Subject: XPOST: Using Guest FTP (wuftpd) with security models

From: Daniel Henry <[email-masked]>
Date: Mon, 10 Aug 1998 18:11:50 -0400

Is anyone else using wuftpd for guest logins?  

When you do this,  a user (actual system userid, not an wuftpd userid)
ftp's to the server and gets chrooted to whatever home directory you
specified in /etc/passwd.  At that point, your guest has access to the
"home" directory (in my case,  this is a part of the web tree which this
person has access to for updates),  and can traverse the directory tree
downward to other directories.  When they try to move upwards, however,
they find that the "home" directory is their root,  and they can't back up
out of it.

So far so good.

Now add another user who needs the same kind of access to the same files.
Now you have to use the group security model to allow multiple people to
have write access to the same files.  You create a group,  make sure both
your users are members, chgrp all your files to that group, and add group
write permissions.

Still fine with me.

Now, say that you are the sys admin,  and your webmaster (responsible for
the whole site,  he coordinates with these "guest" users who maintain only
their portion of the site) says "I need access to the [guest user's] files,
 but since they're owned by him,  and I'm not in his group, I can't touch
them."

"No problem", you say, "I'll just add you to his group and you can do what
you want."  Now the fun begins, because wu-ftpd uses group membership to
manage "guest" access. When you add the webmaster to the "guest" group,
the webmaster ftp's in,  wu-ftp sees that he is a member of a "guest" group
and promptly chroot's him to his home directory - which is not where he
wanted to be - and now he can't access the web tree at all.

Can anyone point out to me what I am missing?  Or is wuftpd taking my group
security model hostage and not allow me any wiggle room for ad hoc security
access?

I'd be interested to hear your opinions on that or even on my methodology
here.  Maybe I'm overlooking a simple solution ... ?

cheers,
Daniel Henry       U.S. Agency for International Development
Ph: 703.465.7146   Internet Data Services
Fx: 703.465.7189   <[email-masked]> <[email-masked]>

---

From: Bob Luckin <[email-masked]>
Date: Mon, 10 Aug 98 18:08:09 CDT

Daniel Henry wrote :-
> here.  Maybe I'm overlooking a simple solution ... ?

Have you tried allowing the webmaster to log in and change his group using
the SITE GROUP and SITE GPASS commands ?  I use this on my site to allow
certain anonymous users into password-protected areas (ie. the rights are
open to the group, but not the world); but I expect it should work for
regular users as well (if not, they can log in as anonymous and then switch
to the group).

The trick to making this work would be to _not_ add the webmaster to the
user's group (so his directory does not get changed automatically), but let
him use SITE GROUP and SITE GPASS to switch to the desired group instead.
If his FTP client does not support the SITE command directly, then he can
use QUOTE SITE GROUP and QUOTE SITE GPASS instead.

To set this up, you need to set "private yes" in your ftpaccess file.
You also need to make sure that the /etc/group file the webmaster will be
accessing after logging in has a suitable encrypted password for each group
you want him to be able to switch to.

There's a bit more detail in the ftpaccess man page.

I hope this helps...  Good luck !

Cheers, Bob
-- 
Bob Luckin      [email-masked]      [http://www.dhc.net/~luckin/palindromes.html]
On mega data disks, attempt FTP. An inapt FTP; met task's ID a tad. A gem, no ?

---

From: Daniel Henry <[email-masked]>
Date: Tue, 11 Aug 1998 09:07:17 -0400

Yes,  check out:
 http://www.landfield.com/wu-ftpd/guest-howto.html
It explains how to set up accounts which,  when the user FTPs in, will be
chrooted to their $HOME directory.  That prevents them from accessing any
directories above that.  You just set their home directory in /etc/passwd
to the directory you want them to have access to.
 
The reference above also discusses additional security measures you can
take to try to prevent them installing back doors.  You should do these,
but don't think it's entirely safe.

At 09:00 AM 8/11/98 +0100, Jhirley (Jay) Fonte wrote:
>Is there a way to limit the way wu-ftpd allows the user to move around in the
>directory structure.
>Ie that their $HOME is the root ??
>
>
>-j
>
>
>
>
>
>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>