Subject: Help! Is something broken?

From: [email-masked] (Dennis M. O'Neill)
Date: Thu, 12 Oct 1995 17:41:09 -0600

I was doing a routine once over of our ftp server and was shocked to find
that I could 'cd' out of a guest account to its parent directory and from
there to any other directory in the tree!. I'm quite certain that
previously when I logged into one of these accounts, and did a

        cd ..

it left me right where I was instead of moving me up a level. Also, if I do a

        pwd

it gives me the complete pathname from root on down (e.g.,
/home/ftpusers/foo) rather than the pseudo root. It looks to me that the
'chroot' isn't taking place.

The relevant settings in 'ftpaccess' are:

class       foo     guest    NNN.MMM.NNN.MMM
guestgroup  foo
limit       foo     1        Any    /usr/local/etc/toomany.msg
upload      /home/ftpusers/foo/incoming /incoming yes test ftp 0600

Is something broken or am I hallucinating?

Thanks,

Dennis

--------------------------------------------------------------------------
* Dennis M. O'Neill                                         [email-masked]  *
* Schlumberger Geco-Prakla                       (713) 596-6103 (Office) *
* 1325 S. Dairy Ashford                          (713) 596-1807 (FAX)    *
* Houston, TX 77077                                                      *
--------------------------------------------------------------------------

---

From: Darci Chapman <[email-masked]>
Date: Thu, 12 Oct 1995 16:03:00 -0700

You'll need force a chroot on login by futzing with the /etc/passwd file
(the real one) like this:

1. Do the /etc hacks.  Create Mort's entry in /etc/passwd and add the 
   /etc/group entry.  (Or adduser or whatever you use.)  Add the 
   entries to /etc/ftpaccess.

/etc/passwd:
mort:*:403:400:Mortimer Snerd:/home/web/mort/./:/etc/ftponly
                                            ^^^
   The /./ sequence determines where the chroot() is done to.  If you 
   want the chroot() done to the web directory and a chdir() to mort,
   it would look like this:

mort:*:403:400:Mortimer Snerd:/home/web/./mort/:/etc/ftponly
                                       ^^^

   --------> (make sure "/etc/ftponly" is in /etc/shells.)

[stolen shamelessly from Michael Brennen ;-]

--
Darci L. Chapman Sr. Software/Firmware Consultant [email-masked]
               On loan from: Solution Logic, Inc, 503/222-0057
                 On loan to: Intel Corporation, 503/264-1419
		          http://puma.jf.intel.com

---

From: Chris Woods <[email-masked]>
Date: Thu, 12 Oct 1995 22:13:39 -0400 (EDT)

> it left me right where I was instead of moving me up a level. Also, if I do a

You need to set up the users' entries in /etc/passwd so that wu-ftpd does 
the chroot() properly. For example:

joeguest::410:121::/ftphome/./joeguest:/etc/ftponly

and make sure that the gid corresponds with the entry in /etc/group that
is being guestgroup'ed in the ftpaccess file. Also make sure the shell is
in /etc/shell. Note: many have problems getting this to work properly. I
had trouble until I created the directories mentioned in some dox
somewhere (sorry, don't remember where): basically
~ftp/{etc,usr,bin,usr/bin,lib,dev}. I created ~ftp/dev/zero, compiled GNU
ls statically and put it in ~ftp/bin and ~ftp/usr/bin, and made sure
~ftp/etc/passwd existed with just root and ftp in it. 

 Chris Woods     Senior System Administrator       USAinternet, Inc.
 GCS/CM/IT d- s++:+ a- C++++$ ULS++++$ P+++$>++++  L++++$ E W$ N+ !o
 K++ !w--- !O !M-- !V-- PS+? !PE !Y+>++ PGP+ t+@ !5 X !R tv? b+ DI++
 D+@ G++ e h---- r+++ y++++
 [email-masked]           http://www.usa1.com         508-774-4700