Subject: VR15: restricted-uid

From: "Scott Parmenter" <[email-masked]>
Date: Mon, 01 Mar 1999 16:56:51 -0800

Hi,

I'm trying out the new restricted-uid clause, but I can't seem to get it
to work.  Before I blame the OS (Trusted Solaris) in a kneejerk
reaction, I'd like to make sure I'm using the clause correctly.

In /etc/passwd:
Test1:x:2305:2000::/home/test/Test1:/usr/bin/ftponly

In /etc/ftpaccess:
guest-root /home/test    Test1
restricted-uid    Test1

Test1 gets chrooted to /home/test, but I'd like to use the
restricted-uid feature to keep him in his home directory.  I believe
this setup is basically the same as the manpage example.  Am I using
this feature wrong?

Thanks,
Scott

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 1 Mar 1999 20:09:41 -0500 (EST)

On Mon, 1 Mar 1999, Scott Parmenter wrote:

> I'm trying out the new restricted-uid clause, but I can't seem to get
> it to work.  Before I blame the OS (Trusted Solaris) in a kneejerk

Here's some of my /etc/ftpaccess file.  It works here.  It's possible the 
problem is restricted-uid vs unrestricted-uid.  Can you test to see if one
works and the other doesn't; I'm off-site right now and will coderead to
see if there's something wrong tomorrow AM.

deny-uid %-99 vrnet
deny-gid %-99 vrnet
allow-uid ftp
allow-gid ftp

guestuser *
realuser ftp

restricted-uid *
unrestricted-uid lundberg

anonymous-root /home/ftp

guest-root /home/users

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 1 Mar 1999 22:50:09 -0500 (EST)

got back with some time to spare tonight.  coderead .. every looked fine.
I removed all restricted-uid options from my ftpaccess and re-tested.  All
my tests were with cwd / pwd using both real and guest users ...

<none>
  worked fine.  Users could cd willy-nilly to each others areas as far as
  Unix permissions would allow.

restricted-uid lundberg
  worked fine.  Could not cd ~<non-lundberg>, /etc or other non-home dirs
  non-lundberg user could cd as desired
  fooled myself for a sec since cd / is quietly remapped to cd ~ dunno why
    but it was in the original patch and makes some sense for URL mapping
    (cf earlier talk about that on another thread) so I left it in

restricted-uid *
unrestricted-uid lundberg
  worked fine.  Could cd ~<non-lundberg>, /etc or elsewhere
  checked as non-lundberg user and could not move about outside home

I don't see how TSOL can have an effect, but who knows.
I'm thinking it's more obvious and therefore harder to see. :)

--