Subject: Added info for upload.configuration.HOWTO

From: Gregory A Lundberg <[email-masked]>
Date: Sat, 27 Feb 1999 15:06:39 -0500 (EST)

The earlier question about umasks got me to thinking.  I've added a few
sections to

  ftp://ftp.vr.net/pub/wu-ftpd/upload.configuration.HOWTO

concerning umasks and a few other features.  This is what I added:

--

umasks for guest and real users
-------------------------------
In most cases you will want to allow guest and real users to control the
permissions on their own files and directories.  As in the examples shown,
if there are no specific permissions given on upload clauses, any new files
or directories created will have all permissions set.  umasks can be used
to reduce these permissions.

The daemon has a command-line option (-u) to set the default umask for all
users.  Follow the -u option with an octal permissions mask.  Bits in this
mask are permissions to turn off whenever the daemon creates a new file or
directory.  The manpage for ftpd documents the -u option.

Often times, the global -u option is not sufficient.  In the ftpaccess
file, you can control umasks by class by using the defumask clause.  If no
class is given, defumask overrides the -u umask from the command line.  If
the current user is a member of the named class, defumask overrides the
umask setting for this user only.

For example, assume there are several classes of users

class admin  real       10.0.0.0/8 127.0.0.0/8
class local  guest      10.0.0.0/8 127.0.0.0/8
class remote guest      *
class anon   anonymous  *

( Notice, by the way, in this example, real users will not be allowed
access unless from the local network since they are not in any class when
coming from an outside IP address.  Since the daemon gives no clue to the
remote user in this case, to outside addresses it will appear as if the
admin users do not exist on the server.  The specific cause for their login
failure will appear in your system logs. )

We can control the umask by class for these users.  For example, we might
say:

defumask 0377
defumask 0177 admin
defumask 0133 local remote

The first clause applies whenever another defumask clause does not match
the current user's class.  This is the same as adding '-u 0377' to the
command line for the FTP daemon.  In this case, the clause applies only to
anonymous users since all other classes have specific default umasks given.

The second turns off execute permissions, as well as group- and world- read
and write permissions, for all files and directories created by real users
(users in the admin class).

The last rule turns off execute permissions and group- and world-write
permissions for files and directories created by guests (in the local and
remote classes).

Remember that umasks apply to ALL files and directories created EXCEPT
those where an upload clause applies AND the upload clause gives specific
permissions.  Disabling execute permissions will cause problems using newly
created directories; leaving them enabled is unsafe because all files
uploaded will have execute permission and could, therefore, be used in
attempts to break into the server.

I recommend disabling all execute permissions and instructing your users to
use the chmod command to add execute permissions to directories or to
change the umask before creating directories.  This may be a bit more work
for your users, but it is safer than having a Trojan Horse program marked
executable just waiting for someone, possibly root, to try running it.

umask and chmod command restrictions
------------------------------------
As just mentioned, users have the ability to change the current umask and
modify the permissions on files and directories.

Obviously, you will want to disable this feature for anonymous users.  You
may also want to control who may use these features for your guest and real
users.  The defaults should be acceptable for most sites.  The default
settings are equivalent to the following (which you may want to add to your
ftpaccess file so you don't forget):

chmod no  anonymous
chmod yes real,guest

umask no  anonymous
umask yes real,guest

If, for example, you wanted to disable these commands for guests accessing
the server from outside the local network, you could add the following:

chmod no  class=remote
umask no  class=remote

Be sure to insert these _before_ the 'yes' clauses.  Order is important;
the daemon will apply the first matching rule it finds.   If you do
something like this, it is probably safer to rewrite the clauses to deny
everything but what you allow.  For example:

chmod yes real,class=local
umask yes real,class=local
chmod no  guest,anonymous
umask no  guest,anonymous

Delete, overwrite, rename restrictions
--------------------------------------
The daemon also provides control over the user's ability to delete, over-
write and rename files.  Again, the defaults are probably acceptable in
most cases.  These are:

delete no  anonymous
delete yes real,guest

rename no  anonymous
rename yes real,guest

overwrite no  anonymous
overwrite yes real,guest

As with the chmod and umask clauses, you can control these by class as
well.  Continuing the above example, restricting these to local users only,
we could instead say:

delete    yes real,class=local
rename    yes real,class=local
overwrite yes real,class=local
delete    no  guest,anonymous
rename    no  guest,anonymous
overwrite no  guest,anonymous

Per-class upload clauses
------------------------
Just as we can restrict the ability to change permissions, delete files,
etc., we can also define upload clauses which apply only to specific
classes of users.  For instance, with the classes from the above examples,
we can revoke upload rights for remote guests.

For example, we can deny all uploads the remote guests except to their
personal tmp directories:

upload class=remote /home/users/* *      no
upload class=remote /home/users/* /*/tmp yes nodirs

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195