Subject: Guest Account

From: "Shon Nixon"<[email-masked]>
Date: Wed, 07 Oct 98 11:23:58 -0500

Hi,

I have followed the new FAQ in creating a guest account. I am using RH 5.1 as
the O/S and have made a copy of /lib from the /ftp directory and placed it in
the guest directory. I have also placed the "ls" file in the /bin directory. I
can see everything in the directory - files and other directories, but can not
transfer anything to it or out of it. The directory, including the /upload
directory is set chmod 755 with the user (lurgi) and group (ftp_user) as the
owners. The /etc/passwd file has been edited with the home directory -
/home/lurgi/./ and I have created the ftponly script in /bin and have placed
that as the user shell /bin/ftponly (with the addition to the /etc/shell file).
I have added the passwd and group files to the /home/lurgi/etc directory and
edited them as per your FAQ with my modifications. The ftpaccess file looks as
such:

loginfails 2

class local real,guest,anonymous *.midrex.com
class remote real,guest,anonymous *

limit   local     20    Any         /etc/msgs/msg.toomany
limit   remote 100  Any         /etc/msgs/msg.toomany

readme README* login
readme README* cwd=*

message /welcome.msg login
message .message cwd=*
compress yes    local   remote
tar yes local   remote

# allow use of private file for SITE GROUP and SITE GPASS?
private yes

# passwd-check <none|trivial|rfc822> [<enforce|warn>
passwd-check rfc822 warn

log commands real
log transfers anonymous,real inbound,outbound
shutdown /etc/shutmsg

# all the following default to "yes" for everybody
delete  no  guest,anonymous # delete permission?
overwrite no    guest,anonymous # overwrite permission? 
rename  no  guest,anonymous # rename permission?
chmod   no  guest,anonymous # chmod permission?
umask   no  guest,anonymous # umask permission?

# specify the upload directory information
upload /home/ftp *  no
upload /home/ftp /upload yes root daemon 0600 dirs
upload /home/ftp /bin   no
upload /home/ftp /etc   no
upload /home/ftp /lib   no

# directory aliases... [note, the ":" is not required]
alias upl: /upload

# cdpath
cdpath /upload
cdpath /pub
cdpath /

# path-filter...
path-filter anonymous   /etc/pathmsg ^[-A-Za-z0-9_\.]*$ ^\. ^-
path-filter guest       /etc/pathmsg ^[-A-Za-z0-9_\.]*$ ^\. ^-

# specify which group of users will be treated as "guests".
guestgroup ftp_users 

email [email-masked]

If you need more information, please, by all means, feel free to email me. Any
help is and will be appreciated.

Regards - Shon Nixon

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 7 Oct 1998 11:52:22 -0400 (EDT)

On Wed, 7 Oct 1998, Shon Nixon wrote:

> I can see everything in the directory - files and other directories,
> but can not transfer anything to it or out of it.

  # Don't allow uploads anywhere at all for anonymous ftp ...
> upload /home/ftp *  no

  # Except allow upload if the file is named _exactly_ '/upload'
> upload /home/ftp /upload yes root daemon 0600 dirs

Change this to read:
  upload /home/ftp /upload/* yes root daemon 0600 nodirs

1) You don't want to allow uploading '/uploadhereforwarez'

2) You want to allow uploading only inside the directory '/upload/'

3) You don't want to allow directories inside there since they won't
   be usable anyway.

4) PAY ATTENTION HERE: Do you really want the uploaded file to be owned by
   'root'?  I'd suggest creating an ftpadmin user and group and having it
   own the uploaded files.

  # The following lines have no effect since they were included in the
  # first, global, denial for upload privileges.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195