Subject: Re: alias directories for ftponly users

From: "Keith Smith" <[email-masked]>
Date: Sat, 8 Jun 1996 20:21:53 -5

On  6 Jun 96 at 11:08, Chuck Nelson wrote:

> I have a group of companies who use ftp to transfer data to and from
> our site for processing. I have created a set of users and a group
> for them and defined the group to WU-FTP as ftponly. Each user has
> his own directory with a single "master" id who has access to each
> other. I would like to create a single "public" directory for common
> files. Due to security reasons, I have each user chrooted to his
> home. I would like to "ln" the public directory under each user's
> home. I tried just using symbolic links and FTP was unable to "see"
> the files. How can I set this up?

We have an almost identical requirement for our clients, with the 
additional requirement that files placed in the "public" area were 
accessible to all clients *and* to anonymous users.

What I did was set up a "guest" area, which was the home for the 
anonymous user and the client users.  The clients however are placed 
in a subdirectory two levels below the home.  For example:

[from passwd]
 client1:[...]:/home/guest/./clients/client1:/bin/ftponly

[sample tree]
 ~guest/
 ~guest/public
 ~guest/incoming
 ~guest/clients
 ~guest/clients/client1
 ~guest/clients/client1/public [-> ~/guest/public]
 ~guest/clients/client1/incoming
 ~guest/clients/client2
 ~guest/clients/client2/public [-> ~/guest/public]
 ~guest/clients/client2/incoming

Access to the various directories is controlled by guest access, which 
means that the anonymous user can not change to (or search) the 
clients directory and the clients can not access each others 
directories.  Note that each client has their own incoming directory, 
I did this to give our clients a bit more control over what they can 
upload.  For example most can make directories and delete files from 
their incoming directory.  This is definitely NOT allowed for the 
"public" incoming directory "~guest/incoming".

Staff members have access to all the directories, usualy controled 
through group acccess, except in a couple of cases where user access 
is used.

In general we have found the system to work well, the only downsides 
being that every client belongs to at least two groups, and every 
client can see the the directory name of all other clients (as they 
have search rights to ~/guests/clients/).  In our case it is not a 
problem that the clients know who some of our other clients are - but 
there is no law that says the directory name must be the same as the 
clients.

Regards,
Keith.

------------
Keith Smith                                 [email-masked]
Paradigm Technology Limited                 Senior Software Engineer
PO Box 10-268                               +64 (4) 495-1000 (voice)
Wellington, New Zealand                     +64 (4) 405-1003 (fax)
             Finger [email-masked] for PGP key
                  [all required disclaimers apply]