Subject: Class restrictions

From: [email-masked]
Date: Tue, 2 Mar 1999 14:06:30 -0500 (EST)

I'm installing wuftp 2.4.2[beta 18]VR15 on Digital Unix 4.0E and I have a problem with the class definitions. 
When I use them for restrict any operation (ie. rename, upload), the operation is denied even for valid users.

Excerpt from ftpaccess:
######

class users_auth guest 172.16.1.2/32

rename yes class=users_auth
rename no guest,anonymous
#####

Then I tried to rename some file with a guest user from 172.16.1.2. I'm sure that the user is managed as guest because it's really chrooted.

However the next error is displayed:

ftp> ren test1 test2
350 File exists, ready for destination name
553 test1: Permission denied. (rename)

And the log contains:

Mar  2 19:42:56 myhost ftpd[12004]: FTP LOGIN FROM myhost.mydomain.es [172.16.1.2], myguest
Mar  2 19:42:56 myhost ftpd[12004]: SYST
Mar  2 19:42:57 myhost ftpd[12004]: PORT
Mar  2 19:42:57 myhost ftpd[12004]: NLST
Mar  2 19:43:03 myhost ftpd[12004]: RNFR test1
Mar  2 19:43:03 myhost ftpd[12004]: RNTO test2
Mar  2 19:43:03 myhost ftpd[12004]: myguest of myhost.mydomain.es [172.16.1.2] tried to rename /home/ftp/pub/test1 to /home/ftp/pub/test2

Where is my mistake?

Thanks,

	David Jorrin
====
David Jorrin <[email-masked]>

   "This chapter is about Laziness, Impatience
    and Hubris because this chapter is about
    good software design"
    Larry Wall, Tom Christiansen & 
    Randal L. Schwartz [Programming Perl]

----------------------------------------------------------------
Get your free email from AltaVista at http://altavista.iname.com

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 2 Mar 1999 15:41:53 -0500 (EST)

On Tue, 2 Mar 1999 [email-masked] wrote:

> I'm installing wuftp 2.4.2[beta 18]VR15 on Digital Unix 4.0E and I
> have a problem with the class definitions.  When I use them for
> restrict any operation (ie. rename, upload), the operation is denied
> even for valid users.
> 

> Then I tried to rename some file with a guest user from 172.16.1.2.
> I'm sure that the user is managed as guest because it's really
> chrooted.
> 
> Mar  2 19:43:03 myhost ftpd[12004]: myguest of myhost.mydomain.es
> [172.16.1.2] tried to rename /home/ftp/pub/test1 to
> /home/ftp/pub/test2

Looks like my example had it backwards.  (Actually, the code looks too
simplistic, but that's for later.)  Try reversing the order of the class'd
clauses, ie:

Looks like the more-general 'no guest' is matching and overriding the
more-specific 'yes class=users_auth'.  I'll revisit the code in the next
few days to see if I can make it behave more rationally.  Until then,
order from more-general to more-specific as your read down the ftpaccess
file and it _should_ work.  Let me know.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 2 Mar 1999 15:49:25 -0500 (EST)

Thinking more on the problem, reordering may not help.  Try this:

The default for guest users is 'yes', form a class= for the 'no' and let
the default case handle the 'yes'.  The code really is too simplistic.

--