Subject: Is this safe!

From: "Ramachandramurthy Sivakumar" <[email-masked]>
Date: Mon, 28 Dec 1998 18:57:06 -0500 (EST)

Hello,

I have installed the latest wu-ftpd archive on a Sun Ultra2, 
Solaris 2.5.1. machine. The machine is used as a webserver/
ftpserver/fileserver. The wu-ftp archive seems to work fine.

I want users belonging to a particular group (let's say the
real group called "xyz" in my system's /etc/group) be able to
add and delete files to the /ftphome/pub/outgoing directory.

This is what I do: 

* Make the directory /ftphome/pub/outgoing owned by "root" 
  and set the group to be the real group "xyz"
* The directory permission for /ftphome/pub/outgoing is set to 775.

With the above set up real users belonging to the group "xyz" is 
able to add/delete files to the /ftphome/pub/outgoing directory.

Is the above procedure safe?

Thanks in advance for the help!

--siva ([email-masked])
Georgia Institute of Technology

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 29 Dec 1998 10:42:09 -0500 (EST)

On Mon, 28 Dec 1998, Ramachandramurthy Sivakumar wrote:

> With the above set up real users belonging to the group "xyz" is able
> to add/delete files to the /ftphome/pub/outgoing directory.

If you're talking about FTP-only access to the area, this is the wrong
approach.  Make the users guests and use upload/noretrieve clauses, etc,
in the ftpaccess file to strictly control their access.  You'll still want
to use Unix permissions/ownership but they are a backstop to the security
features of the daemon rather than your front-line.

You should be OK if the idea is Unix shell sharing of the area, but here's
a few considerations:

 - ownership by non-root; the superuser should never play in this area.

 - umask 002 or higher for users in the group; watch for world permissions
   you'll have to instruct/monitor/admonish the users to check the
   permissions carefully

 - sticky bit; so users cannot play with each others files

 - setgid on the directory; so stuff created in the directory is owned by
   the group.  you'll have to instruct/monitor/admonish the users to watch
   ownership, especially if they move files into the area with rename.

 - only well-trusted users in the group; at least users who well-trust
   each other.

 - don't allow hard links at all; only allow local (to the directory or
   ftp site) symlinks if you must allow them at all.  Once again, though,
   all you can do is watch over the users and hope they don't mess up too
   badly or that you catch the mistakes before they cause problems.

 - If you're dealing here with students or faculty consider the box
   permanently security-compromised.  Backups are good, but fdisk is
   better.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195