Subject: [945] Re: [943] RE: [923] Guest ftp access

From: "Randolph J. Herber" <[email-masked]>
Date: Fri, 16 Dec 1994 15:28:17 -0600

Hard links will work.  Soft (or symbolic) links will not.
Hard links indicate inode numbers directly.  Soft links supply different
translations for path components.

Symbolic links must be relative (i.e. not starting with a / if they are
to work both in and out of the chroot environment.  Think about the
meaning of an absolute (i.e. beginning with a /) link in both environments.
To work properly a symbolic link must not attempt to escape the chroot
environment.

Randolph J. Herber, [email-masked], +1 708 840 2966, CD/HQ
(Speaking for myself and not for US, US DOE, FNAL nor URA.)
(Product, trade, or service marks herein belong to their respective owners.)

|Date: Fri, 16 Dec 1994 14:02:09 -0800 (PST)
|From: [email-masked]
|Subject: [943] RE: [923] Guest ftp access
|To: [email-masked], [email-masked]

|After working with this a while I finally came up with the answer in my sleep
|last night.  It seems so obvious in retrospect...

|When the guest user logs in, a chroot() is done to the appropriate
|subdirectory - since that is the new root, there are no longer any executables
|in the path, so ls could not be executed to show the contents of the
|directory.  I fixed this the only way I know how - I put a bin directory with
|ls in it in the guest ftp login directory, protection 555 on bin and 111 on ls
|so it can't be modified.  That fixed the problem.  I don't like having to copy
|ls multiple times, but I don't know any other way around the problem.  I may
                                                                        ^ ^^^
|play with links and see if that works.
 ^^^^ ^^^^ ^^^^^ ^^^ ^^^ ^^ ^^^^ ^^^^^^

|I hope this has been useful to someone else...

	...

|>Michael Brennen                    Intecom, Inc.
|>[email-masked]               5057 Keller Springs
|>(214) 447-8074                     Dallas,  TX  75248

---

From: [email-masked] (Bill Campbell)
Date: Fri, 16 Dec 1994 15:00:55 -0800 (PST)

> To work properly a symbolic link must not attempt to escape the chroot
One way around this that works is to make directories in the root
file system that are symlinks to the ftp file system.  For instance,
we have our ftp stuff under the /ftp directory (original huh?).  Then
I have linked 'ln -s /ftp/pub /pub' so that a symlink under anon-ftp
will resolve properly when running on the normal system.  I find this
a lot easier than trying to figure out relative path names on our
system where there are multiple file systems under the /ftp directory
which precludes using hard links.

Bill
--
INTERNET:  [email-masked]   Bill Campbell; Celestial Systems, Inc.
UUCP:              camco!bill   2835 82nd Avenue S.E. S-100
FAX:           (206) 232-9186   Mercer Island, WA 98040; (206) 947-5591
http://www.celestial.com/

The question is, why are politicians so eager to be president?  What is
it about the job that makes it worth revealing, on national television,
that you have the ethical standards of a slime-coated piece of
industrial waste?
		-- Dave Barry, "On Presidential Politics"