Subject: Q: Configuration

From: "Michael Cook" <[email-masked]>
Date: Wed, 26 Aug 1998 11:13:08 -0400

Hello,
    Thanks for the reply! The reason they couldn't go deeper in the file
system is that I use a shell script to build a directory of user home pages
(this is a web server) and dynamically generate an html file from this
directory listing - any subdirectories would also be (erroneously) added to
this listing. I have attacked this from the other end, and changed the way
the listing is obtained, and now they can indeed go deeper into (their own)
directory tree with no problems.
    However, it still remains for me how to set up some users (users with
home pages hosted on this box) with ftp which would chroot them to their own
directory (not a common ftp area) without setting up libraries of commands
for each user, and still allow admins ftp access to the whole file system.
There will be no anonymous ftp on this box.
        Thanks again for the help,
            Michael

YOUR REPLY===========================

You're on the right track, although I don't see why the user cannot go
deeper into the directories for their web pages or why you're doing what
you're doing with customer commands. Just restrict the users to ftp by
making their shell /bin/false and adding /bin/false to /etc/shells. If
you don't want the admins outside the ftp area, but want to give them more
access, look at the upload, chmod, delete, rename and umask clauses for
ftpaccess and restrict them to ftp also. If there's something they need
special Unix file-access permissions for, set up your security model with
special group-ownership and permissions then check out SITE GROUP and
/etc/ftpgroups
----

Gregory A Lundberg Senior Partner, VRnet Company
1441 Elmdale Drive [email-masked]
Kettering, OH 45409-1615 USA 1-800-809-2195

ORIGINAL POST===========================

Hello all,
    I'm new to this list, so am not sure of protocol here, please forgive me
(this time) if I step on toes or overstep.
    I've just downloaded, compiled, and installed wu-ftp ver 2.4 on a Sun
Ultra Enterprise 2 running Solaris 2.5.1 with gcc 2.8.1. It runs in
conjunction with tcp wrappers. All works properly with the default settings,
but I would like to add my site-specific configurations. The box is a web
server with user homepages hosted on it. I would like administrators on the
box to have full ftp access to the box, but I would like hosted users to
only have access to their homepage directory (no cd up or down). I have no
need of anonymous ftp on this box. I would like all transfers to be logged.
I have read the docs and the FAQ and have come up with the following, if
there's an better way, please let me know!

        • Use ftpaccess with users in a guestgroup (to chroot them to their
home)
        • Leave admins alone

    The issues I see with this method are:

        • Would have to create a library of commands for this group - not
for each user I hope   = o
        • Do not add 'mkdir' or 'cd' to the above library
        • Create an entry in ftpaccess so they can't make .* files (ie
.cshrc)
        • Ease of adding (MANY) users - maybe /etc/skel could help with this
one

    Any advice would be greatly appreciated!!!
        Michael

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 26 Aug 1998 14:28:32 -0400 (EDT)

On Wed, 26 Aug 1998, Michael Cook wrote:

> home pages hosted on this box) with ftp which would chroot them to their
> own directory (not a common ftp area) without setting up libraries of
> commands for each user, and still allow admins ftp access to the whole
> file system. 

If you're referring to the bin/ and etc/ stuff needed to make things with
in the chroot'd nvironment for each user..

Look at loopback mounts.  Many Unix systems have the ability to create a
filesystem in a disk file and mount it whereever you want.  the specifics
differ, check the man pages and vendor documentation.  For instance, on
Linux, examples of how to set this up are in losetup(8).  Works great,
less filling!

----