Subject: Re: upload statement broken in VR6?

From: Gregory A Lundberg <[email-masked]>
Date: Sat, 24 Oct 1998 05:49:11 -0400 (EDT)

On Sat, 24 Oct 1998, Patrick Feisthammel wrote:

> 1. It has to be the _real_ path (/part1/var and not /var, if /var is a
> symlink). Thanks Gregory! 

This is the substantive change with the VR patches.  Along about VR5 or
VR6 this feature was added and the daemon made to use its own version of
realpath() instead of a system-provided one.

> 2. Also by Greogry: You have to include the 'home directory reltive to
> the root directory' too. So if you have chroot_path/./pub you need
> chroot_path/pub in the ftpaccess file.

The man page says:

    The upload keyword only applies to users who have a home directory
    (the argument to the chroot()) of <root-dir>.

Once-upon-a-time the daemon did not use the '/./' marking in the home
directory, and all users were chroot'd to their home directory.  This was
because, initially, the only user this was done for was 'ftp'.  Over time,
the concept of 'guest' users was added and the '/./' syntax for home
directories also came along.  Nobody bothered to update the man page to
make it more clear what was happening.

The VR patches changed nothing here; it is, was, and has always been, the
full home-directory field from the passwd file which was compared against
this.  What changed was the passing of this through realpath().  Why?
Because it was noted in testing that the upload commands which were
thought to be working were, in fact, not acheiving the desired results.
This could be best seen if you had the following layout:

tim:*:1001:1001::/home/./tim:
tom:*:1002:1002::/home/./tom:

upload /home/tim * no
upload /home/tom /tom/* yes

Think this works in the original daemon?  Yes?  Think again.  It never did
and it took me a long time to see why.

The ftpaccess files you were using prior to VR patches were not, in fact,
doing what you thought they were.  You simply had never tested them.  
When the VR patches came along, your inproperly specified upload clauses
failed competely rather than just failing in subtle ways.

> 3. Wildcards are not intuitive for me: 
>   upload /ftp/aaa/pub /pub/qqq/* yes user1 group1 0600 dirs 0770
>   sets the permissions for all files in subdirctories of qqq. 
>   Files and directories in qqq are _not_ covered by this rule.

It's the way filename globbing works.  'rm -fR /pub/qqq/*' wouldn't effect
/pub/qqq itself, either.

>   upload /ftp/aaa/pub /pub/qqq   yes user1 group1 0660 dirs 0770
>   this covers the files and directories in the qqq directory. 
>   But not the files/directories in subdirectories in qqq.
>  
>   So to protect everything in a directory and below, you need two entries
>   in ftpaccess.

No .. if you want the same rule applied to it all, do:

  upload ... /pub/qqq* ...

> I suggest the following modification for later (correlating to above
> points):
> 
> 1. call realpath() for the ftpaccess pathes too. This way one can
> use symlinks. This is important if you want to modify the physical
> locations without modifying the config files.

I'll think about this one.  My personal bend it to say it should not be
done because it leads to lazy system administration.  I can see what
you're trying to say, though, and will kick the idea about in my head a
while.

> 2. The 'home direcotry relative to the root directory' should be
> independent from the ftpaccess settings. Changing the default starting
> point after login has IMHO nothing to do with the access rights...

Ah .. but it's the only way to differentiate users.  As I said, your old
ftpaccess upload clauses didn't work .. at least, they didn't do what you
thought they did.

> 3. Clarify the doc. 

A tall order.  Don't count on anyone getting arround to fixing the man
page anytime soon.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195