Subject: Revised ls -l / dir directions

From: John-Paul Pagano <[email-masked]>
Date: Mon, 01 Mar 1999 17:21:49 -0500

For those who are interested, here's my recipe for enabling ls -l and dir
functionality for chrooted "real" users on your wu-ftp server with the least
amount of hassle.  I am revising it because I had included some erroneous
information in the first draft.  Here goes:

--

Pre-config steps:  Make sure that your real user is set up in the /etc/password
file to function under a chrooted environment.  E.G., his passwd file entry
should look something like this:

user:x:UID:GID(ftp):User's FTP Account:/ftp/user/./:/dev/null

The critical ftp-specific entry in this theoretical passwd file line is 

/ftp/user/./

which is the syntax that "jails" your FTP account user into a chrooted file
system, so that he doesn't have access to anything on the machine you don't
intend him to see.  Also, make sure that the bogus shell you assign this user
(in my example, /dev/null) is listed in /etc/shells.  (Never give a purely FTP
user a real shell, unless you are sure it is totally restricted.)  If /dev/null
is not in my /etc/shells file, no users will be able to gain access to my FTP
server.
1. Make the following subdirectories in your user's chrooted / :

        usr/lib 
        dev
        bin

2. Copy the following files into ~user/usr/lib :

        ld.so.1 
        libc.so.1 
        libdl.so.1

3. Copy /bin/ls into ~user/bin.  Run ldd against the ~user/bin/ls to make sure
that no library or shared files come up that you haven't already copied to
~user/usr/lib.

4. ls -l the /dev/zero link on your machine.  E.g.

        bash# ls -l /dev/zero 
        lrwxrwxrwx 1 root root 27 Feb 2 13:14 /dev/zero ->
../devices/pseudo/mm@0:zero 
        bash# ls -l "/devices/pseudo/mm@0:zero" 
        crw-rw-rw- 1 root sys 13, 12 Feb 2 13:14 /devices/pseudo/mm@0:zero

Make note of the major and minor numbers (13,12). Then create a zero device in
~user/dev based on those numbers, e.g. (if you are sitting in ~user):

        bash# mknod dev/zero c 13 12

This should create a ~user/dev/zero device file that is identical to the one
actually located in /dev/zero on your FTP server, for use in the user's
chrooted environment.  I don't know about other systems, but on Solaris 2.5.1,
I have found that a non-statically built ls will not function without this
device file.

4a.  Verify that your ~user/dev/zero file was created properly.  It should look
something like this:

        crw-r--r--   1 root     other     13, 12 Mar  1 16:31
/ftp/user/dev/zero

One thing you want to verify is that there aren't redundant links pointing to
either the /ftp/user/dev directory, or the zero file contained therein.  I have
seen incorrectly issued mknod commands create almost perfect-looking dev/zero
files that in fact didn't allow the chrooted ls to function properly .  Make
sure that the 1 in the second column above appears in your own output.

Also, never try to just cp a device file from your server's main /dev directory
to ~user/dev.  If you do, the machine will spiral into an endless copy of
worthless data that won't cease until you either kill the cp process, or your
file system fills up.

5. Test by executing the following command:

        bash# truss -f chroot ~user/bin/ls > /tmp/ls.log 2>> /tmp/ls.log

If everything is kosher, you won't see anything erroneous-looking in the
output. You may find that "Err#2 ENOENT" comes up, but that's an innocuous
notification that (I think) merely has something to do with the process trying
to write to a pseudo terminal device.

6. Finally, prune from or otherwise don't try to use the following directives
in Wu-FTP's ftpaccess file:

        lslong <command> [<options>... ] 
        lsshort <command> [<options>... ] 
        lsreal <command> [<options>... ] 
        lsplain <command> [<options>... ]

They don't seem to do squat, at least after hours of trying to get them to work
on my machine. To be sure, I could just be doing something dumb, and these
directives work fine, but, the bottom line is that I am now able to get ls -l
and dir to work without adding these lines to my ftpaccess file. The only
affect that these directives did have was allowing ls -l functionality but
breaking the dir command, before I commented them out altogether.  

FYI, I wrote this based on my experience with Wu-FTPD version
wu-2.4.2-academ[BETA-18-VR14].

-- 
John-Paul Pagano 
Unix Systems Administrator 
Voice: (212) 208-0828 
Fax: (212) 825-1040

--
John-Paul Pagano
Unix Systems Administrator
Voice: (212) 208-0828
Fax: (212) 825-1040