Subject: guest accounts/passwd?

From: Michael Will <[email-masked]>
Date: Fri, 18 Sep 1998 11:44:44 -0400

Opps, (forgot to ask on other question).

If I'm restriciting each user to their own / directory, then what is the
need for the etc/passwd for?  Since the user actually has an account on the
machine do you need the etc/passwd file?

Michael

--
Michael Will                    |   Voice: (202) 767-9196 Ext. 226
Naval Research Lab Code 8140    |   Fax:   (202) 404-8918
4555 Overlook Ave. SW           |   E-mail: [email-masked]
Washington, DC 20375		|   Skypage: 1-800-SKY-PAGE #1528803

Key fingerprint =  B5BC B3BB 8995 D642 309F  9A12 9C4F D4A2 9774 DD13

---

From: Bob Luckin <[email-masked]>
Date: Fri, 18 Sep 98 12:00:28 CDT

> machine do you need the etc/passwd file?

The ls command uses etc/password to map the owner and group numbers
associated with a file into the equivalent names.

If the password file is not present, ls still works, but lists the actual
id numbers instead of the names.  If this is acceptable to you, then you
probably don't need a copy of etc/passwd.

If you do want to have the numbers mapped to names, I recommend you don't
copy the original /etc/passwd as-is - take a copy and replace the password
field with an asterisk for security purposes.  If you are using this with
guestgroups, you probably don't need the whole file anyway - just those
userids which are visible under the user's chrooted directory, which should
be quite a small number (say root, ftp, the user account itself).

Cheers, Bob
-- 
Bob Luckin    [email-masked]    "Many hands make a heavy arm"
                             [http://www.dhc.net/luckin/cgi-bin/misfortune.cgi]

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 18 Sep 1998 13:01:29 -0400 (EDT)

On Fri, 18 Sep 1998, Michael Will wrote:

> If I'm restriciting each user to their own / directory, then what is
> the need for the etc/passwd for?  Since the user actually has an
> account on the machine do you need the etc/passwd file?

The ls command uses it to display names instead of numbers.  Also the
daemon can use it to allow ~name style accesses.

If you don't mind seeing numeric owner and group in the directory listing,
you can do away with etc/passwd and etc/group in each chroot'd area.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Scott Parmenter" <[email-masked]>
Date: Fri, 18 Sep 1998 10:55:24 -0700

> associated with a file into the equivalent names.

I want to apologize in advance for this question.  I know it's a FAQ, and I've
spent plenty of time searching for its solution, but to no avail.  It's the old "ls
-l gives UID and GID, not user and group names" thingee.  I've got hacked down
passwd and group files (world readable at the moment) in the chrooted /etc dir.
The /etc is at the same level as the /bin, /dev, and /usr dirs and they're being
accessed properly.  That is, ls -l for a guest user gives time stamp info, etc.
just not user and group names.  Any ideas what I'm doing wrong?

Scott

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 18 Sep 1998 14:21:41 -0400 (EDT)

On Fri, 18 Sep 1998, Scott Parmenter wrote:

> I've got hacked down passwd and group files (world readable at the
> moment) in the chrooted /etc dir. The /etc is at the same level as the
> /bin, /dev, and /usr dirs and they're being accessed properly.  That
> is, ls -l for a guest user gives time stamp info, etc. just not user
> and group names.  Any ideas what I'm doing wrong?

Probably a typo in the 'hacked-down' passwd and/or group files.

--

---

From: "Scott Parmenter" <[email-masked]>
Date: Fri, 18 Sep 1998 11:36:23 -0700

> Probably a typo in the 'hacked-down' passwd and/or group files.

Maybe you can see my error.  Here are the files:

/etc/passwd
root:x:0:1::/:
user1:x:2152:21::/user1:
user2:x:2153:21::/user2:

/etc/group
root::0:
client::21:

Scott

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 18 Sep 1998 15:16:16 -0400 (EDT)

> Maybe you can see my error.  Here are the files:

I had a problem once with a missing newline at the end-of-file.

I've heard of others who used a DOS/Windoze editor (probably notepad) to
create the file and had un-viewable characters (\r .. ASCII returns) in
the file.

Once, a former network admin here upgraded the libraries and kernel but
didn't change the ls program in the ftp area .. it was broken until I
built a new one.  Which is the reason I build static binaries for ftp
nowadays.

Does the output for 'ls -al' look identical to the output for 'ls -aln'?

Play with it, try adding a shell on the end.  Maybe your ls doesn't like
missing parts.  Maybe the :x: should just be :: (it's good enough, the
password fields aren't used after all).

It seems to me that once, several months ago, someone had a problem like
this and it turned out he'd made copies of passwd and group into several
places .. imagine his chagrin when he realized he'd been changing the
wrong ones!  For real users, the daemon uses the real /etc/passwd.  For
anonymous, it uses ~ftp/etc/passwd.  For guests it uses the chroot'd one
(ie., if home is "/home/users/./user1" it uses /home/users/etc/passwd). He
had originally tried "/home/users/user1/./" and changed and forgot that ..
editing /home/users/user1/etc/passwd just didn't seem to have any effect!

--

---

From: "Scott Parmenter" <[email-masked]>
Date: Fri, 18 Sep 1998 12:35:24 -0700

> Does the output for 'ls -al' look identical to the output for 'ls -aln'?

Yes.

> password fields aren't used after all).

Well, I'll keep fiddling with it.  And there's always the possibility that
this a "feature" of the operating system.  Trusted Solaris may not allow a
chrooted passwd file on a CMW to be valid, even for something innocuous like
this.

Thanks for your support!

Scott

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 18 Sep 1998 15:43:14 -0400 (EDT)

On Fri, 18 Sep 1998, Scott Parmenter wrote:

> Well, I'll keep fiddling with it.  And there's always the possibility
> that this a "feature" of the operating system.  Trusted Solaris may
> not allow a chrooted passwd file on a CMW to be valid, even for
> something innocuous like this.

I believe it works, and I believe theres a command you need to run to make
things right.  I dunno Solaris specifics, tho.  The FAQ and the following
document are the extent of my knowledge:

>From [email-masked] Fri Sep 18 15:40:55 1998
From: Auteria Wally Winzer Jr. <[email-masked]>
To: Gregory A Lundberg <[email-masked]>

OK.  Actually for Solaris it does not matter whether you have dynamic
or static executables, for the installation instructions for anonymous FTP
for Solaris is different.  I'll attach the HOW_TO file that comes with
the WU-FTPD package so you can see exactly how it is laid out.

- Wally

-------------------------------------------------------------------------
File: HOW_TO_SETUP_AN_FTP_SERVER

                        HOW TO SETUP AN SECURE FTP SERVER
                 NOTE: The following instructions are applicable
                       for Solaris 2.x (2.5.1, 2.5, 2.4) only.
                 2nd NOTE: This setup is for WUARCHIVE-ftp 2.4.2
                           beta15 (wu-ftpd) as well as the
                           vendor's version (Solaris).

IMPORTANT NOTE!!!!!!!!!!!!!!!!!!!
You can run in.ftpd as a stand-alone daemon by adding the "-S"
option.  An rc script is provided with this distribution.  The rc script
filename is "/etc/init.d/wu-ftpd".  To execute the script type at the
command prompt as root "/etc/init.d/wu-ftpd start".  To shutdown the
wu-ftpd daemon type "/etc/init.d/wu-ftpd stop".  Before you use the
stand-alone daemon you must put a "#" in front of the "ftpd" line
within the "/etc/inetd.conf" file.  Send a SIGHUP to inetd in order
for inetd to re-read its configuration file.

1. Add usr "ftp" to the "/etc/passwd" file.
   NOTE: If the user name appears in the file "ftpusers", ftp access is denied.
2. Create an "ftp" home directory owned by "root" that cannot be written to by
   anyone.
3. Create a "bin" directory under the "ftp" home directory that is owned by
   "root", and that cannot be written to by anyone.  The "ls" program should
   be placed in this directory and changed to mode 111 (excute-only).  Also
   for "wu-ftpd" copy GNU's version of "tar" (gtar) , "compress", "gzip", and
   "gunzip" into the "bin" directory under the "ftp" home directory.  This
   is necessary for wu-ftp to compress and uncompress zipped files (*.Z, *.gz).
4. Create an "etc" directory in the "ftp" home directory that is owned by root,
   and that cannot be written to by anyone. Create special "passwd", "group",
   and "shadow" files in this directory and change the mode of both files
   to 444 (read-only).
5. Create a "pub" directory in the "ftp" home directory that is owned by root
   and is mode 755 (read, and execute).  This is the only directory
   where anonymous "ftp" users can store files.  If you don't want to allow
   remote users to store files on your server, change the mode of this directory
to 444 (read-only).

wu-ftpd authenticates users according to four rules:

a. The user name must be in the password data base, /etc/passwd, and have a
   password that is not null.  A password must always be provided by the
   client before any file operations may be performed.
b. If the user name appears in the file /etc/ftpusers, ftp access is denied.
c. ftp access is denied if the user's shell (from /etc/passwd) is not listed
   in the file /etc/shells.  If the file /etc/shells does not exist, then the
   user's shell must be one of the following:
                /usr/bin/sh  /usr/bin/csh /usr/bin/ksh
                /usr/bin/jsh /bin/sh      /bin/csh
                /bin/ksh     /bin/jsh     /sbin/sh
                /sbin/jsh
d. If the user name is "anonymous" or "ftp", an entry for the user name ftp
   must be present in the password and shadow files.  The user is then
   allowed to log in by specifying any password by convention this is given
   as the user's e-mail address (such as [email-masked]).  Do not specify
   a valid shell in the password entry of the ftp user, and do not give it a
   valid password (use NP in the encrypted password field of the shadow file).

IMPORTANT NOTE: The anonymous FTP root directory (~ftp) and its subdirectories
should not be owned by the ftp account or be in the same group as
the ftp account.  This is a common configuration problem.  If any of
these directories are owned by ftp or are in the same group as the
ftp account and are not write protected, an intruder will be able to
add files (such as a .rhosts file) or modify other files.  Many sites
find it acceptable to use the root account.  Making the ftp root
directory and its subdirectories owned by root, part of the system
group, and protected so that only root has write permission will help
to keep your anonymous FTP service secure.

Here is an example of an anonymous FTP directory setup:

        drwxr-xr-x  7   root    sys  512 Mar 1       15:17 ./
        drwxr-xr-x 25   root    sys  512 Jan 4       11:30 ../
drwxr-xr-x  2   root    sys  512 Dec 20      15:43 bin/
        drwxr-xr-x  2   root    sys  512 Mar 12      16:23 etc/
        drwxr-xr-x 10   root    sys  512 Jun 5       10:54 pub/

Files and libraries, especially those used by the FTP daemon and
those in ~ftp/bin and ~ftp/etc, should have the same protections
as these directories.  They should not be owned by ftp or be in the
same group as the ftp account; and they should be write protected.

THE FOLLOWING EXAMPLES SHOW EACH OF THESE STEPS.  First, create the "ftp"
home directory and the required subdirectories.  In our example, we create
the "ftp" directory under the "/export" directory:

        # mkdir -p /export/ftp
        # cd /export/ftp
        # pwd (should show /export/ftp)
        # mkdir bin etc pub

Then copy "ls" to /export/ftp/bin, and set the correct permissions:

        # cp /usr/bin/ls /export/ftp/bin
        # chmod 00111 /export/ftp/bin/ls

Copy "gzip", "gtar", "tar", "pipe", and "compress" to /export/ftp/bin, and
set the correct permissions:

        # cp /usr/local/etc/wu-ftp2.4.2-beta15/bin/gzip /export/ftp/bin
        # chmod 00111 /export/ftp/bin/gzip
        # cp /usr/local/etc/wu-ftp2.4.2-beta15/bin/gtar /export/ftp/bin
        # chmod 00111 /export/ftp/bin/gtar
        # cp /usr/local/etc/wu-ftp2.4.2-beta15/bin/tar /export/ftp/bin
        # chmod 00111 /export/ftp/bin/tar
        # cp /usr/local/etc/wu-ftp2.4.2-beta15/bin/pipe /export/ftp/bin
        # chmod 00111 /export/ftp/bin/pipe
        # cp /usr/local/etc/wu-ftp2.4.2-beta15/bin/compress /export/ftp/bin
        # chmod 00111 /export/ftp/bin/compress

Create a "hard link" for "gunzip" to "gzip and "uncompress" to "compress":

        # ln /export/ftp/bin/gzip /export/ftp/bin/gunzip
        # ln /export/ftp/bin/compress /export/ftp/bin/uncompress

NOTE: IF YOU DON'T HAVE "gzip" or "gtar" you can grab the source code from
GNU's main ftp site "prep.ai.mit.edu" under "/pub/gnu", or you can copy the
above files from the "/usr/local/wu-ftp2.4.2beta15/bin" directory.

Create a group that will only be used by anonymous "ftp", a group that has no
other members.  In our example we create a group called "anonymous".  An entry
for this new group is added to the "/etc/group" file, and a file named
"/export/ftp/etc/group" is created that contains only this single entry:

        anonymous::30000:

If you're installing the ftp server on a Solaris system you can use the
"groupadd" command:

        # groupadd -g 30000 anonymous

Create a user account "ftp" by placing an entry for that user in the file
"/etc/passwd".  Also create a file named "/export/ftp/etc/passwd" that contains
only the "ftp" entry.  Here's the entry that was used in this file:

        ftp:x:30000:30000:Anonymous FTP:/export/ftp:/bin/true

After modifying "/etc/passwd" type "pwconv".  A line will be created within
the "/etc/shadow" file for encryption of user "ftp".  Place a "NP" within
the encryption field.  For example if the original line looks like this:

        ftp::10234::::::

place "NP" between the first 2 colons.  Now the line should look like this:

        ftp:NP:10234::::::

Replace the field "10234" with "6445".  Now the line should look like this:

        ftp:NP:6445::::::

Now create the "/export/ftp/etc/passwd" and add the "ftp" entry only.
Modify the ftp line so that it is different than the line placed within
"/etc/passwd".  Add a root line within "/export/ftp/etc/passwd".  Add a
bogus user that will be maintained by "~ftp/pub/*".  The three lines should look
like the following:

        root:x:0:0:FTP Maintainer::
        agent007:x:20000:20000:Auteria Wally Winzer Jr.::
        ftp:x:30000:30000:Anonymous FTP::

Create "/export/ftp/etc/shadow" and add the "ftp", "root", and
"agent007" entry only.  The line should look exactly like the "ftp" line:

        root:NP:6445::::::
        agent007:NP:6445::::::
        ftp:NP:6445::::::

Copy "/etc/netconfig" to "/export/ftp/etc".

Make the directory "/export/ftp/etc/default".

Copy "/etc/default/init" to "/export/ftp/etc/default".

These examples use a GID of 30000 and a UID of 30000.  These are only examples;
pick a UID and GID that aren't used for anything else on your system.

A "cat" of the newly created "/export/ftp/etc/passwd", "/export/ftp/etc/group",
"/export/ftp/etc/netconfig", and "/export/ftp/etc/shadow" files shows
the following:

    # cat /export/ftp/etc/passwd
    root:x:0:0:FTP Maintainer::
    agent007:x:20000:20000:Auteria Wally Winzer Jr.::
ftp:x:30000:30000:Anonymous FTP::
    # cat /export/ftp/etc/group
    root::0:
    filekeeper::20000:
    anonymous::30000:
    # cat /export/ftp/etc/netconfig
    udp        tpi_clts      v     inet    udp    /dev/udp        -
    tcp        tpi_cots_ord  v     inet    tcp    /dev/tcp        -
    rawip      tpi_raw       -     inet    -      /dev/rawip      -
    ticlts     tpi_clts      v    loopback -      /dev/ticlts     straddr.so
    ticotsord  tpi_cots_ord  v    loopback -      /dev/ticotsord  straddr.so
    ticots     tpi_cots      v    loopback -      /dev/ticots     straddr.so
    # cat /export/ftp/etc/shadow
    root:NP:6445::::::
    agent007:NP:6445::::::
    ftp:NP:6445::::::
    # cat /export/ftp/etc/default/init
    # @(#)init.dfl 1.2 92/11/26
    #
    # This file is /etc/default/init.  /etc/TIMEZONE is a symlink to this file.
    # This file looks like a shell script, but it is not.  To maintain
    # compatibility with old versions of /etc/TIMEZONE, some shell constructs
    # (i.e., export commands) are allowed in this file, but are ignored.
    #
    # Lines of this file should be of the form VAR=value, where VAR is one of
    # TZ, LANG, or any of the LC_* environment variables.
    #
    TZ=US/Pacific

After the edits are complete, set all three files to mode 444:

        # chmod 444 /export/ftp/etc/passwd
        # chmod 444 /export/ftp/etc/group
        # chmod 444 /export/ftp/etc/netconfig
        # chmod 444 /export/ftp/etc/shadow
        # chmod 444 /export/ftp/etc/default/init
        # chmod 111 /export/ftp/etc/default
Set the correct ownership and mode for each of the directories:

        # cd /export/ftp
        # pwd (should show /export/ftp)
NOTE: make the "pub" directory 2555, ie. set-group-id, in order to create new
files with the same group ownership:
        # chmod 2555 pub
        # chmod 111 bin
        # chmod 111 etc
        # chown root *
        # chgrp root *
        # chown root .
        # chgrp root .
        # chmod 755 .

NOTE----NOTE----NOTE----NOTE----NOTE----NOTE----NOTE----NOTE----NOTE----NOTE----
*** Neither the home directory (~ftp) nor any directory below it should be
owned by ftp!  No files should be owned by ftp either.  Modern ftp daemons
support all kinds of useful commands, such as chmod, that allow outsiders to
undo your careful permission settings.  They also have configuration options
like the following (WuFTP) to disable them:

(NOTE: ENTRY OF "ftpaccess" for WuFTP)
# all the following default to "yes" for everybody
delete          no      guest,anonymous         # delete permission?
overwrite       no      guest,anonymous         # overwrite permission?
rename          no      guest,anonymous         # rename permission?
chmod           no      anonymous               # chmod permission?
umask           no      anonymous               # umask permission?

IMPORTANT SECURITY NOTE:
If you wish to have a place for anonymous users to leave files, create
the directory ~ftp/pub/incoming.  This directory is owned by root with
permissions 733.  Do a 'chmod +t ~ftp/pub/incoming'.  The ftp daemon will
normally not allow an anonymous user to overwrite an existing file, but a
normal user of the system would be able to delete anything.  By setting the
mode to '1733' you prevent this from happening.  In wuftpd you may configure
the daemon to create new files with permissions '600' owned by root or any
other user.  Many times, incoming directories are abused by exchanging pirated
and pornographic material.  Abusers often create hidden directories there for
this purpose.  Making the incoming directory unreadable by anonymous ftp helps
to some extent.  With ordinary ftp severs there is no way to prevent
directories being created in incoming. The WUarchive ftp server can limit
uploads to certain directories and can restrict characters used in file names
like this:

(NOTE: ENTRY OF "ftpaccess" for WuFTP)
# specify the upload directory information
upload  /export/ftp  *       no
upload  /export/ftp  /incoming       yes     ftp     anonymous   0600    nodirs

# path filters...
path-filter  anonymous  /usr/local/etc/msgs/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
path-filter  guest      /usr/local/etc/msgs/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-

If you have wuftpd you may want to add some ftp extensions like
compression/decompression 'on the fly' or creation of tar files for the
directory hierarchies.  Get the appropriate sources (gzip, gnutar, compress),
compile them and link statically, put in the ~ftp/bin directory and edit the
appropriate file containing the definitions of the allowed conversions.
/usr/bin/tar is already statically-linked.  You may wish to use gnu tar
anyway:

[NOTE: Copy the program "pipe" from "usr/local/wu-ftp2.4.2beta15/bin"
       into "~ftp/bin".  This is needed for piping two commands into one.]
(SAMPLE "fileconversions")
#strip prefix:strip postfix:addon prefix:addon postfix:external command:
#types:options:description
 :.Z:  :  :/bin/compress -d -c %s:T_REG|T_ASCII:O_UNCOMPRESS:UNCOMPRESS
 :-z:  :  :/bin/compress -d -c %s:T_REG|T_ASCII:O_UNCOMPRESS:UNCOMPRESS
 :  :  :.Z:/bin/compress -c %s:T_REG:O_COMPRESS:COMPRESS
 :  :  :.tar:/bin/tar cf - %s:T_REG|T_DIR:O_TAR:TAR
 :  :  :.tar.Z:/bin/pipe /bin/tar cf - %s | /bin/compress -c:T_REG|T_DIR:O_COMPRESS|O_TAR:TAR+COMPRESS
:  :  :.tar:/bin/gtar -c -f - %s:T_REG|T_DIR:O_TAR:TAR
 :  :  :.tar.Z:/bin/gtar -c -Z -f - %s:T_REG|T_DIR:O_COMPRESS|O_TAR:TAR+COMPRESS
 :  :  :.tar.gz:/bin/gtar -c -z -f - %s:T_REG|T_DIR:O_COMPRESS|O_TAR:TAR+GZIP

touch /var/mail/ftp
chmod 600 /var/mail/ftp

For most UNIX systems, the installation is complete.  But if you have a Sun
system, a few more steps are necessary.  The dynamic linking used in
Sun OS/Solaris 5.x requires that the "ftp" home directory contains:

1. The runtime linker
2. The Shared C Library
3. /dev/zero, /dev/tcp, /dev/udp, /dev/ticotsord, /dev/null, /dev/ticlts,
   and /dev/ticots
4. zoneinfo files

These Sun-specific steps are shown in the following examples.  First create the
directory "/export/ftp/usr/lib, then copy the files "ld.so", "libc.so.*",
"libdl.so*", libintl.so.*", "libw.so.*", "libnsl.so.*", "libsocket.so.*",
"nss_nis.so*", "nss_nisplus.so*", "nss_dns.so*", "nss_files.so*", and
"straddr.so*" into the new directory, and set the file permissions:

        # cd /export/ftp
        # pwd (should show /export/ftp)
        # mkdir -p usr/lib
        # cp /usr/lib/ld.so* usr/lib
        # cp /usr/lib/libc.so.* usr/lib
        # cp /usr/lib/libdl.so.* usr/lib
        # cp /usr/lib/libintl.so.* usr/lib
        # cp /usr/lib/libw.so.* usr/lib
        # cp /usr/lib/libnsl.so.* usr/lib
        # cp /usr/lib/libsocket.so.* usr/lib
        # cp /usr/lib/nss_nis.so* usr/lib
        # cp /usr/lib/nss_nisplus.so* usr/lib
        # cp /usr/lib/nss_dns.so* usr/lib
        # cp /usr/lib/nss_files.so* usr/lib
        # cp /usr/lib/straddr.so* usr/lib
 # cd usr/lib
        # pwd (should show /export/ftp/usr/lib)
        # rm -f ld.so straddr.so
        # ln -s ./ld.so.1 ld.so
        # ln -s ./straddr.so.2 straddr.so
        # chmod 555 *
        # chgrp root *
        # cd ..
        # pwd (should show /export/ftp/usr)
        # chmod 111 lib
        # cd ..
        # pwd (should show /export/ftp)
        # chmod 111 usr

Next, create the "/export/ftp/dev" directory.  Perform ls -lL on the device
files listed below to determine their major and minor numbers, then use mknod
to create them in this directory:

        # cd /export/ftp
        # pwd (should show /export/ftp)
        # mkdir dev
        # chmod 111 dev
        # cd dev
        # pwd (should show /export/ftp/dev)
        # ls -lL /dev/null /dev/zero /dev/tcp /dev/udp /dev/ticotsord \
        /dev/ticlts /dev/ticots
          (AN EXAMPLE OUTPUT WILL LOOK LIKE THE FOLLOWING:)

        # ls -lL /dev/null /dev/zero /dev/tcp /dev/udp /dev/ticotsord \
        /dev/ticlts /dev/ticots
        crw-rw-rw-   1 root     sys       13,   2 Jun  2 20:28 /dev/null
        crw-rw-rw-   1 root     sys       11,  42 Apr 16  1997 /dev/tcp
        crw-rw-rw-   1 root     sys      105,   2 Aug 20  1997 /dev/ticlts
        crw-rw-rw-   1 root     sys      105,   0 Aug 20  1997 /dev/ticots
        crw-rw-rw-   1 root     sys      105,   1 Aug 20  1997 /dev/ticotsord
        crw-rw-rw-   1 root     sys       11,  41 Apr 16  1997 /dev/udp
        crw-rw-rw-   1 root     sys       13,  12 Apr 16  1997 /dev/zero

 # mknod null c 13 2
        # mknod tcp c 11 42
        # mknod ticlts c 105 2
        # mknod ticots c 105 0
        # mknod ticotsord c 105 1
        # mknod udp c 11 41
        # mknod zero c 13 12
        # chmod 00666 null tcp ticlts ticots ticotsord udp zero
        # chgrp sys null tcp ticlts ticots ticotsord udp zero

Create the directory "/export/ftp/usr/share/lib/zoneinfo".  Make this
directory mode 555 and owned by the super-user.  Copy its contents from
/usr/share/lib/zoneinfo.  This enables ls -l to display time and date
stamps correctly:

        # mkdir -p /export/ftp/usr/share/lib/zoneinfo
        # cd /export/ftp/usr
        # pwd (should show /export/ftp/usr)
        # chgrp sys share
        # chmod 555 share
        # cd share
        # pwd (should show /export/ftp/usr/share)
        # chgrp sys lib
        # chmod 555 lib
        # cd lib
        # pwd (should show /export/ftp/usr/share/lib)
        # chgrp bin zoneinfo
        # chmod 555 zoneinfo
        # cd zoneinfo
        # pwd (should show /export/ftp/usr/share/lib/zoneinfo)
        # cp /usr/share/lib/zoneinfo/* .

NOTE: FOLLOW THE NEXT SET OF INSTRUCTIONS IF YOU'RE USING Wu-FTP, OTHERWISE
      GO ON TO THE "Setting up wu-ftpd..." SECTION:

<==============================================================================>
Modify the "in.ftpd" line in the "/etc/inetd.conf" file.  Change the location
of the newly installed "wu-ftpd" (in.ftpd) if the location is different than
the vendor's version (/usr/sbin/in.ftpd) [THIS PARTICULAR WUARCHIVE PACKAGE
INSTALLS Wu-FTP IN /usr/local/bin/in.ftpd].  Change "/usr/sbin/in.ftpd" to
"/usr/local/bin/in.ftpd".  In the last field change "in.ftpd" to "in.ftpd -a".
The "-a" option is necessary in order for wu-ftpd to read the "ftpaccess" file.
<==============================================================================>

Setting up wu-ftpd -OR- ftpd (vendor's version of Solaris) by hand gives
you the ability to understand and perform manually the necessary steps to
configure and setup the FTP Server.  If you wish to save time you can use
the following shell script that will set up the anonymous ftp area.
It presumes that names are resolved using NIS - This script is only
applicable for Solaris 2.5.1 and 2.6:

------------Cut Here------------
#!/bin/sh
# script to setup anonymous ftp area
#

# verify you are root
/usr/bin/id | grep -w 'uid=0' >/dev/null 2>&1
if [ "$?" != "0" ]; then
        echo \"$0\" must be run as root.
        exit 1
fi

# handle the optional command line argument
case $# in

   # the default location for the anon ftp comes from the passwd file
   0) ftphome="`getent passwd ftp | cut -d: -f6`"
      ;;

   1) if [ "$1" = "start" ]; then
         ftphome="`getent passwd ftp | cut -d: -f6`"
      else
         ftphome=$1
      fi
      ;;

   *) echo "Usage: $0 [anon-ftp-root]"
      exit 1
      ;;
esac

if [ -z "${ftphome}" ]; then
   echo "$0: ftphome must be non-null"
   exit 2
fi

case ${ftphome} in
        /*) # ok
            ;;

        *) echo "$0: ftphome must be an absolute pathname"
           exit 1
           ;;
esac

# This script assumes that ftphome is neither / nor /usr so ...
if [ -z "${ftphome}" -o "${ftphome}" = "/" -o "
{ftphome}" = "/usr" ]; then
   echo "$0: ftphome must be non-null and neither / or /usr"
   exit 2
fi

# If ftphome does not exist but parent does, create ftphome
if [ ! -d ${ftphome} ]; then
    # lack of -p below is intentional
    mkdir ${ftphome}
fi
echo Setting up anonymous ftp area ${ftphome}

# Ensure that the /usr directory exists
if [ ! -d ${ftphome}/usr ]; then
    mkdir -p ${ftphome}/usr
fi
chown root ${ftphome}
chmod 555 ${ftphome}

# Now set the ownership and modes to match the man page
chown root ${ftphome}/usr
chmod 555 ${ftphome}/usr

# Ensure that the /usr/bin directory exists
if [ ! -d ${ftphome}/usr/bin ]; then
    mkdir -p ${ftphome}/usr/bin
fi
# Now set the ownership and modes to match the man page
chown root ${ftphome}/usr/bin
chmod 555 ${ftphome}/usr/bin

# this may not be the right thing to do
# but we need the bin -> usr/bin link
rm -f ${ftphome}/bin
ln -s usr/bin ${ftphome}/bin

# Ensure that the /usr/lib and /etc directories exist
if [ ! -d ${ftphome}/usr/lib ]; then
    mkdir -p ${ftphome}/usr/lib
fi
chown root ${ftphome}/usr/lib
chmod 555 ${ftphome}/usr/lib

if [ ! -d ${ftphome}/etc ]; then
    mkdir -p ${ftphome}/etc
fi
chown root ${ftphome}/etc
chmod 555 ${ftphome}/etc

# a list of all the commands that should be copied to ${ftphome}/usr/bin
# /usr/bin/ls is needed at a minimum.
ftpcmd="
        /usr/bin/ls
"

# ${ftphome}/usr/lib needs to have all the libraries needed by the above
# commands, plus the runtime linker, and some name service libraries
# to resolve names. We just take all of them here.

ftplib="`ldd $ftpcmd | nawk '$3 ~ /lib/ { print $3 }' | sort | uniq`"
ftplib="$ftplib /usr/lib/nss_* /usr/lib/straddr* /usr/lib/libmp.so*"
ftplib="$ftplib /usr/lib/libnsl.so.1 /usr/lib/libsocket.so.1
/usr/lib/ld.so.1"
ftplib="`echo $ftplib | tr ' ' '\n' | sort | uniq`"

cp ${ftplib} ${ftphome}/usr/lib
chmod 555 ${ftphome}/usr/lib/*

cp ${ftpcmd} ${ftphome}/usr/bin
chmod 111 ${ftphome}/usr/bin/*

# you also might want to have separate minimal versions of passwd and group
cp /etc/passwd /etc/group /etc/netconfig ${ftphome}/etc
chmod 444 ${ftphome}/etc/*

# need /etc/default/init for timezone to be correct
if [ ! -d ${ftphome}/etc/default ]; then
        mkdir ${ftphome}/etc/default
fi
chown root ${ftphome}/etc/default
chmod 555 ${ftphome}/etc/default
cp /etc/default/init ${ftphome}/etc/default
chmod 444 ${ftphome}/etc/default/init

# Copy timezone database
mkdir -p ${ftphome}/usr/share/lib/zoneinfo
(cd ${ftphome}/usr/share/lib/zoneinfo
(cd /usr/share/lib/zoneinfo; find . -print | cpio -o) 2>/dev/null|cpio -imdu
2>/dev/null

  find . -print | xargs chmod 555
  find . -print | xargs chown root
)

# Ensure that the /dev directory exists
if [ ! -d ${ftphome}/dev ]; then
    mkdir -p ${ftphome}/dev
fi

# make device nodes. ticotsord and udp are necessary for
# 'ls' to resolve NIS names.

for device in zero tcp udp ticotsord ticlts
do
   line=`ls -lL /dev/${device} | sed -e 's/,//'`
   major=`echo $line | awk '{print $5}'`
   minor=`echo $line | awk '{print $6}'`
   rm -f ${ftphome}/dev/${device}
   mknod ${ftphome}/dev/${device} c ${major} ${minor}
done

chmod 666 ${ftphome}/dev/*

## Now set the ownership and modes
chown root ${ftphome}/dev
chmod 555 ${ftphome}/dev

# uncomment the below if you want a place for people to store things,
# but beware the security implications
if [ ! -d ${ftphome}/pub ]; then
   mkdir -p ${ftphome}/pub
fi
chown ftp ${ftphome}/pub
chmod 1777 ${ftphome}/pub

# added pam libs for 2.6
# mkdir -p ${ftphome}/usr/lib/security
# cp /etc/pam.conf ${ftphome}/etc
# cp /usr/lib/security/pam_unix.so.1 ${ftphome}/usr/lib/security
------------Cut Here------------

AUTERIA "WALLY" WINZER JR.

--

---

From: "Auteria Wally Winzer Jr." <[email-masked]>
Date: Fri, 18 Sep 1998 13:07:19 -0700

As I noted in a previous message, the instructions have changed just a
little for beta18-VR's.  Pretty much everything else is the same.  The
rc script is now /etc/init.d/academ.  The Solaris package is specific for
VR6 - VR8 (VR8 has not been released yet.  Waiting on Greg's
announcement).  The VR8 Solaris pkg will have the latest instructions.
At the time I created a beta15 package, hence the reason you see beta15-like
directories.

- Wally Winzer Jr.

---

From: Bob Luckin <[email-masked]>
Date: Fri, 18 Sep 98 15:09:33 CDT

> just not user and group names.  Any ideas what I'm doing wrong?

I have a feeling that it may be another missing library from usr/lib - I'm
sure I've seen this problem before somewhere, but it was so long ago I can't
remember what the library was.  For some reason, libnsl.so and libnsl.so.1
come to mind, along with the various nss_libraries, but I could be way off
base.  And I seem to recall it wasn;t one of those listed in the vendor's
ftpd man page.

I can send you a list of the libraries I have in my Solaris 2.5.1
installation if it will help you to cross check, although I think you said
you were running under 2.6, so there may be differences anyway.

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "Rats live on no evil planet"
                                 [http://www.dhc.net/~luckin/palindromes.html]