Subject: Re: XPOST: Using Guest FTP (wuftpd) with security models

From: Daniel Henry <[email-masked]>
Date: Mon, 10 Aug 1998 20:35:02 -0400

Great!  This sounds like it would work.  I can keep my groups completely
segregated from the guest access controls.  I'll try it and see if it works.

I also recieved this suggestion from Bob Luckin (thanks Bob, I've tested it
and it works!)  With this solution, I have to manage the /etc/ftpgroups
file.  With the "dual groups" solution Dave suggests below, I have to
manage dual groups.  To me, it's a toss up - except that maybe the dual
groups is cleaner  :)  ...although, I've always wanted to find a good use
for the site group command   - Finally!  ;)

===================================================
>From: Bob Luckin <[email-masked]>
>
>Daniel Henry wrote :-
...
>
>Have you tried allowing the webmaster to log in and change his group using
>the SITE GROUP and SITE GPASS commands ?  I use this on my site to allow
>certain anonymous users into password-protected areas (ie. the rights are
>open to the group, but not the world); but I expect it should work for
>regular users as well (if not, they can log in as anonymous and then switch
>to the group).
>
>The trick to making this work would be to _not_ add the webmaster to the
>user's group (so his directory does not get changed automatically), but let
>him use SITE GROUP and SITE GPASS to switch to the desired group instead.
>If his FTP client does not support the SITE command directly, then he can
>use QUOTE SITE GROUP and QUOTE SITE GPASS instead.
>
>To set this up, you need to set "private yes" in your ftpaccess file.
>You also need to make sure that the /etc/group file the webmaster will be
>accessing after logging in has a suitable encrypted password for each group
>you want him to be able to switch to.
>
>There's a bit more detail in the ftpaccess man page.
>
>I hope this helps...  Good luck !
>
>Cheers, Bob
>-- 
>Bob Luckin      [email-masked]
[http://www.dhc.net/~luckin/palindromes.html]
>On mega data disks, attempt FTP. An inapt FTP; met task's ID a tad. A gem,
no ?
==========================================================

At 07:15 PM 8/10/98 -0400, you wrote:
>We had a similar problem.
>
>Suppose "ftpguest" is the group that wu-ftp uses to sense that it should be
>chroot-ing to the users' home directories. Then put your guest users in
>that group.
>
>But make a new group, call it "xyz" for the project, and add the guests to
>that group as well. Then add your webmaster to the xyz group.
>
>Now go into your ftpaccess file and require that files written by the guest
>users have group "xyz" and permissions 0664 (say).
>
>For example:
>
>upload /usr/home/guest/ftpguest/guest1 /www yes guest1 xyz 0664
>upload /usr/home/guest/ftpguest/guest2 /www yes guest2 xyz 0664
>
>That way your guests can read and write to them, as can your webmaster, but
>he won't be chroot-ed because he's not a member of ftpguest.
>
>Dave
>
>At 6:11 PM -0400 8/10/98, Daniel Henry wrote:
>>Is anyone else using wuftpd for guest logins?
>>
>>When you do this,  a user (actual system userid, not an wuftpd userid)
>>ftp's to the server and gets chrooted to whatever home directory you
>>specified in /etc/passwd.  At that point, your guest has access to the
>>"home" directory (in my case,  this is a part of the web tree which this
>>person has access to for updates),  and can traverse the directory tree
>>downward to other directories.  When they try to move upwards, however,
>>they find that the "home" directory is their root,  and they can't back up
>>out of it.
>>
>>So far so good.
>>
>>Now add another user who needs the same kind of access to the same files.
>>Now you have to use the group security model to allow multiple people to
>>have write access to the same files.  You create a group,  make sure both
>>your users are members, chgrp all your files to that group, and add group
>>write permissions.
>>
>>Still fine with me.
>>
>>Now, say that you are the sys admin,  and your webmaster (responsible for
>>the whole site,  he coordinates with these "guest" users who maintain only
>>their portion of the site) says "I need access to the [guest user's] files,
>> but since they're owned by him,  and I'm not in his group, I can't touch
>>them."
>>
>>"No problem", you say, "I'll just add you to his group and you can do what
>>you want."  Now the fun begins, because wu-ftpd uses group membership to
>>manage "guest" access. When you add the webmaster to the "guest" group,
>>the webmaster ftp's in,  wu-ftp sees that he is a member of a "guest" group
>>and promptly chroot's him to his home directory - which is not where he
>>wanted to be - and now he can't access the web tree at all.
>>
>>Can anyone point out to me what I am missing?  Or is wuftpd taking my group
>>security model hostage and not allow me any wiggle room for ad hoc security
>>access?
>>
>>I'd be interested to hear your opinions on that or even on my methodology
>>here.  Maybe I'm overlooking a simple solution ... ?
>>
>>cheers,
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>Daniel Henry       U.S. Agency for International Development
>>Ph: 703.465.7146   Internet Data Services
>>Fx: 703.465.7189   <[email-masked]> <[email-masked]>
>
>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Daniel Henry       U.S. Agency for International Development
Ph: 703.465.7146   Internet Data Services
Fx: 703.465.7189   <[email-masked]> <[email-masked]>