Subject: Another question on ftp root

From: Robert Kohlbus <[email-masked]>
Date: Mon, 23 Nov 1998 11:14:13 -0500 (Eastern Standard Time)

Here's my problem.  I have several users who have accounts on my system 
that have login access and I want them to continue to have login access.  
However, I would like to set it up so that when the user FTPs into the 
system, they are placed into a different directory other then their home 
directory and that this directory is now their root directory. I've 
looked over the guestgroup command and the FAQs.  Everything that I have 
seen on the issue requires that the user's shell be setup for ftp access 
only and that their home directory field in the password file be divided 
into two sections.  Is there another way or am I out of luck?  Thanks for 
the help.

------------------------------------------
Robert Kohlbus - [email-masked]
Academic Information Technology Services
University of Maryland
Computer & Space Sciences Bldg. - Room 3347
College Park, MD  20742-2411
Phone (301)405-0020  Fax (301)314-9220

---

From: "Scott D. MacKay" <[email-masked]>
Date: Mon, 23 Nov 1998 11:52:35 -0500

Munge the source code...wohoo!! :)

Jyst kidding;  while it would be good to have a separate resource file
which indicates alternate home paths, it could be cumbersome to
maintain.

If you want the FTP to be 100% separate from the login area, I would
suggest
the following:

1. script the in.ftp entry in inetd.conf
2. In the new script, do a chroot to a private area (like /export/ftp).
Set up the /export/ftp area like you would an anonymous FTP; /dev
entries, etc...
I would make the following exception: 
Naming service: If users are local, I would hard link /etc/passwd,
/etc/group, and /etc/shadow.  This would keep you from having to
maintain 2 sets of password files and should not be a problem since
people could see these before anyways.  If you use NIS/NIS+/etc,
replicate the required files.
3. Recreate the path and home directories for users within /export/ftp. 
This way, the passwd entries will 'look' the same for the home area
(/home/sdm), but will actually be located somewhere else
(/export/ftp/home/sdm).

This may not work if you use automounted homes in NIS/NIS+.  It should
if you use automount definitions purely in local filesystems (since all
you have to do is ignore the original /etc/auto_home) or if your OS
allows you to override the automount lookup.

Just my ramblings....

-- 
-------------------------
| Scott MacKay : Postmaster
|   [email-masked] | [email-masked] | ICQ 22025608 | (716) 383-1290
| Real Time Enterprises, Pittsford NY
| -Electronic Document Imaging-System Integration-Software Development-
| 'The opinions shared here only reflect the poster's  
|  views and may not reflect the views of the company.'

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 23 Nov 1998 11:53:43 -0500 (EST)

On Mon, 23 Nov 1998, Robert Kohlbus wrote:

> Here's my problem.  I have several users who have accounts on my
> system that have login access and I want them to continue to have
> login access.

No problem.

> system, they are placed into a different directory other then their
> home directory and that this directory is now their root directory.

Also no problem.

> I've looked over the guestgroup command and the FAQs.  Everything that
> I have seen on the issue requires that the user's shell be setup for
> ftp access only and that their home directory field in the password
> file be divided into two sections.

The shell must be a valid shell.  The ftp-only shell is for just that,
ftp-only access.  Give them a standard shell and they can telnet just
fine.  It's how I several of have my users set up here.

> Is there another way or am I out of luck?

If you don't like hacking the passwd file's home directory entry, check
out the changes to the daemon in my VR version (currently at VR10):

  ftp://ftp.vr.net/pub/wu-ftpd/

In particular look at the new ftpaccess features

 - deny-gid, deny-uid, allow-gid and allow-uid
 - guestuser, realgroup and realuser
 - wildcards for user and group numbers
 - anonymous-root and guest-root

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195