Subject: Solaris 2.6 Guest-root restricted-uid setup

From: David Stringer <[email-masked]>
Date: Wed, 28 Apr 1999 14:43:49 -0600

Help!

I am in the process of upgrading our version of wu-ftpd to the latest and
greatest release, and I am having one hell of a time getting the
guestgroup/guest-root/restricted-gid commands to work. 

What we would like to have is all guest-users locked into their home
directories (via restricted-gid), and then have one common root directory
for all guest users (via guest-root).

Example: User has the following NIS+ entry
std:PASSWD:103:50001::/export/home/std:/usr/local/bin/bash:10689::::::

So when this user logs in we would like to chroot to /export/home, and have
this user locked into the directory std. (*I realize this can be done by
using guestgroup and the '/./' hack of the passwd entry, but we have way to
many entries to be attempting this.*)

As I understand all the documentation, if I specify the following in
ftpaccess:
guest-root 	/export/home *
restricted-gid	ituser

Restricted-gid locks user into account and seems to work fine, but
guest-root which should chroot to /export/home, and then look up the user in
/export/home/etc/passwd doesn't appear to work at all. (User will end up in
home directory but can browse the entire file system.)

(? should guest-root work with NIS+, if /export/home/etc/nsswitch.conf
points to nisplus ? )

The only way I have been able to accomplish what I want is by setting the
following in ftpaccess:
guest-group 	ituser
guest-root 	/export/home
restriced-gid	ituser

Then in the subdirectory of /export/home, I created soft links:
ln -s . export
ln -s . export/home

Is there a better way to be doing this ? What else am I doing wrong ?

Thanks,
David Stringer

PS. I have done the following:
* Read the faq
* Searched the mail archives
* Set up my directories properly
* Have ran ftpck1.1.1 against our configuration
So I really am at my wits end!!!

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 29 Apr 1999 10:13:54 -0400 (EDT)

On Wed, 28 Apr 1999, David Stringer wrote:

> I am in the process of upgrading our version of wu-ftpd to the latest
> and greatest release, and I am having one hell of a time getting the
> directories (via restricted-gid), and then have one common root
> directory for all guest users (via guest-root).
> 
> So when this user logs in we would like to chroot to /export/home, and
> have this user locked into the directory std. (*I realize this can be
> done by using guestgroup and the '/./' hack of the passwd entry, but
> we have way to many entries to be attempting this.*)
> 
> guest-root which should chroot to /export/home, and then look up the
> user in /export/home/etc/passwd doesn't appear to work at all. (User
> will end up in home directory but can browse the entire file system.)
> 

I'd be real surprised if it worked with nsswitch.conf.  I certainly never
coded it to.

> The only way I have been able to accomplish what I want is by setting the

Yeah, you told it where guests were to be root'd but you didn't tell it
who were to be guests until you added guest-group.  Personally, I like
  guestuser *
  realuser ftp
since it makes everyone except the anonymous FTP user a guest.

> Is there a better way to be doing this ? What else am I doing wrong ?

huh?  so you have a softlink /export/home/export -> /export/home and
another /export/home/export/home -> /export/home ???

Dunno what's going on here but I'll guess that the /export/home/etc/passwd
file has home directory entries starting with '/export/home'

when using these features of VR17, the chroot-local etc/passwd MUST be
consistent with the INTERNAL view the user will have.  So, if usera has a
real home of /export/home/usera (as shown in /etc/passwd) then the local
etc/passwd should say simply /usera

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195