Subject: Re: Problems with home directories for guest users

From: Gunter Vanasse -- Opcom ACE Web Engineer <[email-masked]>
Date: Tue, 31 Aug 1999 09:03:33 -0400 (EDT)

James,

I've used Michael Brennen's how-to setup a WU-FTP guest account
at ftp://ftp.fni.com/pub/wu-ftpd/guest-howto.

I now have individual "home directories" in which each WU-FTP guest
account is restricted to (and any directories created within it).

The issue I have is that, setting a chroot'd environment on Solaris
implies that I had to add libraries to get ls to run with '-l' option 
and the likes. Setting up guest accounts in this way, would require
to setup chrooted environments for each account to get the functionality
I want. Short of this, guests can still 'ls' (using the WU-FTP provided
'ls' function) as well as upload/download files to their directory.

I vaguely recall 'lofs' as a potential solution to setting up multiple 
chroot'd environments without duplicating all the files. I haven't
found information to explain how to set this up (anyone on the list?)

Günter.

> Date: Tue, 31 Aug 1999 17:31:04 +1000
> From: James McMahon <[email-masked]>
> To: WUFTPD Discussion List <[email-masked]>
> Subject: Problems with home directories for guest users
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> X-Accept-Language: en
> X-Listprocessor-Version: 8.0 -- ListProcessor(tm) by CREN
> 
> Dear all,
> 
> I have the following relevant entries in my ftpaccess file:
> 
> guestroot /data01
> guestgroup guest
> 
> /data01/etc/password contains:
> 
> guest:x:10000:1001:Guest User:/guest:
> 
> /etc/passwd contains:
> 
> guest:x:10000:1001:Guest User:/data01/guest
> 
> /etc/group contains:
> 
> guest::1001:guest
> 
> My question is .... When I log in as guess I get chrooted to /data01 and my
> initial directory is / (the chrooted /).  What I want is for my initial
> directory to be /guest (chrooted), and if possible, restricted that
> directory and it's subdirs.
> 
> Could anyone point out what changes I should make?
> 
> I assume that I will need to make use of the restricted gid command in
> order to accomplish this, but am having no luck on my attempts so far.
> 
> Thanks in advance,
> 
> James
> 
> -- 
> **************************************************************************
> *     James McMahon                  *     When all else fails ...       *
> *     Secure Gateway Environment     *     Read the destructions.        *
> *     [email-masked]          *             -- (unknown)          *
> **************************************************************************

---

From: James McMahon <[email-masked]>
Date: Wed, 01 Sep 1999 09:26:49 +1000

Gregory,

I added the restricted-gid command and am still having the same problems. 
What I log in with user guest, I am chrooted to the base directory
/data01.  It appears that the daemon is not reading the home directory from
/data01/etc/passwd or I have the entry in the wrong form.

I have tried putting the home directory in both absolute and chroot forms
in this file, and neither seem to work.

I just tried using the /data01/./guest syntax in the real /etc/passwd and
managed to get the effect that I am looking for (chroot point of
/data01/guest), but my impression from reading the man pages is that this
shouldn't be necessary.  The relevant man page section from ftpaccess.5 is
included below:

		If a guest-root is  chosen  for  the  user,  the
          user's home directory in the <root-dir>/etc/passwd file
          is used to determine the initial  directory  and  their
          home  directory  in  the system-wide /etc/passwd is not
          used.

As can be seen from the file excerpts included with my original message
(below), the global guest root is set to be /data01 for all guest users
(users in group guest set by "guestgroup guest"), and hence I believe that
the entry in /data01/etc/passwd should then be used to set the home
directory and the user restricted to that directory by restricted-gid.

Perhaps this is a bug, perhaps a feature.

James

Gregory A Lundberg wrote:
> 
> On Tue, Aug 31, 1999 at 05:31:04PM +1000, James McMahon wrote:
> 
> restricted-gid guest