Subject: chroot problem

From: ryanm <[email-masked]>
Date: Tue, 29 Jun 1999 12:06:09 -0400

Does anyone have a doc a setting up wu-ftp, proFTP, berofFTP or
any other ftp server for that part with Solaris 7 to chroot w/o
the /etc/passwd hack or w/o the need for files copied into
each and every user's home directory?? Even hard links are a 
pain. I wish there was a way I could specify who I did not want
to have chroot()'ed and everyone else would be confined in jail.

Thanks for any information/doc's/URL's.

Thanks again,

Ryan

---

From: Chris Covington <[email-masked]>
Date: Tue, 29 Jun 1999 13:16:58 -0500

Ryan,

I don't think that wu-ftpd will do all that at this point.  It sounds
like a good set of wish list items though.  

It sounds like you want the following: a config line that for each
virtual server where you could specify that a guest user's home
directory would be /samedir/username - thus no /etc/passwd hack.  I
didn't see that in the TODO list of the 2.5.0 source.

It also sounds like you want a config line that would limit access to
only guest users - that is already available in ftpaccess, see the
"class" line in the ftpaccess file.  I'm not sure how to do it for
virtual hosts though.  To deny/allow certain users, look at the
"defaultserver" or "virtual" line in the ftpaccess file.

It also sounds like you want the LIST (ls -l/dir) command to use a
compiled-in ls version that reads the password file (and possibly only
stored a certain set of lines) before doing a chroot - eliminating the
need for /bin, /etc, /lib, and /dev (provided you aren't offering
gunzip/ untarring capability).  I think that is part of the TODO list
provided in the source of 2.5.0.

How is your C?

Chris Covington
[email-masked]

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 29 Jun 1999 15:04:14 -0400 (EDT)

> didn't see that in the TODO list of the 2.5.0 source.

that's because we take them off the TODO list when we put them in the
manpage.

> "defaultserver" or "virtual" line in the ftpaccess file.

also covered in the manpage

> provided in the source of 2.5.0.

the need for a built-in ls command is greatly reduced by the current
features of the daemon.

the TODO item is to merge BeroFTPD's built-in ls command because users
tend to not RTFM and the ls command is a FAQ ..  the other reason is the
future of FTP will do away with the text-mode ls output (leaving that up
to the client) so we might as well do a text-mode convertion of the MLST
output to support legacy clients (ie., all clients currently in use).

> How is your C?

Who cares?  All he needs is a compiler; he won't be doing any coding.

> > the /etc/passwd hack

guest-root clause

> > or w/o the need for files copied into
> > pain.

restricted-uid clause: one set of files works for all users

> > I wish there was a way I could specify who I did not want

real-uid
guest-uid
allow-uid
deny-uid
.. other features

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195