Subject: chroot problems --- At least on Solaris ANSWER...

From: Leif Ericksen <[email-masked]>
Date: Fri, 26 Mar 1999 11:49:24 -0600

I was playing around with my server as I created a new Virutal user as
it is I had an error in my configuration.  I did not have the guestuser
entered on the 
guestuser line in /etc/ftpaccess  As it is I was able to log in and I
got myself placed into the VIRTUAL users "home" direcotry, however I was
able to 
change my direcotry to wherever I wanted to on the System...     This is
a CONFIGURATION problem as well as a possible coding issue.

*IF* I find time maybe I can submit a change...  However, since there
are already many hands in the bot maybe I should write and RFC...

When the server is autenticating a users log in IF the users has a /.
after the address it should make sure that the ftpaccess file has them
as a guest user or so that they are fored and not allowed to change
directories...

			Just a thought.

					--Leif Ericksen
					[email-masked]

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 26 Mar 1999 13:11:15 -0500 (EST)

On Fri, 26 Mar 1999, Leif Ericksen wrote:

> it is I had an error in my configuration.  I did not have the
> guestuser entered on the guestuser line in /etc/ftpaccess As it is I
> was able to log in and I got myself placed into the VIRTUAL users
> "home" direcotry, however I was able to change my direcotry to
> wherever I wanted to on the System...  This is a CONFIGURATION problem
> as well as a possible coding issue.
> 

A missing guestuser is the same as a missing guestgroup.  Personally, I do
this:

guestuser *
realuser ftp
realuser lundberg

Everyone's a guest _except_ anonymous (ftp), and other users I name (like
me!).

Actually, I'd like to get everyone moved away from the old /./ hack and
using guestgroup/guestuser with guestroot

I'd be interested in your ideas though since it's unlikely everyone would
switch and one of the notable lacks in the daemon is any protection for
server admins against their own mistakes.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195