Subject: Isn't there a better way?

From: "Sheryl A. Lemma" <[email-masked]>
Date: Fri, 14 Aug 1998 11:31:33 -0400

Hi all,

I've been searching the archives unsuccessfully for two days to find the
answer, thus this post. I hope I'm following this list's etiquette.

I recently installed WU-FTPD on my Digital Unix, 4.0D machine. The reason
for doing so is that we need a way to allow our students to ftp only in and
out of their home directories.

By reading, and re-reading, and RE-READING, I think the answer is that each
account needs to be set up with the proper password entries (i.e, the /./
notation) and a bin and an etc directory need to be created in their home
directories. The trouble is, we have over a thousand established accounts!!
That means a whole lot of manual entry or a programmatic fix. Is there a
better way for me to set this up? 

Looking forward to hearing from you.

Regards,

	Sheryl Lemma

% % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %
%  Sheryl A. (Campbell) Lemma                Internet: [email-masked]  %
%  Assistant Director                           Voice: (717)867-6060  %
%  Administrative Computing                       FAX: (717)867-6019  %
%                                                                     %
%            L E B A N O N    V A L L E Y    C O L L E G E            %
%                                                                     %
%  DEC Unix 3.2d-1, Coll: Live 14v5, Dev 15, Ben: Live 4.3, Dev 4.3   %
%                                                                     %
%                    Visit my Personal Web Page at                    %
%       http://www.geocities.com/Heartland/Plains/4407/index.html     %
%                                                                     %
%                Never underestimate the power of a smile!            %
% % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % %

---

From: Dave Wreski <[email-masked]>
Date: Fri, 14 Aug 1998 11:56:50 -0400 (EDT)

> better way for me to set this up? 

No, you should be able to create the bin, etc, lib, directories at the
same level of the home directories, instead of within each of them.  So
your root directory would be /home, for example, and then you would have:

/home/etc
/home/lib
/home/bin
/home/users

and

/home/users/student1
/home/users/student2

Then set up their /etc/passwd entries like this:

student1:x:500:500:Student 1:/home/./users/student1

and student1 will be placed right into her directory.  You might consider
placing each student in their own group.  This has the advantage of
preventing student2 from seeing student1's files.  Then place all ftp
users in one other group, and make them into a guestgroup.

So /etc/group would look like:

student1:500:student1
ftpusers:600:student1,student2,studentN...

and /etc/ftpaccess would contain a guestgroup like:

guestgroup ftpusers

Dave

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 14 Aug 1998 12:02:40 -0400 (EDT)

On Fri, 14 Aug 1998, Sheryl A. Lemma wrote:

> By reading, and re-reading, and RE-READING, I think the answer is that
> each account needs to be set up with the proper password entries (i.e,
> the /./ notation) and a bin and an etc directory need to be created in
> their home directories. The trouble is, we have over a thousand
> established accounts!!  That means a whole lot of manual entry or a
> programmatic fix. Is there a better way for me to set this up? 

No, I think you've got it.  At some point you'll have to go through the
passwd file and adjust all the home directory entries.  You'll also need
to have bin and etc directories in each student's home unless you modify
the security model a bit.  Symlinks won't work for the bin and etc
directories, but you should take a look at hard links or loop-back mounts
so you're not duplicating all the files.

The changeover is painful, but only happens once.  Change your new-account
setup process to handle the new requirements and you'll not have a
recurring problem.

As to the files duplication problem, I'd recommend looking at chroot'ing
to a common point.  for instance, I put all my users in /home/users and
only need one bin and etc directory (/home/users/bin, /home/users/etc)
since I chroot all my users with /home/users/./<username> in the password
file.  Only thing is I needed to make sure the users' directory
permissions kept them apart (chmod -R fixed that) and edit /etc/profile to
set a default umask of 022.  downside: users can get at each others files
if they want to.  upside: users can get at each others files if the want
to.

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195