Subject: Solutions for wu-ftpd on Solaris

From: "Marxen, Sara" <[email-masked]>
Date: Thu, 4 Jun 1998 10:41:30 -0700

> Greg, I wondered if you could elaborate on your setup mentioned below.
> Where exactly are the shared bin and ls directories, in /home/users?
> do you
> mean that all your users share a home directory and are chrooted to
> the 
> same dir?  or that within the /home/users dir there is a home dir for
> each 
> user that they are chrooted to when they login. 
> Sorry for all the questions but obviously I'm missing something and I
> need
> to do the same thing....
> Thanks
> 
> Given your environment, you're right.
> 
> here, my users are all on a single directory heirarchy (/home/users),
> each
> is in a private group, and permissions are forced to deny world or
> group
> write anywhere in /home/users .. so I can chroot to the common point
> and
> only need one copy of the bin/ and etc/ directories.
> 
> Using a copy of the ls (et al) is a very good idea, hardlinking is
> fine if
> you can do it.  I keep four copies myself (actually five, I have a
> secured version for intrusion detection): system, chroot'd user,
> anonymous
> ftp, guestgroup/dropbox (almost anonymous) chroot'd users.
> 
> ----
> 
> Gregory A Lundberg		Senior Partner, VRnet Company
> 1441 Elmdale Drive              [email-masked]
> Kettering, OH 45409-1615 USA    1-800-809-2195
> 
>

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 4 Jun 1998 14:17:29 -0400 (EDT)

On Thu, 4 Jun 1998, Marxen, Sara wrote:

> Where exactly are the shared bin and ls directories, in /home/users?  do
> you mean that all your users share a home directory and are chrooted to
> the same dir?  or that within the /home/users dir there is a home dir
> for each user that they are chrooted to when they login. Sorry for all
> the questions but obviously I'm missing something and I need to do the
> same thing.... 

dr-xr-xr-x   6 root     root         1024 May 11 14:52 /home/ftp
d--x--x--x   2 root     root         1024 Nov 17  1997 /home/ftp/bin
---x--x--x   1 root     root        58368 Nov 17  1997 /home/ftp/bin/compress
---x--x--x   1 root     root        99328 Nov 17  1997 /home/ftp/bin/gzip
---x--x--x   1 root     root       231612 Nov 17  1997 /home/ftp/bin/ls
---x--x--x   1 root     root       230400 Nov 17  1997 /home/ftp/bin/tar
d--x--x--x   2 root     root         1024 Jun  3 19:55 /home/ftp/etc
-r--r--r--   1 root     root          456 Apr 27 09:22 /home/ftp/etc/ftpconversions
-r--r--r--   1 root     root           13 Jun  7  1997 /home/ftp/etc/group
-r--r--r--   1 root     root           31 Jun  3 19:55 /home/ftp/etc/passwd
d-wx------   2 ftp      root         1024 Jun  3 22:14 /home/ftp/incoming
dr-xr-xr-x   3 root     root         1024 Jun  3 22:33 /home/ftp/pub
drwxr-xr-x  82 root     root         2048 May 31 16:34 /home/users
drwxr-x--x   2 root     root         1024 Feb  9 16:08 /home/users/bin
---x--x--x   1 root     root        58368 Nov 17  1997 /home/users/bin/compress
---x--x--x   1 root     root       127332 Feb  9 10:02 /home/users/bin/gzip
---x--x--x   1 root     root       231612 Nov 17  1997 /home/users/bin/ls
---x--x--x   1 root     root       366872 Feb  9 09:55 /home/users/bin/tar
drwxr-x--x   2 root     root         1024 May 31 16:32 /home/users/etc
-rw-r--r--   1 root     root          456 Feb  9 15:29 /home/users/etc/ftpconversions
-rw-r--r--   1 root     root         1650 May 31 16:32 /home/users/etc/group
-rw-r--r--   1 root     root         2330 May 31 16:32 /home/users/etc/passwd
drwxr-s--x  27 lundberg lundberg     2048 Jun  4 13:23 /home/users/lundberg
drwxr-s--x   4 owner    owner        1024 May  7 16:18 /home/users/owner
drwxr-s---   7 owner    guest        1024 Feb  6 09:49 /home/users/owner/ftp
d--x--x--x   2 root     root         1024 Nov 17  1997 /home/users/owner/ftp/bin
---x--x--x   1 root     root        58368 Nov 17  1997 /home/users/owner/ftp/bin/compress
---x--x--x   1 root     root        99328 Nov 17  1997 /home/users/owner/ftp/bin/gzip
---x--x--x   1 root     root       231612 Nov 17  1997 /home/users/owner/ftp/bin/ls
---x--x--x   1 root     root       230400 Nov 17  1997 /home/users/owner/ftp/bin/tar
d--x--x--x   2 root     root         1024 Apr 29 16:41 /home/users/owner/ftp/etc
-r--r--r--   1 root     root          456 Apr 29 16:41 /home/users/owner/ftp/etc/ftpconversions
-r--r--r--   1 root     root           52 Oct 30  1997 /home/users/owner/ftp/etc/group
-r--r--r--   1 root     root           63 Nov 13  1997 /home/users/owner/ftp/etc/passwd
drwx-ws--T   2 owner    guest        1024 Jun  4 12:43 /home/users/owner/ftp/incoming
drwx--s---   2 owner    guest        1024 Apr 29 16:47 /home/users/owner/ftp/private
drwxr-s---   2 owner    guest        1024 Apr 29 16:48 /home/users/owner/ftp/pub
drwxr-s--x   5 vrnet    vrnet        1024 May 19 00:04 /home/users/vrnet

Notice all files in /home/users/bin, /home/users/owner/ftp/bin and
/home/ftp are statically linked and are copies, not hard links (oh,
lookitthat, I guess I should update the ones in /home/ftp/bin and
/home/users/owner/ftp/bin). Also, notice that /home/ftp/incoming is a
loopback mount to limit the file sizes there.  I could do a read-only
lookback mount for bin as well but I'm not that paranoid (yet).

Notice also that, by default (I changed /etc/profile), all users have a
umask of 022 so any files or directories they create are safe from
overwriting by other users.  If users want to share files, they can .. but
they need to know the specific names.  The lack of world-read prevents
users from casually browsing each other's homes.  The anonymous ftp users
are notably absent from that rule. 

Contents of /home/users/etc/passwd:

root:*:0:0::/:
vrnet:*:100:100::/vrnet:
owner:*:101:101::/owner:
lundberg:*:102:102::/lundberg:
guest:*:103:103::/owner/ftp:

Contents of /home/users/etc/group:

root::0:root
vrnet::100:vrnet
owner::101:owner
lundberg::102:lundberg
guest::103:guest

Contents of /home/users/owner/ftp/etc/passwd:

root:*:0:0::/:
owner:*:101:101::/:
guest:*:103:103::/:

Contents of /home/users/owner/ftp/etc/group:

root::0:root
owner::101:owner
guest::103:guest

Contents of /etc/passwd:

root:*:0:0:root:/root:/bin/sh
ftp:*:14:50:FTP User:/home/ftp:/bin/false
vrnet:*:100:100:VRnet Company:/home/users/./vrnet:/bin/sh
owner:*:101:101:Dropbox Owner:/home/users/./owner:/bin/sh
lundberg:*:102:102:Gregory A Lundberg:/home/users/./lundberg:/bin/sh
guest:*:103:103:Dropbox Guest:/home/users/owner/ftp/./:/bin/false

Contents of /etc/group:

root::0:root
ftp::50:
ftponly::51:
ftpusers::52:vrnet,owner,lundberg
vrnet::100:vrnet,lundberg
owner::101:owner
lundberg::102:lundberg
guest::103:guest,owner

Contents of /etc/ftpaccess:

loginfails 3
class local  real,guest      *.vr.net localhost
class remote real,guest      *
class anon   anonymous       *
limit local  9 Any
limit remote 4 SaSu|Any1800-0600
limit remote 2 Any
limit anon   2 Any
readme README* login
readme README* cwd=*
message /welcome.msg            login
message .message                cwd=*
compress        yes             *
tar             yes             *
private yes
passwd-check rfc822 warn
log transfers real,anonymous,guest inbound,outbound 
shutdown /etc/shutmsg
chmod		no		anonymous
delete		no		anonymous
overwrite	no		anonymous
rename		no		anonymous
umask		no		anonymous
upload /home/ftp *          no
upload /home/ftp /incoming* yes root root 400 nodirs
path-filter anonymous,guest /etc/pathmsg ^[-A-Za-z0-9_\.]*$ ^\. ^-
autogroup ftponly local remote anon
guestgroup guest
upload /home/users/owner/ftp * no
upload /home/users/owner/ftp /incoming* yes owner guest 400 nodirs
guestgroup ftpusers
email [email-masked]
hostname ftp.vr.net
noretrieve /etc/passwd /etc/group /etc/ftpgroups core

----