Subject: Problem w/upload clauses & files in class defn

From: Susannah Gort <[email-masked]>
Date: Mon, 12 Jul 1999 17:41:17 -0700

Hi,

I've been trying to figure out what suddenly went wrong with my
wu-ftpd 2.5.0 configuration.  I'm using a configuration where
some of my users (the internal ones) have /usr/local/ftp
as their home directory to which they are chrooted, and the
other users (the external customer accounts) are confined to
/usr/local/ftp/whoever.  The only place either set of users can
put files is /usr/local/ftp/whoever/to and /usr/local/ftp/whoever/from,
for various values of 'whoever'.  To get this to work well, I am
wanting all the files to be owned by ftpadm:ftpadm and 
0660.

I have two class definitions, one 'cust' and one 'local'.

I have a defumask line like:

defumask        117

My upload lines look like:

upload class=local /usr/local/ftp / no
upload class=local /usr/local/ftp /* no
upload class=local /usr/local/ftp /*/to yes ftpadm ftpadm 0660
upload class=local /usr/local/ftp /*/from yes ftpadm ftpadm 0660
upload class=local /usr/local/ftp /*/* no

upload class=cust /usr/local/ftp/* / no
upload class=cust /usr/local/ftp/* /* no
upload class=cust /usr/local/ftp/* /*/to yes ftpadm ftpadm 0660
upload class=cust /usr/local/ftp/* /*/from yes ftpadm ftpadm 0660
upload class=cust /usr/local/ftp/* /*/* no

My 'local' class definition looks like:

class	local	guest	a.b.c.*

This is preceded by my 'cust' class definition.

Originally I had a 'cust' line like

class	cust	guest	x.x.x.x y.y.y.y x.w.y.z

And everything worked fine.  But the number of customer IP addressesd
was ballooning, and I wanted to freeze the ftpaccess file, rather than
risk mishaps.  SO I looked in the man page for ftpaccess and found that
I could replace the IP addresses with a filename.  SO now I have:

class	cust	guest	/etc/ftpcusthosts

And that file has one IP address on each line.

The problem is that now, although logins are restricted properly, the
upload stuff has gone all squiffy.  I appear to be relying on unix
permissions to restrict uploads, as when I try to upload into
/usr/local/ftp/whoever as a cust user, instead of seeing 

553 file: Permission denied on server. (Upload)

I see

553 file: No such file or directory.

And when I upload a file into, say, the /usr/local/ftp/whoever/to
directory, the upload succeeds but the ownership and permissions
are wrong - the file is owned by the uploading user, and the 
permissions are -rw-----w-.

I can't make 602 from 117 and 0660.  Can you?

If I replace the reference to a file in the 'local' class definition
with an IP address, all is back to normal.  But I don't want to do
that.  Help?

-- 
Susannah Gort, Senior Systems Administrator, Artisan Components, Inc.
--
You can ISO9001 certify the process of shooting yourself in the foot,
so long as the process is documented and reliably produces the proper
result. -- Adam Shostack

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 12 Jul 1999 22:32:31 -0400

On Mon, Jul 12, 1999 at 05:41:17PM -0700, Susannah Gort wrote:

> I've been trying to figure out what suddenly went wrong with my wu-ftpd
> 2.5.0 configuration.  I'm using a configuration where some of my users
> (the internal ones) have /usr/local/ftp as their home directory to which
> they are chrooted, and the other users (the external customer accounts)
> are confined to /usr/local/ftp/whoever.  The only place either set of
> users can put files is /usr/local/ftp/whoever/to and
> /usr/local/ftp/whoever/from, for various values of 'whoever'.  To get
> this to work well, I am wanting all the files to be owned by
> ftpadm:ftpadm and 0660.
> 

What you probably mean here is

  upload class=local /user/local/ftp * no

> upload class=local /usr/local/ftp /*/* no

This last line has no effect.  The '/*' clause you used (or the better '*'
clause I suggest) will catch this case.

> upload class=cust /usr/local/ftp/* /*/* no

Given what you've said, I'd loose the 'class=' stuff.  It's not gaining you
anything.  Also, I'd add 'nodirs' to the end of the four 'yes' clauses.

> /usr/local/ftp/whoever as a cust user, instead of seeing 

Probably something is keeping the users from matching the upload clauses.
Check that they really are being classed as you expect (ftpwho while
they're logged in will clue you).

> I can't make 602 from 117 and 0660.  Can you?

117 is decimal.  That's 075 in mask terms.  0666 & ~0075 => 0602.

You may whap your head.

> If I replace the reference to a file in the 'local' class definition with
> an IP address, all is back to normal.  But I don't want to do that.

Sounds like the file referenced from the class clause for 'local' class
isn't working.  I'd suggest:

Be sure you're running 2.5.0 (it looks like you are, but you might be
running some VR version).

Be sure you've installed the deny.not.nameserved patch from
  ftp://ftp.wu-ftpd.org/pub/wu-ftpd/quickfixes/apply_to_2.5.0

Make the changes I've suggested.

Test that the users are actually being classed as expected (ftpwho will
clue you).

-- 

Gregory A Lundberg              WU-FTPD Development Group
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195