Subject: autogroup question

From: Kitty Smith <[email-masked]>
Date: Thu, 27 Aug 1998 16:58:48 -0700

I am running beta-11 on AIX 4.1.4.  Can someone please help me.  I am
trying to create two classes of anonymous users on my FTP site, local
and remote.  I basically want to restrict anonymous access to a
directory by IP, part of the anonymous FTP site available to all guests
and part available only to guests in our domain.  I have tried to follow
the example,  but maybe I am missing something.  I created a group
called ftplocal and gave R-X access to that group on the protected
directory.  Here is what my ftpaccess file looks like.

********************************************************************
autogroup ftplocal local

class remote     real,guest,anonymous *
class local        real,guest,anonymous 123.45.*.*

limit  anon   25   Any          msg.busy

passwd-check trivial    warn

readme  README*    login
readme  README*    cwd=*

message /welcome.msg            login
message .message                cwd=*

compress        yes             local remote
tar             yes             local remote

log commands real
log transfers anonymous,real inbound,outbound

delete       no   anonymous            # delete permission?
overwrite    no   anonymous,guest      # overwrite permission?
rename       no   anonymous,guest      # rename permission?
chmod        no   anonymous,guest      # chmod permission?
umask        no   anonymous,guest      # umask permission?

shutdown shutmsg

********************************************************************

Am I doing something wrong?  As anonymous I can access the directory
from within a telnet session, but I get access denied when using ftp.

Thanks.

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 27 Aug 1998 18:50:36 -0400 (EDT)

> class local        real,guest,anonymous 123.45.*.*

Move the class local line above the class remote.  Otherwise the * on
remove matches the local users first and the class local isn't used.

Make sure user 'ftp' is not in the ftplocal group.  It's usually in the
ftp group.  Neither the ftp user nor the ftp group should own any files on
your system.

The fully-public area should be a=rx and owned by somebody other than ftp
user or ftp group.  I'd suggest an ftpadmin user and group to own the
public site.

The ftplocal area should be ug=rx,o= and owned by somebody other than ftp;
group ownership must be ftplocal.  A good choice would be the ftpadmin for
the owning user.

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195