Subject: Hiya + chroot question

From: "Scott D. MacKay" <[email-masked]>
Date: Thu, 12 Nov 1998 11:58:50 -0500

Hiya!  I just joined on!

I have a question which may be covered in the current release of wu-ftp
or an add on patch.

I want to consolidate our existing FTP server onto another machine.  The
problem is that I do not want to have to add users to /etc/passwd and do
not want them to have access to any of the system save the FTP area for
multiple reasons.  Is there an easy way of doing this?
Thought I had...
Alter (shudder) ftpd.c to do a chroot/chdir when invoked.  It would
change to a central area (ie: /export/ftp) where a private /etc/passwd,
etc are located.  

I realize that *all* ftp would be forced to use /export/ftp as a root no
matter what, but this is not a problem given the roles of this machine.

Is this OK (well, maybe not nice but OK) or is there a better way of
doing this?

Thanks in advance!

-- 
-------------------------
| Scott MacKay : Postmaster
|   [email-masked] | [email-masked] | ICQ 22025608 | (716) 383-1290
| Real Time Enterprises, Pittsford NY
| -Electronic Document Imaging-System Integration-Software Development-
| 'The opinions shared here only reflect the poster's  
|  views and may not reflect the views of the company.'

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 12 Nov 1998 12:10:48 -0500 (EST)

On Thu, 12 Nov 1998, Scott D. MacKay wrote:

> I want to consolidate our existing FTP server onto another machine.  
> The problem is that I do not want to have to add users to /etc/passwd
> and do not want them to have access to any of the system save the FTP
> area for multiple reasons.  Is there an easy way of doing this?
> Thought I had... Alter (shudder) ftpd.c to do a chroot/chdir when
> invoked.  It would change to a central area (ie: /export/ftp) where a
> private /etc/passwd, etc are located.

I'd write a shell script such as:

#!/bin/sh
env - chroot /export/ftp /usr/sbin/wu-ftpd -a -l -i -o

And kick that off from inetd on the machine instead of the real ftpd
executable.

I just did something like this for a mail server and it works fine, but
you'll have to spend some time chasing down the pieces and parts you'll
need to copy/create in the chroot area.  Libraries, special devices,
config files in /etc, stuff like that.

> I realize that *all* ftp would be forced to use /export/ftp as a root
> no matter what, but this is not a problem given the roles of this
> machine.

The FTP daemon won't know the difference but it will have a lot of effect
on your management of the site for any tools/scripts you may have.

> Is this OK (well, maybe not nice but OK) or is there a better way of

Actually, what you're talking about improves the security of the machine
if done right.  If done wrong, it shouldn't make things any worse.

If it weren't such a pain to set up, I'd recommend everyone do this.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Scott D. MacKay" <[email-masked]>
Date: Thu, 12 Nov 1998 15:06:05 -0500

ooo, there is, of course, a very simple way of setting this up;
configure the base ftp path like you would for anonymous ftp.

I followed the steps to configure for anonymous ftp, using /export/ftp
as the root, altered the ftpd.c to chroot at the start (I am lazy; I
will do this better soon) and bing!  It worked!

It is actually **really** good because I am on a networked machine, so I
was getting NIS+ entries before this.  Now I can *really* isolate FTP.

One gotcha was that the /dev entries for tcp,udp,ticotsord were not like
the config scripts off
http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html#IDX35
(through a flub, I *killed* my real /dev s...lucky me I was already
telnetted to a good machine :)

My steps were:
1) Set up the subdirectory area as if it going to be used for anon ftp
   (copy over ls, libs, etc files)
2) For every program (just for safety, even ftpd) run ldd against it to
   get the shared library list; copy those too.
3) Alter ftpd.c; added a command line option '-r' for root path; in arg 
   loop do a chroot, then a chdir("/"), verifying both worked.
4) Changed inetd.conf to use my ftpd

The only think I am missing are files required for DNS resolution...
Easy nuff to track down.

With Sun ACLs, is there still a reason to do a chroot further for the
'ftp' user?  I figure I can Solaris acl all the paths I do not want it
to have access to...

Yippie!  It worked.

Things I plan to do:
a.  Write a C prog to change passwords, add/del users in this chrooted
area
Anyone have user management progs where I can control the actual path to
the passwd and group files?