Subject: Re: Re[4]: Some troubles with "upload..."

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 10 Jun 1999 08:26:40 -0400 (EDT)

On Thu, 10 Jun 1999, Alexander N. Lykov wrote:

> >> In section "Upload restrictions for guest users" no any about change
> >> owner and group on upload files... Do it mean so I cannot change
> >> owner, group and attribute on upload files by guest user?
> 
> GAL> The upload clause determines the ownership and permissions for *NEW*
> GAL> files.

> Yes. I upload by guest users a *NEW* file and ownership and
> permissions DID NOT change. Permission and ownership only change if I
> upload file by anonymous.

> GAL> For *EXISTING* files (overwrite), 2.5.0 does *NOT* change
> GAL> ownership _or_ permissions.

> I did not overwrite any file.

Then the upload clause didn't match for your guest users.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Alexander N. Lykov" <[email-masked]>
Date: Thu, 10 Jun 1999 16:56:31 +0700

Hello Gregory,

Thursday, June 10, 1999, 4:45:36 PM, you wrote:

Best regards,
 Alexander

---

From: "Alexander N. Lykov" <[email-masked]>
Date: Fri, 11 Jun 1999 09:56:19 +0700

Hello Gregory,

>> I did not overwrite any file.
GAL> Then the upload clause didn't match for your guest users.
OK. it's my configs:
------------ /etc/ftpaccess
class   all   real,guest,anonymous  *
email root@localhost
loginfails 3
readme  README*    login
readme  README*    cwd=*
message /welcome.msg            login
message .message                cwd=*
private         yes
passwd-check    rfc822  warn
delete          no      anonymous         # delete permission?
overwrite       no      guest,anonymous         # overwrite permission?
rename          no      guest,anonymous         # rename permission?
chmod           no      quest,anonymous               # chmod permission?
umask           no      quest,anonymous               # umask permission?
upload  /home/ftp  *             no     nobody   nogroup 0000 nodirs
upload  /home/ftp  /bin          no
upload  /home/ftp  /etc          no
upload  /home/ftp  /user1     yes     user1    user1  0600 dirs
upload  /home/ftp  /user2     yes     user2    user1  0600 dirs
guestgroup ftpusers
shutdown /etc/shutmsg
---------------- /etc/passwd
ftp:*:14:50:FTP User:/home/ftp:
user1:rewrerewrewrw:1417:1418::/home/ftp/./user1:/bin/sh
user2:qwrewrwerewrw:1418:1419::/home/ftp/./user2:/bin/sh
---------------- /etc/group
ftp::50:
ftpusers::51:user1,user2
user1:x:1418:
user2:x:1419:
--------------- ls -l /home/ftp
d--x--x--x   2 root     ftp          1024 Jun 27  1998 bin
d--x--x--x   2 root     ftp          1024 Jun  9 14:40 etc
drwxr-xr-x   2 root     ftp          1024 Jun 27  1998 lib
dr-xr-sr-x   3 root     ftp          1024 Jun  8 17:16 pub
drwxrwxr-t   2 user1    ftpusers     1024 Jun 11 09:45 user1
drwxrwxr-t   2 user2    ftpusers     1024 Jun 11 09:33 user2
----------------

> ok? Then, I installed wu-ftpd-2.4.2b18-2.1.i386.rpm. connect to ftp by user1.
> Upload a NEW file WhatsNew.txt
--------------- ls -l /home/ftp/user1
-rw-------   1 user1    user1        2082 Jun 11 09:33 WhatsNew.txt
---------------
> It's ok. The permissions changed.
> Then I install wu-ftpd-2.5.0-1.RH5-1.i386.rpm., copy old
> /etc/ftpaccess.rpmsave to /etc/ftpaccess and connect to ftp by user1.
> Upload a NEW file faq.current
-------------- ls -l /home/ftp/user1
-rw-------   1 user1    user1        2082 Jun 11 09:33 WhatsNew.txt
-rw-r--r--   1 user1    user1       26606 Jun 11 09:41 faq.current
--------------
Permissions did not change. Why? :(

Best regards,
 Alexander

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 11 Jun 1999 01:01:56 -0400 (EDT)

> private         yes

You almost certainly don't need this.

> upload  /home/ftp  *             no     nobody   nogroup 0000 nodirs

This 'no nobody nogroup 0000 nodirs' crap was Stan's way of trying to fix
the upload clause.  It didn't work and he didn't see why, but I guess this
solved the complaint he'd received to it got added to the documentation.  
With 2.5.0 you don't need it but it wasn't spotted in the documentation
until too late to be removed.

> Permissions did not change. Why? :(

Because 2.5.0 (being descended from VR upgrades) interprets the upload
clauses differently; hence my upload.configuration.HOWTO and the example
site .. the fact your site even marhinally works is due to the default
behavior of the daemon and not to your ftpaccess file or directory layout.

Why the change?  Because, although you've never noticed it, the upload
clauses you were using were being mis-interpreted by the daemon.  Maybe
you accepted that, I certainly didn't.  2.5.0 is much more robust, but
requires you to do things more precisely.

As I've been saying for months now, "If your ftraccess was broken, it will
completely fail under the new daemon."

Here's a few different ways to do this better (not correctly, mind you,
but better .. you really need to completely rethink your security model
since the one you're currently using is way to lax):

ftpaccess #1
------------
#
# This works exactly as your old ftpaccess did under 2.4* which is to say:
# not very securely.
#
# Everyone can upload into any user's home and create directories to to
# any depth.  Created directories are unusable but you don't care since
# they never were anyway.
#
upload /home/ftp       *      no
upload /home/ftp       /user1 yes user1 user1 0600 dirs
upload /home/ftp       /user2 yes user2 user2 0600 dirs
upload /home/ftp/user1 *      no
upload /home/ftp/user1 /user1 yes user1 user1 0600 dirs
upload /home/ftp/user1 /user2 yes user2 user2 0600 dirs
upload /home/ftp/user2 *      no
upload /home/ftp/user2 /user1 yes user1 user1 0600 dirs
upload /home/ftp/user2 /user2 yes user2 user2 0600 dirs

ftpaccess #2
------------
#
# This makes the created directories usable; which makes the site even
# less secure, but what-the-heck.
#
upload /home/ftp       *      no
upload /home/ftp       /user1 yes user1 user1 0600 dirs 0777
upload /home/ftp       /user2 yes user2 user2 0600 dirs 0777
upload /home/ftp/user1 *      no
upload /home/ftp/user1 /user1 yes user1 user1 0600 dirs 0777
upload /home/ftp/user1 /user2 yes user2 user2 0600 dirs 0777
upload /home/ftp/user2 *      no
upload /home/ftp/user2 /user1 yes user1 user1 0600 dirs 0777
upload /home/ftp/user2 /user2 yes user2 user2 0600 dirs 0777

ftpaccess #3
------------
#
# This limits directory creation to a single level.  The site is a bit
# more secure than under #2.
#
upload /home/ftp       *        no
upload /home/ftp       /user1   yes user1 user1 0600 dirs   0777
upload /home/ftp       /user1/* yes user1 user1 0600 nodirs
upload /home/ftp       /user2   yes user2 user2 0600 dirs   0777
upload /home/ftp       /user2/* yes user2 user2 0600 nodirs
upload /home/ftp/user1 *        no
upload /home/ftp/user1 /user1   yes user1 user1 0600 dirs   0777
upload /home/ftp/user1 /user1/* yes user1 user1 0600 nodirs
upload /home/ftp/user1 /user2   yes user2 user2 0600 dirs   0777
upload /home/ftp/user1 /user2/* yes user2 user2 0600 nodirs
upload /home/ftp/user2 *        no
upload /home/ftp/user2 /user1   yes user1 user1 0600 dirs   0777
upload /home/ftp/user2 /user1/* yes user1 user1 0600 nodirs
upload /home/ftp/user2 /user2   yes user2 user2 0600 dirs   0777
upload /home/ftp/user2 /user2/* yes user2 user2 0600 nodirs

ftpaccess #4
------------
#
# chgrp your user's home to be group-owned by the user's private group
# rather than the 'ftpusers' group.  This makes the site even more secure
# and allows us to simplify things so we don't need a set of upload rules
# for each user.
#
# To make this work, we need to specifically deny upload for "special"
# areas.  I'll assume a Linux FTP site with just ~ftp/bin, ~ftp/dev,
# ~ftp/etc and ~ftp/lib directories.  You may need to add a few more.
#
upload /home/ftp   *    no
upload /home/ftp   /bin no
upload /home/ftp   /dev no
upload /home/ftp   /etc no
upload /home/ftp   /lib no
upload /home/ftp   /*   yes * * 0640 dirs   0777
upload /home/ftp   /*/* yes * * 0640 nodirs
upload /home/ftp/* *    no
upload /home/ftp/* /bin no
upload /home/ftp/* /dev no
upload /home/ftp/* /etc no
upload /home/ftp/* /lib no
upload /home/ftp/* /*   yes * * 0640 dirs   0777
upload /home/ftp/* /*/* yes * * 0640 nodirs

ftpaccess #5
------------
#
# mkdir ~ftp/users, move all your user's homes into it.  This makes it so
# we don't have to list all the "special" areas.
#
upload /home/ftp          *          no
upload /home/ftp         /users/*   yes * * 0640 dirs   0777
upload /home/ftp         /users/*/* yes * * 0640 nodirs
upload /home/ftp/users/* *          no
upload /home/ftp/users/* /users/*   yes * * 0640 dirs   0777
upload /home/ftp/users/* /users/*/* yes * * 0640 nodirs

I'll stop at this point.  I was going to continue to refine the site, but
I have this feeling your users really do like being able to trample on
each other's files.  I certainly wouldn't allow a site configured in this
way on the Internet; but maybe your site is not connected to any networks
at all so security isn't an issue.

--