Subject: "private" anonymous ftp

From: Tony Warner <[email-masked]>
Date: Mon, 01 Mar 1999 14:54:31 -0800

I'm running wuftp 2.4.2[beta 18]VR13 on Digital Unix 4.0D.

I want to set up my anonymous ftp server in such a way that
an anonymous user can gain access to a restricted directory
by entering an "extra" password.
It looks as though I can do this with the "private" command in 
the ftpaccess file.
Unfortunately, I don't think I've set it up correctly, or I don't know how
to use it.

If I read the man page correctly:
I add "private yes" to the ftpaccess file.
I create a /etc/ftpgroups file with an entry that looks something like:

secure_grp_name:encrypted_pw:real_grp_name

At this point, I get a little confused.  Does the user login anonymously
and then enter 
ftp>SITE secure_grp_name
or
ftp>SITE GROUP
or what??

neither of these works.  Is there still more I need to set up?

Thanks,
Tony Warner

*********************************************************************
Tony Warner						[email-masked]
General Atomics					(619) 455-4285

*********************************************************************

---

From: Bob Luckin <[email-masked]>
Date: Mon, 1 Mar 99 17:21:45 CST

Tony said :-
> neither of these works.  Is there still more I need to set up?

a) The directory you want them to be able to access must be readable by the
   secure_grp_name you used in the ftpgroups file.  (Probably obvious, but
   I thought I'd mention it just in case !)
b) If the user is chrooted (ie. anonymous or via guestgroup mechanism), you
   need the etc/ftpgroups file to be under the chrooted area so that the
   daemon can see it when the SITE GROUP command is entered.
c) There are two commands needed to change to the new group :-
      site group secure_grp_name
   the system responds
      200 Request for access to group secure_grp_name accepted
   at which point you must type
      site gpass unencrypted_grp_password
   If the user doesn't enter the second command they won't be changed to the
   new group.
d) Some FTP clients don't understand the SITE command.  You can get round this
   by using
      quote site group secure_grp_name
   and
      quote site gpass unencrypted_grp_password

   Note that my FTP clients don't seem to recognise the first word in
   the string when it is uppercase (ie. SITE or QUOTE); the case after the
   first word is probably not important, since it is passed on to the server
   which I thinks recognises either case.

I hope this helps !

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "Coder, adapt.  FTP Ada, redo C"
                                 [http://www.dhc.net/~luckin/palindromes.html]

---

From: Tony Warner <[email-masked]>
Date: Mon, 01 Mar 1999 16:03:59 -0800

Thanks, Bob, a couple more questions:

When I did the 
ftp>site group secure_grp_name
I got the correct response (of course, it doesn't seem to matter
what grp name I give it, it always gives the correct response),
but, when I did
ftp>site gpass <unencrypted pw>
I got the following:
Group access request incorrect.

>   I thought I'd mention it just in case !)

The "secure_grp_name" in the ftpgroups file (now located in ~ftp/etc for use
with anonymous users) is not a real group on the system. So, this cannot be
used as the group owner of the restricted directory.  Instead I used the
"real_grp_name" that I associated with it in the ftpgroups file.  Do I
understand
this correctly?

Also, is there an easier way of creating/changing the encrypted passwords
in this ftpgroups file other than cutting and pasting an encrypted password
out of the /etc/passwd file?

Thanks,
Tony Warner

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 1 Mar 1999 19:23:33 -0500 (EST)

On Mon, 1 Mar 1999, Tony Warner wrote:

> Also, is there an easier way of creating/changing the encrypted
> passwords in this ftpgroups file other than cutting and pasting an
> encrypted password out of the /etc/passwd file?

privatepw

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Tony Warner <[email-masked]>
Date: Mon, 01 Mar 1999 17:28:08 -0800

Thanks for the quick responses from Bob Luckin and
(of course,) Greg Lundberg.

Got this one working...

It turns out I had "almost" everything right.

To set up a "private" area for anonymous users:

-add "private yes" to your ftpaccess file.
-get the privatepw command (which I couldn't find
	in the wuftp package, so I got it from
	ftp://www.landfield.com/wu-ftpd/privatepw/)
-use privatepw to create a new private group in your
	ftpgroups file with the format:
	ftp_grp_name:encrypted_pw:real_grp_name
	the "real_grp_name" must actually exist in your
	/etc/group file.
-create a directory in your anonymous ftp area
	that is owned by the group <real_grp_name>
	obviously, to make this private, change the permissions
	to allow only reading or writing by the group (depending
	on your needs)
-login anonymously , then issue the following commands:
	ftp>site group <ftp_grp_name>
	ftp>site gpass <un-encrypted_pw>

That's all there is to it.  Thanks for all the help.

Tony Warner

---

From: Bob Luckin <[email-masked]>
Date: Mon, 1 Mar 99 22:13:50 CST

Tony,

I was just about to reply to your last set of questions (sorry for the delay,
but I was too busy to check the email for a while there), and I saw your
summary email come in.

> (of course,) Greg Lundberg.

You're welcome.

> -add "private yes" to your ftpaccess file.

Right

> 	the "real_grp_name" must actually exist in your

I wrote my own small C program to take a string and two letter salt, and
return the encypted version of the string.  I presume from the name that
privatepw does something similar - maybe inserts the entry into the
ftpgroups file as well ?  (I just made the relevant entry using vi, and
pasting the output from my program in the appropriate place.)

You're correct in that you need an entry in the real /etc/group file (or
YP/NIS/NIS+ equivalent) which corresponds to the real_group_name.  I forgot
to mention this in my earlier reply - sorry !

> 	to allow only reading or writing by the group (depending

Right

> That's all there is to it.  Thanks for all the help.

One more thing !

You might want to add an entry for the ftp_grp_name to ~ftp/etc/group,
similar to the one in /etc/group (put a * in the password field for security),
but with ftp_grp_name instead of real_grp_name.  But put a * in the password
field for security).  I guess you could put real_grp_name instead of
ftp_grp_name here if you think your users will find it less confusing.
(On my server I use the same name for for both ftp_grp_name and real_grp_name,
so it makes no difference...)

Anyway, the point is to have a suitable entry in the chrooted ~ftp/etc/group.
If you don't do this, then the "ls -l" / "dir" command will not be able to
map the groupid to ftp_grp_name when run by anonymous users.  They'll get the
groupid number in the listing instead.

This won't prevent anything from working, so it isn't essential, but it
looks nicer...

Glad you got it sorted out !

Cheers, Bob