Subject: Upload question

From: "Scott Parmenter" <[email-masked]>
Date: Wed, 21 Apr 1999 16:35:11 -0700

Hi,

I'm currently running VR15 on TSOL 2.5.1.

I will eventually have a bunch of users that I will need to chroot to a
common point and then restrict to their individual home directories.
But, I'm having some difficulties getting the upload statements to
behave as I'd like.  What I want to do is to only allow the users to
upload files to their individual IN directories.  Each user's incoming
directory would have the form /ftp/users/userX/IN where userX is unique
for each user.  I hope that there's a way to do this so that one upload
clause will apply to all of the users, instead of having to use one
clause for each user.  I'd like to have all uploaded files be owned by
user "ftptest" and match the group ID of the user who uploads the file.

Here's the relevant snippet from my current ftpaccess file:

guest-root    /ftp/users    %5000-5999
restricted-uid    %5000-5999
upload    absolute    /ftp/users/*    /IN    yes    ftptest    *
0640    nodirs

However, I definitely don't have the upload clause correct.  I've tried
a number of variations and read all the relevant FAQ's and how-to's I
could find, but to no avail.  Does anyone have any suggestions on how to
do this?

Thanks,
Scott

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 23 Apr 1999 11:25:10 -0400 (EDT)

On Wed, 21 Apr 1999, Scott Parmenter wrote:

> I will eventually have a bunch of users that I will need to chroot to
> a common point and then restrict to their individual home directories.
> directory would have the form /ftp/users/userX/IN where userX is
> unique for each user.  I hope that there's a way to do this so that
> one upload clause will apply to all of the users, instead of having to
> use one clause for each user.  I'd like to have all uploaded files be
> owned by user "ftptest" and match the group ID of the user who uploads
> the file.
> 
> However, I definitely don't have the upload clause correct.  I've
> tried a number of variations and read all the relevant FAQ's and
> how-to's I could find, but to no avail.  Does anyone have any
> suggestions on how to do this?

If the user is in /ftp/users/etc/passwd and you've set their home there,
you should be OK.  Otherwise, you'll need to use a match against their
entry in the real /etc/passwd homedir.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Scott Parmenter" <[email-masked]>
Date: Fri, 23 Apr 1999 15:23:16 -0700

If the user is in /ftp/users/etc/passwd and you've
set their home there,

you should be OK.  Otherwise, you'll need to use a match against
their

Well, I finally got the upload clause to work using:

upload    absolute
/ftp/users/*    /*/IN    yes
ftptest    *    0640    nodirs

But, in the process, I also needed to make the following change in ftpd.c:

/* if we have a uid and gid, then use them. */

if (valid > 0) {

oldid = geteuid();

delay_signaling(); /*
we can't allow any signals while euid==0: kinch */

-       (void) seteuid((uid_t) 0);

+       (void) seteuid((uid_t) uid);

if ((fchown(fdout, uid,
gid)) < 0) {

...

So far I haven't noticed any side effects from not being root.
I believe this is necessary because _POSIX_CHOWN_RESTRICTED is apparently
not defined by default for Trusted Solaris, and it affects the fchown()
call.  Or if it is defined, I can't find it.  Anyway, you may
want to consider adding an #ifdef-else clause for the seteuid() call to
handle both cases.

Scott