Subject: How to limit directory access in wu-ftpd ?

From: Bernd Finger <[email-masked]>
Date: Tue, 02 Jun 1998 09:37:25 +0200

Hi,
I want to selectively limit directory write / read / browse (cd) access
for several users. See the following example:

DIR /tmp WRITE user1, user2, user3 READ user1 user2 CD ALL
DIR /home/user1 WRITE user1 READ user1 CD user1
DIR /download WRITE user2 READ ALL CD ALL
DIR /upload WRITE user2 user3 READ - CD user2 user3

(How) can this be done with wu-ftpd ?

Thanks a lot,

--
       _________-----___
Bernd (_FINGER_/_/--    \  email: [email-masked]
              (__|__O)      c.a.r.u.s., Borsteler Chaussee 49
               (___O)       22453 Hamburg, Germany
                (_O)____/  +49-40-51435-0 Fax -111

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 2 Jun 1998 06:39:27 -0400 (EDT)

Wu-ftpd uses your Unix ownership and permissions.  Some of what you want
can be handled with proper directory and file permissions.  In some places
you'll want to create special-purpose groups in /etc/group to help out. 
If your Unix supports it, the directory group-sticky bit will help out
too.  When permissions are not enough, the upload directive may be of
help.  Notice that when you're done, the permissions manage the case of
telnet/shell access as well for everything you're asking _except_ the /tmp
directory.

> DIR /tmp WRITE user1, user2, user3 READ user1 user2 CD ALL

On most Unix flavors /tmp _must_ be world-writable, so this is a case for
the upload statement.

> DIR /home/user1 WRITE user1 READ user1 CD user1

Use Unix permissions for this one.

> DIR /download WRITE user2 READ ALL CD ALL

Use Unix permissions for this one, too.

> DIR /upload WRITE user2 user3 READ - CD user2 user3

Permissions here, as well.

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Bernd Finger <[email-masked]>
Date: Tue, 02 Jun 1998 12:59:02 +0200

Gregory A Lundberg wrote:

> help.

Thanks, I'll look for the upload directive.

> Notice that when you're done, the permissions manage the case of

What I wanted was to exclude all others from access for /tmp, so for example
user3 is NOT allowed to read files in /tmp.

> Permissions here, as well.

That's not sufficient in my case. I want to limit access in a way that
everything that is not explicitly allowed is forbidden. In my example, cd,
read and write access to /usr should be forbidden for anyone.

On my and many other unix boxes, /usr has read and execute rights for
everyone:
$ ls -ald /usr
drwxr-xr-x  31 root     system      1024 Jun 02 08:07 /usr

That means that every ftp user would be able to cd to /usr which is not what
I want.

--
       _________-----___
Bernd (_FINGER_/_/--    \
              (__|__O)
               (___O)
                (_O)____/

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 2 Jun 1998 07:25:03 -0400 (EDT)

On Tue, 2 Jun 1998, Bernd Finger wrote:

> What I wanted was to exclude all others from access for /tmp, so for
> example user3 is NOT allowed to read files in /tmp. 

> everything that is not explicitly allowed is forbidden. In my example,
> cd, read and write access to /usr should be forbidden for anyone. 

What you want is to use chroot'd environment, then.  Read the guest howto.

----

---

From: Bernd Finger <[email-masked]>
Date: Tue, 02 Jun 1998 13:27:52 +0200

> What you want is to use chroot'd environment, then.  Read the guest howto.

Are you sure that I will be able to have several users with access restricted
by different passwords ? Or simply guests with no password (except an e-mail
address) ?

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 2 Jun 1998 08:51:54 -0400 (EDT)

> by different passwords ? Or simply guests with no password (except an e-mail

yes.

The location of the latest version of wu-ftpd can be found in the 
directory
 
      ftp://ftp.academ.com/pub/wu-ftpd/private/
 
You can't see the directory contents, so read the message informing you
of the actual filename to retrieve. It's there.
 
wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd FAQ:              http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

----