Subject: wu-ftpd, guest's accounts

From: Max Chernykh <[email-masked]>
Date: Fri, 10 Jul 1998 10:55:35 +0800

Hi there!

I have problem.
Our users has some access to our ftp.

Has groups "wwwusers","wwwall","local","academ" in /et/group.
- wwwusers has 100 users
- wwwall has 300 users
- local has 10 users
- academ has 500 users
These groups has be "guest", i.e. "/./". 

Example of our ftpaccess:

guestgroup      ftp wwwall wwwusers local academ

autogroup       ftpadm   admin
autogroup       www      users
autogroup       tfi      users

class   admin    real       icc.ru ccsoan.irkutsk.su freemail.icc.ru
class   users    real       dima.icc.ru .il
class	local	 guest	    10.8.0.* 
class   wwwusers guest      195.46.97.141 195.46.97.142 195.206.40.4
194.206.40.* 195.206.46.* 
class   academ   guest      62.76.19.* 62.76.23.*
class   wwwall   guest      *
class   all      anonymous  *

For example, if user of group "local" cannot enter from 10.1.0.1, 
then he can enter as wwwall, because he has "guest"... Really?

Question, how can I separate access for these users?

Thanx...

-- 
Max Chernykh          / mailto:[email-masked]  http://www.irk.ru/~max /
Business Net-Irkutsk  / mailTo:[email-masked] http://www.dsi.ru      /

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 10 Jul 1998 10:00:51 -0400 (EDT)

> guestgroup      ftp wwwall wwwusers local academ

Anyone logging in who is a member of the Unix groups ftp wwwall wwwusers
local and academ is a guest user instead of a real user; they'll be
chroot'd.

> autogroup       tfi      users

This has to do with Unix permissions; class admin gets Unix group ftpadm
privileges.  Class users getsUnix group www permissions.  The autogroup
for tfi is ignored because class users has already matched the line above. 

> class admin    real       icc.ru ccsoan.irkutsk.su freemail.icc.ru

Real users .. those who are *NOT* members of the Unix groups listed on the
guestgroup .. logging in from these sites are members of the class admin
and therefore will received Unix group ftpadm privileges as well as their
real Unix user privileges.

> class users    real       dima.icc.ru .il

Same here, but the users get Unix group www privileges

> class	local	 guest	    10.8.0.* 

Guest users .. that is real Unix users who are members of the Unix groups
listed on the guestgroup .. from this segment of the private network are
class local.

> class wwwusers guest      195.46.97.141 195.46.97.142 195.206.40.4 194.206.40.* 195.206.46.* 

Guest users from these segments are class wwwusers.

> class academ   guest      62.76.19.* 62.76.23.*

Guest users from these segments are class academ

> class wwwall   guest      *

All other guest users are class wwwall.

> class all      anonymous  *

All anonymous users are class 'all'.

NB: real users who are not guest and do not come from one of the listed
domains are denied access since the have no class.

> then he can enter as wwwall, because he has "guest"... Really?

A real Unix user who is a member of the Unix group local loggin in from
10.1.0.1 is in class wwwall because the user is guest and not in one of
the previous network segments, the '*' catches this, yes.

> Question, how can I separate access for these users?

What do you mean?

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195