Subject: using <class> with 'delete' keyword

From: "Thomas R. Kimpton" <[email-masked]>
Date: Mon, 12 Jul 1999 15:04:34 -0400

My intent is to allow anonymous login from within my domain, allowing
them upload/download/delete permission on a global basis (global to
the ftp root, that is), and restricted access to anonymous users
outside of our domain with *no* delete permission.  I've got everything
except delete working:

========================================================================

class   staff   real  *

# Create a class of anonymous ftp users from those who login from
# within the maned.com domain.
class privilegedftp anonymous *.maned.com
class privilegedftp anonymous 199.224.118.*
# class privilegedftp guest *.maned.com
# class privilegedftp guest 199.224.118.*

class anonftp anonymous *

delete yes real,class=privilegedftp
#delete no class=anonftp
delete no anonymous,guest

# Set the gid to ftp when this class logs in.
autogroup ftp privilegedftp

# Don't allow anyone to upload to the ftp directory
upload /opt/home/anonftp * no

# Well... ok, let the privileged guys upload anywhere they want
# and allow them to create directories
upload class=privilegedftp /opt/home/anonftp * yes ftp ftp 0664 dirs

# Oh, and allow the privileged people to delete things.
#delete yes class=privilegedftp

# Put up a drop box for uploading. No reading here, sorry. Also, no making directories.
upload /opt/home/anonftp /pub/upload yes ftpuser ftp 0440 nodirs

========================================================================

I've read the FAQs, the man pages, the examples, the web pages, the
list archive (ok not all of them, but, most of them with the word 'delete'
in them :-) and tried hacking the source to let me do it. As yet, to
no avail.  Can anyone spot the glaring error that will make me
strike my forehead and emit a heartfelt "Doh!"?

Thanks!

Tom Kimpton

Oz:  So, do you guys steal weapons from the Army a lot?
Willow:  Well, we don't have cable, so we have to make
our own fun.
-- Innocence - Buffy the Vampire Slayer

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 12 Jul 1999 22:09:00 -0400

On Mon, Jul 12, 1999 at 03:04:34PM -0400, Thomas R. Kimpton wrote:

> them upload/download/delete permission on a global basis (global to the
> ftp root, that is), and restricted access to anonymous users outside of
> our domain with *no* delete permission.  I've got everything except
> delete working:
> 
> class staff real *

I strongly recommend NOT allowing ANY real user access.  Make all your
'real' users guests.  It's more secure.

> delete no anonymous,guest

The default for real is 'yes' and for anonymous, 'no'.   You don't allow
any guest users (default: delete yes), so I'd only say:

  delete yes class=privilegedftp

This will probably solve your problem.  What's probably going on here is
the 'class=' clause stuff is far too simplistic.  I'm thinking that the
second delete clause matched and overrode the first; disabling delete for
your privilegedftp anonymous users.

> autogroup ftp privilegedftp

I assume the anonymous user, 'ftp', is already a member of the group
'ftp'.  If that is the case, this clause does nothing.

> upload /opt/home/anonftp /pub/upload yes ftpuser ftp 0440 nodirs

I assume the anonymous user, 'ftp', has a home directory entry (in
/etc/passwd) of /opt/home/anonyftp.  I usually like to state it exlicitly:

  anonymous-root /opt/home/anonftp

The default 'upload' for anonymous users is 'no'.  So the first clause has
no effect.

The second clause is probably WAY to loose.  Do you really want to give
privilegedftp anonymous users the ability to create directories to any
depth?  With the default permissions (usually 0777)?  With the default
ownership (probably ftp/ftp)?

In general, I question the concept that anonymous users should ever be
given the kind of latitude you're looking for.  I'd make a guest user who
has the privileges you want, and for the FTP maintainers to use that
username and password to gain the kind of access you're looking to grant.

-- 

Gregory A Lundberg              WU-FTPD Development Group
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195