I did
not describe the problem clearly. Here is the problem:

I set up guest only account based on guetshowto and works fine in term of
uploading and downloading, but the user's personal web page can not be
seen because of "webuser:x:10000:10000:ftp web user
only:/export/home/web/./webuser/:/etc/ftponly". If I remove the dot
between web and webuser "webuser:x:10000:10000:ftp web user
only:/export/home/web/webuser:/etc/ftponly" and then everything would be
fine. BTW, the ftp directory is /export/home/web and all of ftponly users
are under /export/home/web.

I would be very gratefull if anyone can help me out this.

TIA

_ming

---

From: Michael Brennen <[email-masked]>
Date: Wed, 25 Mar 1998 13:35:48 -0600 (CST)

One thought right offhand is that somehow the directory permissions
are set wrong.  The low order bit (0111) has to be set for a user
(other than root) to have access to files in the directory, and the
high bit (0444) has to be set for the contents of the directory to be
visible. 

Another more likely possibility is that the external ls is not
installed properly in the chroot'ed tree.  The guest howto goes over
that in some detail. 

   -- Michael

---

From: Ming Lu <[email-masked]>
Date: Wed, 25 Mar 1998 16:00:57 -0500 (EST)

Well, the anonymous and guest users login fine and I can use any ftp
related commands with no problems at all. all of
/export/home/web/./webuser's directories have permissions 755. It is
frustrusting.... I really need help!

Best Regards

_ming

On Wed, 25 Mar 1998, Michael Brennen wrote:

->
->One thought right offhand is that somehow the directory permissions
->are set wrong.  The low order bit (0111) has to be set for a user
->(other than root) to have access to files in the directory, and the
->high bit (0444) has to be set for the contents of the directory to be
->visible. 
->
->Another more likely possibility is that the external ls is not
->installed properly in the chroot'ed tree.  The guest howto goes over
->that in some detail. 
->
->   -- Michael
->
->On Wed, 25 Mar 1998, Ming Lu wrote:
->
->> I set up guest only account based on guetshowto and works fine in term of
->> uploading and downloading, but the user's personal web page can not be
->> seen because of "webuser:x:10000:10000:ftp web user
->> only:/export/home/web/./webuser/:/etc/ftponly". If I remove the dot
->> between web and webuser "webuser:x:10000:10000:ftp web user
->> only:/export/home/web/webuser:/etc/ftponly" and then everything would be
->> fine. BTW, the ftp directory is /export/home/web and all of ftponly users
->> are under /export/home/web.
->
->

============================================================================
Ming Lu                                         Email: [email-masked]
Network Tech Consulting Engineer                Phone: 703-689-5290 (w)
Product Engineering                                    703-855-4194 (m)
Global One Telecommunications, LLT.                    703-689-6575 (f)
============================================================================  
"Do not pay attention to every word people say, or you may hear your
 servant cursing you ---- for you know in your heart that many times you
 yourself have cursed others."

---

From: Michael Brennen <[email-masked]>
Date: Wed, 25 Mar 1998 15:07:58 -0600 (CST)

I understand and sympathize with your frustration.  However, stop and
think about how *you* would debug this if you knew only what you have
posted to this list.  It isn't much, and what is probably more
critical is what you have *not* posted.  Frankly I've not even fully
understood exactly what the problem is, whether FTP or Web service
related, so it is hard to suggest areas to look.

If the Web server is not able to see the data because of the /./, what
Web server are you running?  Apache does not use the /etc/passwd file
and is not affected by the /./.

   -- Michael

---

From: Ming Lu <[email-masked]>
Date: Wed, 25 Mar 1998 18:03:36 -0500 (EST)

Thanks, you are right!

I am using Netscape Enterprise 2.1. Could that be a problem?

Best Regards

_ming

->
->I understand and sympathize with your frustration.  However, stop and
->think about how *you* would debug this if you knew only what you have
->posted to this list.  It isn't much, and what is probably more
->critical is what you have *not* posted.  Frankly I've not even fully
->understood exactly what the problem is, whether FTP or Web service
->related, so it is hard to suggest areas to look.
->
->If the Web server is not able to see the data because of the /./, what
->Web server are you running?  Apache does not use the /etc/passwd file
->and is not affected by the /./.
->
->   -- Michael
->
->On Wed, 25 Mar 1998, Ming Lu wrote:
->
->> Well, the anonymous and guest users login fine and I can use any ftp
->> related commands with no problems at all. all of
->> /export/home/web/./webuser's directories have permissions 755. It is
->> frustrusting.... I really need help!
->
->
->

---

From: Michael Brennen <[email-masked]>
Date: Wed, 25 Mar 1998 17:00:41 -0600 (CST)

I honestly don't know; I don't run the NS server.  Hopefully someone
on the list will have gone through this before. 

   -- Michael

---

From: Ming Lu <[email-masked]>
Date: Wed, 25 Mar 1998 18:13:23 -0500 (EST)

I am stll very gratfull for you and bob's help, it gives me the direction.
So far I was focusing on ftp server itself. I will check this out and let
your guys know.

Best Regards

_ming

->
->I honestly don't know; I don't run the NS server.  Hopefully someone
->on the list will have gone through this before. 
->
->   -- Michael
->
->On Wed, 25 Mar 1998, Ming Lu wrote:
->
->> I am using Netscape Enterprise 2.1. Could that be a problem?
->
->

---

From: Ming Lu <[email-masked]>
Date: Wed, 25 Mar 1998 19:08:56 -0500 (EST)

I just removed the dot  and I can see the web page very well, BUT, I tried
to login via ftp and I got error:

220 server1 FTP server (Version wu-2.4.2-academ[BETA-16](1) Sat Mar 25
23:56:30 EST 1998) ready.

Name (xxx.xxx.xxx.xxx:mlu):webtest
331 Password required for webtest.
Password:
230 User webtest logged in.  Access restrictions apply.
ftp> ls -al
200 PORT command successful.
425 Can't create data socket (0.0.0.0,20): No such file or directory.
ftp> quit
221 Goodbye.

Once I put the dot back, I got:

220 server1 FTP server (Version wu-2.4.2-academ[BETA-16](1) Sat Mar 25
23:56:30 EST 1998) ready.
Name (xxx.xxx.xxx.xxx:mlu): webtest
331 Password required for webtest.
Password:
230-Welcome, archive user!
230-
....
....
230 User webtest logged in.  Access restrictions apply.
ftp> ls -al
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
total 10
drwxr-xr-x   4 10006    40000        512 Mar 24 19:25 .
drwxr-xr-x   7 0        1            512 Mar 24 19:11 ..
drwxr-xr-x   2 10006    40000        512 Mar 24 19:25 public_html
drwxr-xr-x   2 10006    40000        512 Mar 24 19:20 tr
-rw-r--r--   1 10006    40000          8 Mar 24 19:19 ttt
226 Transfer complete.
remote: -al
309 bytes received in 0.59 seconds (0.51 Kbytes/s)
ftp> cd ..
250 CWD command successful.
ftp> ls -al
200 PORT command successful.
150 Opening ASCII mode data connection for /bin/ls.
total 18
drwxr-xr-x   7 0        1            512 Mar 24 19:11 .
drwxr-xr-x   7 0        1            512 Mar 24 19:11 ..
-r--------   1 0        1              0 Nov  4 18:25 .forward
-r--------   1 0        1              0 Nov  4 18:25 .rhosts
-rw-r--r--   1 0        1            479 Mar 24 19:15 .welcome.msg
lrwxrwxrwx   1 0        1              7 Nov  4 17:51 bin -> usr/bin
dr-xr-xr-x   2 0        1            512 Nov  4 18:06 dev
dr-xr-xr-x   2 0        1            512 Nov  4 17:57 etc
dr-xr-xr-x   5 0        1            512 Nov  4 17:49 usr
drwxr-xr-x   4 10006    40000        512 Mar 24 19:25 webtest
drwxr-xr-x   3 10005    40000        512 Mar 25 06:26 webuser
226 Transfer complete.
remote: -al
693 bytes received in 0.6 seconds (1.12 Kbytes/s)

Anyone has insights besides user's web page problems?

TIA

_ming

->

---

From: Michael Brennen <[email-masked]>
Date: Wed, 25 Mar 1998 18:03:45 -0600 (CST)

This is covered in the FAQ as well as in the guest howto (toward the
bottom).

   -- Michael

---

From: Ming Lu <[email-masked]>
Date: Wed, 25 Mar 1998 19:35:57 -0500 (EST)

Michael:

The reason I built the ueser 'webtest' home directory in the ftp server
directory is that I am trying to avoid create the /etc, /lib, and any
other directories in every ftponly user home directory. Here is the
directory layout:

drwxr-xr-x   7 root     other        512 Mar 24 22:11 .
drwxr-xr-x  19 root     staff        512 Mar 24 21:59 ..
-r--------   1 root     other          0 Nov  4 21:25 .forward
-r--------   1 root     other          0 Nov  4 21:25 .rhosts
-rw-r--r--   1 root     other        479 Mar 24 22:15 .welcome.msg
lrwxrwxrwx   1 root     other          7 Nov  4 20:51 bin -> usr/bin
dr-xr-xr-x   2 root     other        512 Nov  4 21:06 dev
dr-xr-xr-x   2 root     other        512 Nov  4 20:57 etc
dr-xr-xr-x   5 root     other        512 Nov  4 20:49 usr
drwxr-xr-x   4 webtest  web          512 Mar 24 22:25 webtest

Do I still have to build these directories in every ftp user's home
directory?

Best Regards

_ming

->
->This is covered in the FAQ as well as in the guest howto (toward the
->bottom).
->
->   -- Michael
->
->On Wed, 25 Mar 1998, Ming Lu wrote:
->
->> ftp> ls -al
->> 200 PORT command successful.
->> 425 Can't create data socket (0.0.0.0,20): No such file or directory.
->
->

---

From: kobayashi <[email-masked]>
Date: Thu, 26 Mar 1998 09:43:06 +0900

if wu-ftpd running on solaris 2.x, you should see man page(ftpd).
So you find how to set permission.

---

From: Ming Lu <[email-masked]>
Date: Wed, 25 Mar 1998 20:26:22 -0500 (EST)

Well, I don't think it was perssion problem though. But good point! The
server was in Africa and it belongs to our customer. I don't manage it,
they are having problems and my boss wants me to fix it.

OK, let me straight this out first.

Thinks

_ming
 
On Thu, 26 Mar 1998, kobayashi wrote:

->if wu-ftpd running on solaris 2.x, you should see man page(ftpd).
->So you find how to set permission.
->　
->
->Ming Lu wrote:
->
->> Michael:
->>
->> The reason I built the ueser 'webtest' home directory in the ftp
->> server
->> directory is that I am trying to avoid create the /etc, /lib, and any
->> other directories in every ftponly user home directory. Here is the
->> directory layout:
->>
->> drwxr-xr-x　　 7 root　　　　 other　　　　　　　 512 Mar 24 22:11 .
->> drwxr-xr-x　 19 root　　　　 staff　　　　　　　 512 Mar 24 21:59 ..
->> -r--------　　 1 root　　　　 other　　　　　　　　　 0 Nov　 4 21:25
->> .forward
->> -r--------　　 1 root　　　　 other　　　　　　　　　 0 Nov　 4 21:25
->> .rhosts
->> -rw-r--r--　　 1 root　　　　 other　　　　　　　 479 Mar 24 22:15
->> .welcome.msg
->> lrwxrwxrwx　　 1 root　　　　 other　　　　　　　　　 7 Nov　 4 20:51
->> bin -> usr/bin
->> dr-xr-xr-x　　 2 root　　　　 other　　　　　　　 512 Nov　 4 21:06
->> dev
->> dr-xr-xr-x　　 2 root　　　　 other　　　　　　　 512 Nov　 4 20:57
->> etc
->> dr-xr-xr-x　　 5 root　　　　 other　　　　　　　 512 Nov　 4 20:49
->> usr
->> drwxr-xr-x　　 4 webtest　 web　　　　　　　　　 512 Mar 24 22:25
->> webtest
->
->　
->
->

---

From: Ming Lu <[email-masked]>
Date: Wed, 25 Mar 1998 20:37:06 -0500 (EST)

OK, I checked this. The ftp server directory /export/home/web settings are
OK. I don't see any problem to set these directories owned by root. Let me
check something else.

_ming

---

From: Ming Lu <[email-masked]>
Date: Wed, 25 Mar 1998 20:50:00 -0500 (EST)

Michael:

I found the problem. In the /etc/passwd file I have:

webtest:x:10006:40000:Webtest:/export/home/web/./webtest/:/etc/ftponly

but in another passwd file which is located in ftp server directory
/export/home/web/etc had only:

root:x:0:1:Super-User:/:/sbin/sh

It was covered in the guest-howto point 5. So I put:

webtest:x:10006:40000:webtest:/export/home/web/./webtest/:/etc/ftponly

It works fine now.

I am sorry if my postings anoyied anyone here.

Best Regards

_ming

->

---

From: Michael Brennen <[email-masked]>
Date: Wed, 25 Mar 1998 21:50:42 -0600 (CST)

I haven't looked at the code, but I think this structure has to be
under the chroot point (/./).  I build this structure under every
user's chroot point, but I build hard links for the static 'ls' in
~/bin to avoid taking needless disk space.  I built a perl script to
build this account structure, so once the script is built the process
is painless. 

   -- Michael