Subject: Setting upload permissions

From: Jesse Jensen <[email-masked]>
Date: Sat, 31 Oct 1998 01:03:33 -0600

Ok, I'm running beta 18 with the latest VR patch on a linux box.

I'm trying to let a user who has been guestgrouped upload.  I want
anything uploaded to be owned by root and have a restrictive mode.  I
tried following all the directions I could find, but it doesn't work. 
The uploaded stuff is usually owned by the user that uploaded it and has
a lenient mode.  Here's what I have:

[/ftp/pub/]
drwxr-x---  19 root    family         1024 Oct 24 03:42 photoalbum
drwxrwx-w-   3 root    family         3072 Oct 31 00:37 uploads

[passwd file]
erik:x:1002:1002:Erik,,,:/ftp/./pub:/bin/lshells/nologin

[group file]
family:x:101:erik,adam,mom,dad

[ftpaccess]
guestgroup    family    *

class   all   guest,real

limit   all   10  Any   /ftp/etc/toomany.msg

# all the following default to "yes" for everybody
rename          no      guest,anonymous         # rename permission?
delete          no      guest,anonymous         # delete permission?
overwrite       no      guest,anonymous         # overwrite permission?
chmod           no      guest,anonymous         # chmod permission?
umask           no      guest,anonymous         # umask permission?

# path-filter
path-filter guest /etc/filename.msg ^[-+A-Za-z0-9_.[:space:]]*$ ^\. ^-

#      ab/rel   HomeDir  ArchiveDir     Allow? Owner Group Mode Dirs?
DirMode
upload absolute /ftp/pub /pub/uploads/* yes    root  root  770  dirs 
777

I'm pretty sure this is how it's supposed to work.  But, when I do this,
they can upload into uploads/ and in subdirectories of it, but all the
permissions are wrong.  Also, and I don't know if this is related, when
I have ftp'ed in and I check the directory listing, it usually shows the
uid, instead of the name; but all the users are in /ftp/etc/passwd.  I
have also tried the following with varying degrees of unsuccess:

upload absolute /ftp/pub /pub/uploads/  yes    root  root  770  dirs 
777
upload absolute /ftp/pub /pub/uploads   yes    root  root  770  dirs 
777
upload absolute /ftp/pub /pub/uploads*  yes    root  root  770  dirs 
777
upload absolute /ftp/pub /pub/uploads/* yes    *     *     770  dirs 
777
upload absolute *        *              yes    *     *     770  dirs
and so on...

Thanks,
jesse

---

From: Gregory A Lundberg <[email-masked]>
Date: Sat, 31 Oct 1998 10:51:49 -0500 (EST)

On Sat, 31 Oct 1998, Jesse Jensen wrote:

> The uploaded stuff is usually owned by the user that uploaded it and
> has a lenient mode.  Here's what I have:
> 
> [/ftp/pub/]

Looking at the rest of the stuff, do a chmod o-w on 'uploads' .. just
tightening security here.

> erik:x:1002:1002:Erik,,,:/ftp/./pub:/bin/lshells/nologin

This is fine.

> family:x:101:erik,adam,mom,dad

This is fine too.

> class   all   guest,real

No class for anonymous, anonymous FTP won't be allowed.

> #      ab/rel   HomeDir  ArchiveDir     Allow? Owner Group Mode Dirs? DirMode
> upload absolute /ftp/pub /pub/uploads/* yes    root  root  770  dirs  777

'absolute' is the default, you can leave it off if you want.

Personally, I don't like 'root' owning anything ftp users can write to.
I'd do the following, just to tighten up security:

- add 'jesse' to the 'family' group

  I'm assuming you have an account on your machine.

- chown -R jesse.jesse /ftp
- chown -R root.root /ftp/bin /ftp/etc
- chown -R jesse.family /ftp/pub/photoalbum /ftp/pub/uploads
- chmod o+t /ftp

  Since you own the directory, root doesn't want you messing with the
  important files for the ftp server.

- chmod g+s `find /ftp/pub/photoalbum -type d`
- chmod g+s `find /ftp/pub/uploads -type d`

  So if you play in the directories, the group-ownership of stuff you
  create gets set so the rest of your family can see what you've done.

- chmod -R o= /ftp/pub/uploads
- chmod a-x `find /ftp/pub/uploads -not -type d'

  Clean up the mistakes in permissions already there.

- upload specifies user 'jesse' and group 'family'

  You REALLY REALLY REALLY do not want uploaded files or directories owned
  by root!

- upload sets permissions to 660 for files and 770 for directories

  Family cannot upload files which can be run on your ftp server and
  files and directories are only available to family members.  Dunno if
  there are any other users on your machine, but just to be safe don't
  give them access to this stuff.

> permissions are wrong.

Personally, for your use, I'd use '*' for the upload owner and 'family'
for the upload group.  That way the family members can see who's to blame
for the new file in the FTP site.

This all should work as you see it, let me know if not after you've
cleaned up the security model, and I'll take a deeper look.

> Also, and I don't know if this is related, when I have ftp'ed in and I
> check the directory listing, it usually shows the uid, instead of the
> name; but all the users are in /ftp/etc/passwd.

Then the setup for /ftp/etc/passwd and /ftp/etc/group is wrong.  Check my
example site at ftp://ftp.vr.net/pub/wu-ftpd/examples for the suggested
(minimum) contents.  I run Linux and use statically-linked binaries so the
example site is all I need (other flavors of Unix may need additional
files, special devices and directories, but Linux does not).

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Jesse Jensen <[email-masked]>
Date: Sat, 31 Oct 1998 18:56:34 -0600

Wow, that was really helpful.  It's a shame you can't get all that stuff
in a man page so you don't have to keep answering questions.  The
tightening security suggestions are good; I was just trying to make sure
that wasn't holding me back when it wasn't working, so that's why I had
stuff world writable.  

What exactly does chmoding something to "s" do?  I guess that makes
anything created in that directory have the same permissions, but I'm
not sure.  Also, how can I feed chmod a bunch of directories with spaces
in them?  chmod g+s `find /ftp/pub/photoalbum -type d` chokes hard-core
on spaces.

If I were to open my computer up a bit more, and allow anonymous access,
how would I prevent multiple simultaneous connections?  Also, is NOOP
ignored by default with beta-18 VR9?  If not, how can I manually boot
people if I see them hanging around too long?

Can I download from you a statically linked ls?  I really don't know how
to do that, and I haven't seen much for directions anywhere.

Thanks,

jesse

---

From: Gregory A Lundberg <[email-masked]>
Date: Sun, 1 Nov 1998 00:09:05 -0500 (EST)

On Sat, 31 Oct 1998, Jesse Jensen wrote:

> not sure.

For a directory, u+s says any new files created get the user-owner of the
directory and g+s the group-owner.  For executables, the program runs as
the user/group owning the file (this is dangerous, so don't do it unless
you're sure it's the right thing to do).

> Also, how can I feed chmod a bunch of directories with spaces in them?  
> chmod g+s `find /ftp/pub/photoalbum -type d` chokes hard-core on
> spaces.

You'll have to do a special script for those.

> If I were to open my computer up a bit more, and allow anonymous
> access, how would I prevent multiple simultaneous connections?

Using the 'class' and 'limit' clauses in ftpaccess.

> Also, is NOOP ignored by default with beta-18 VR9?  If not, how can I
> manually boot people if I see them hanging around too long?

The VR versions ignore NOOP.

> to do that, and I haven't seen much for directions anywhere.

ftp://ftp.vr.net/pub/wu-ftpd/binaries has what you need.

--