Subject: hiding specific files starting with .

From: Andreas de Pretis <[email-masked]>
Date: Wed, 16 Sep 1998 14:42:18 +0200

hi,

situation:

for example, in every user-home der is a .index.html with owner
wwwrun.nogroup and permissions "700" ... i have wu.ftpd-2.4.2-beta15 and
chroot() configured

problem:

i need to hide this .index.html when listing all the files in this
directory ... but, some windows ftp's like cuteftp oder ws_ftp show .-files
allthough they are marked as hidden with the "." 

is there any easy way to hide these files when listing directory content
with dir oder ls ? ... i even tried (for testing) chmod 000 but that
results in that only root can read the file ... but it's shown when
requesting the directory-content with dir ...

could anybold help me with this damn problem ... thx

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 16 Sep 1998 09:36:34 -0400 (EDT)

On Wed, 16 Sep 1998, Andreas de Pretis wrote:

> directory ... but, some windows ftp's like cuteftp oder ws_ftp show
> .-files allthough they are marked as hidden with the "."

In Unix, there really is no such thing as a 'hidden' file.  There's only
the convention that ls won't show such files unless asked.  It's being
asked to do so.

> requesting the directory-content with dir ...

As it stands, Wu-FTPD cannot help you.  Frankly, though, I don't see the
problem from an FTP point of view.  If your customers are allowed to
manage their sites via FTP, they should be able to control the contents of
their web index.  If this is a system-owned file, maybe you should move it
outside the user's home directory to avoid the problem.

I'm thinking what you really asking for is to keep _web_ clients from
seeing the files.  You can get that with either an .htaccess file or a
system-wide configuration in the .conf files for Apache so web browsers
won't see the file.  Docs for Apache are at http://www.apache.org/

My web server uses a CGI to generate my 'Customer Sites' page.  The author
(one of my partners, hacking a Perl script he found on the net) took the
point of view that all customers should be indexed unless they opt
otherwise.  If the customer creates a .nowebindex file in their home
directory, they're not indexed.  If they create a .webindex file they may
specify an alternate description for their page and/or an alternate URL to
link to it.  Their web pages are in a subdirectory, so even if they forget
to create an index.html these CGI control files don't show in the
automatic index created by Apache.  Since they are customer-owned files,
they are owned by the users and completely under their control.

My point is this: careful design of the security model, including file
locations, can achieve the desired results with existing code; giving
local users the flexibility to control their private areas while still
enforcing site policies.

The only way to do exactly what you're looking for is to hack the source
code to prevent listing filenames beginning with a period, then hack the
ls source code in the same way.  I'll leave hacking ls to you.  Inside the
daemon, you'll need to find (1) where the listing is created internally
for NLST (search ftpd.c for send_file_list) and (2) where the external ls
is called for LIST (search ftpcmd.y for ls_long and ls_short).

Finally, I'll point out that the FTP-WG is developing a 'virtual file
system' specification for FTP.  When that comes along (and presuming
wu-ftpd ever supports it), I can easily see the feature you're asking for
being part of the definition of the VFS presented by the daemon to the
remote user.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195