Subject: Group Access

From: Yilmaz Oztanir <[email-masked]>
Date: Wed, 29 Jul 1998 12:08:04 +0100

Hi

I'm having a couple of problems understanding the SITE GROUP and
SITE GPASS commands. I can get them to work by making a group in the
ftpgroups file. However, I am not sure what privileges this group has. I

want it to have the same privileges as the group it maps to in
/etc/group. Is this the case? If it is not the case, how do I get this
type of sublogin to work and give users access as defined in
/etc/groups.

Finally, if anyone could tell me how I get wu-ftpd to do a similar
feature to sublogins
as it does not do this.

Thanks for you help

Yilmaz

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 29 Jul 1998 10:01:19 -0400 (EDT)

On Wed, 29 Jul 1998, Yilmaz Oztanir wrote:

> I'm having a couple of problems understanding the SITE GROUP and SITE
> GPASS commands. I can get them to work by making a group in the
> feature to sublogins as it does not do this. 

To use SITE GROUP and SITE GPASS, you must have compiled the daemon
_without_ NO_PRIVATE defined in config.h (this is the default, you you
probably have it enabled there).  Next, you must include 'private yes' in
your ftpaccess.  Then you must create the ftpgroups file mapping a wu-ftp
group to a real Unix group.

Once you have passed GROUP and GPASS, your ftp session will have the
permissions of the Unix group, within the contraints of the other
ftpaccess statements.  So, while the group might have authority to write
in a directory, the upload, delete, etc., clauses in ftpaccess can still
prevent many of the increased features from taking effect.

One example use for wu-ftpd groups is to allow anonymous users who know
the group password the ability to view the contents of an incoming
directory which is unviewable to all other anonymous users.  Consider:

~ftp/incoming can be owned by ftpadmin/ftpadmin with permissions
u=rwx,g=rwxs,o=wx and the following appear in ftpaccess:

private yes
upload /home/ftp * no
upload /home/ftp /incoming* yes ftpadmin ftpadmin 440 nodirs

The upload clauses prevent uploading files anywhere in ~ftp except into
the incoming directory.  Uploaded files in the incoming directory will be
owned by the site admin user and group and be read-only.  the private
clause, however, means the ftpgroup file could contain a line such as:

siteadm:<crypt(pwd)>:ftpadmin

Now, when a logged-in anonymous ftp user issues the following:

SITE GROUP siteadm
SITE GPASS <pwd>

They will have group permissions.  In this example, they can now read the
contents of the incoming directory (ls, LIST, etc) as well as read the
contents of files in that directory.  such anonymous users could delete,
chmod, or rename files in the incoming directory as well _unless_ the
directory is g-w or ftpaccess includes:

chmod no anonymous
delete no anonymous
rename no anonymous

Unix files permissions still take effect, so even without the delete
clause, if we chmod o+t the incoming directory, delete would still be
disallowed, but at the Unix level, since the anonymous user has
ftp/ftpadmin privilege, o+t in the directory prevents non-owners from
deleting files, and the owner was set to ftpadmin by the upload clause.

In summary, yes, SITE GROUP is the sub-login you're looking for but I
would warn you to be _very_ careful in the security model you impose since
this feature, if improperly set up, can expose your entire system to
abuse. 

In my experience, people who are playing with SITE GROUP are usually
looking for the guest-group features instead of the GROUP sub-login
features.  Carefully examine what you're trying to accomplish and the
various security models available to you before choosing SITE GROUP over
guest-groups.  Almos always, guest-group is the correct choice.

For more about guest-groups and how to set them up, see the FAQ:

The location of the latest version of wu-ftpd can be found in the 
directory
 
      ftp://ftp.academ.com/pub/wu-ftpd/private/
 
You can't see the directory contents, so read the message informing you
of the actual filename to retrieve. It's there.
 
wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd FAQ:              http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195