Subject: Re: Virtual FTP and Solaris 2.5

From: [email-masked] (Mukesh Kacker)
Date: Tue, 25 Jun 1996 07:24:16 -0700

> > 
> > One would sumise that a virtual server would be able to share all the
> > libraries and other needed files with symbolic links...NOT SO. This means
> > that in order to have a virtual server I have to use 8 megabytes of storage
> > space just to create the virtual ftp.
>

I can suggest an outline of an "experiment" to fans of Virtual FTP who want
to save space used by shared libraries by sharing them between the "chroot"'d
FTP areas of the various sites being hosted on one machine. I currently do
not have time to test this out to see if it works and any site running
awuftpd  Virtual FTP is probably better equipped to do this.

The central idea is to use a partition with a copy of the shared libraries
and use "loopback virtual file system" [ Read lofs(7F) ] mounting in
Solaris 2 to do the sharing. The details follow for those interested.

-----

Anonymous FTP login involves a chroot to a separate directory part
which requires replicating the shared libries used by the set of commands
accessible to the anonymous ftp user (minimally /usr/bin/ls). With
Virtual FTP, I presume that the chroot() is done to different diretories
based on the destination address of the connection (local address from the
server end). The goal is to share the shared libraries among the FTP chroot'd
areas. There should still be ONE copy of these libraries made because part of
the reason of chroot() is to take away the ability of anonymous ftp users
to exploit any (present or future) security holes to compromise your system.
[ I would not recommend using this technique to share the libraries of the
primary system root area ]

This "sharing" cannot be done with symbolic links since they oviously
cannot span outside the chroot'd area. It is limited (and can have other
problems), with "hard links" which can only be made within a filesystem
partition.

With loopback filesystem, what might work is to have a separate partition
mounted can be dedicated to the "ftp shared libs" and mounting that
area on other chroot'd ftp library areas. Here is in illustration of what
I am suggesting would be needed to make the ls commands in different
virtual FTP areas share a single copy of the libraries. It is just
an illustartion which can be customized for their sites...

(1) Use a partition (e.g. /dev/dsk/c0t1d0s0 for the shared libraries)
	- Find out what librares are needed
        e.g.
		host% ldd /usr/bin/ls
 	       libc.so.1 =>     /usr/lib/libc.so.1
	        libdl.so.1 =>    /usr/lib/libdl.so.1

	- Create the directory for replica of the shared libraries needed
	  mount it readonly after "initializing "
	e.g.
	host# mkdir /shared_ftp_libs
	host# mount -F ufs /dev/dsk/c0t1d0s0 /shared_ftp_libs
	host# cp -p /usr/lib/libc.so.1 /shared_ftp_libs
	host# cp -p /usr/lib/libdl.so.1 /shared_ftp_libs
	[ Comment: unmount and remount it read only (and any other
	  options now ]
	host# umount /shared_ftp_libs
	host# mount -F ufs -r /dev/dsk/c0t1d0s0 /shared_ftp_libs

(2)  Create the ".../usr/lib" directories in your virtual ftp chroot areas:
	e.g.

	host# mkdir -p /export/ftp/virtual_site1/usr/lib
	host# mkdir -p /export/ftp/virtual_site2/usr/lib

(3) Mount the lib areas using "lofs" filesystem
	e.g.

	host# mount -F lofs /shared_ftp_libs /export/ftp/virtual_site1/usr/lib
	host# mount -F lofs /shared_ftp_libs /export/ftp/virtual_site1/usr/lib

Once this done manually and properly initialized, the basic mount command
equivalents can put in the right order (and order is important) in /etc/vfstab.
so that it comes up as needed at boot time.

------------

I hope that is enough of an outline for anyone interested to attempt
this. As I said before, I have not really tried this and there might
be some gotchas or details missing. But as far as I know, this should
work and accompliesh sharing of the shared libraries among the different
chroot areas of "virtual FTP" sites on the same host.

-Mukesh Kacker
 Internet Engineering
 Sun Microsystems Inc(SunSoft)
 [email-masked]

---

From: Mike Batchelor <[email-masked]>
Date: Wed, 26 Jun 1996 21:20:28 -0400 (EDT)

> Solaris 2 to do the sharing. The details follow for those interested.

According to the man page for lofs(7FS), it is designed to work as you
describe:

     Loopback mounts of '/' can be performed in conjunction  with
     the  chroot(2)  system  call,  to provide a complete virtual
     file system to a process or family of processes.

Furthermore, just as with any other filesystem type, you can mount lofs
read-only, which is a winner for anon ftp, virtual or not.

---
  + + +      %%%%% Mike Batchelor % [email-masked] %%%%% A Division
 Capitol.Net %%%%%%%%%%% 301-306-9090 % V.34/ISDN %%%%%%%%%%%    of
     + + +   %% Serving Washington DC, No.VA, and Maryland %%   Criticom, Inc.