Subject: /etc/group

From: "Chip Downs, Webmaster" <[email-masked]>
Date: Thu, 28 Jan 1999 10:55:09 +0900

I have followed the wonderful instructions at
ftp://ftp.fni.com/pub/wu-ftpd/guest-howto for the guest howto and have
everything working, but have a question.

In step one it says to ad the following line to /etc/group:

client::400:mort

We have several hundred customers and I don't want my /etc/group turning
into
client::400:userid1,userid2,userid3,...,userid999,...

In addition, in steps 3-6 we create a ~userid/bin and ~userid/etc with
~userid/etc containing the group and passwd files of two lines each.  As
long as we do this, do we really need to put every userid in our /etc/group
file?  I tested it without putting a userid in the /etc/group, but leaving
the userid in the ~userid/etc/passwd and ~userid/etc/group file.

Will I have any security concerns by not adding every userid to the
/etc/group file?

Also, I'm interested in the on the fly compression and tar...Is there any
documentation talking about the advantages/disadvantages of this and how it
works?

Thanks,
Chip Downs, [email-masked]

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 27 Jan 1999 21:28:03 -0500 (EST)

On Thu, 28 Jan 1999, Chip Downs, Webmaster wrote:

> We have several hundred customers and I don't want my /etc/group
> turning into client::400:userid1,userid2,userid3,...,userid999,...

The VR version (and, I believe, BeroFTPD) add ftpaccess clauses which
allow you to force all users/groups, individually, or by a range, to be
guests.

> ~userid/etc containing the group and passwd files of two lines each.  
> As long as we do this, do we really need to put every userid in our
> /etc/group file?

Yes, unless you're running the VR version.  /etc/group determines whether
they are guests or real users.

> I tested it without putting a userid in the /etc/group, but leaving

You should put only the UIDs/GIDs needed for 'ls' to be pretty in ~/etc.
For the VR version, ~/etc/passwd can also determine the guest's starting
directory (rather than /etc/passwd) so it does not need to be their true
home (ie., /etc/passwd home is /home/./user1, chroot to /home, start in
~user1/www since that's the home claimed in /home/etc/passwd).

> Will I have any security concerns by not adding every userid to the

Yes, with the stock academ version, they won't be guests but real users.
As such they will have free reign to roam at will through your entire
system.  For instance, if a file is accidentally writable to the user,
they will be able to modify it via FTP.  Of course, if the users can all
telnet into the box, this is sorta moot; but if they can only FTP, it's
critically important.  You can manage it using upload, but that can get to
be a real pain too.  Make your users all guests if at all possible.

> Also, I'm interested in the on the fly compression and tar...Is there
> any documentation talking about the advantages/disadvantages of this
> and how it works?

No documentation like that.  Advantage: less bandwidth used.
Disadvantages: only power users will use it; system load is increased.  It
works by installing the programs in ~/bin and using /etc/ftpconversions to
control which conversions are run.  The FAQ covers it pretty well .. it's
basically the same as getting 'ls' to work for your guestgroup users.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195