Subject: chroot steps for Solaris 2.4/2.5.1?

From: Dan Foster <[email-masked]>
Date: Thu, 6 Jun 1996 18:06:23 -0400 (EDT)

Howdy!
	I know the general instructions is to "RTFM the Solaris man page
on ftpd and take it from there" but problem is, guy who originally installed
Solaris later overwrote the man page with wu-ftpd 2.4.2 beta 11. *grumble*.

	Anybody got a copy of the man page for Solaris 2.4, have pointers
to it somewhere in cyberspace, or the instructions? That would be
*greatly* appreciated... thanks! :)

-Dan
Internet: [email-masked]

---

From: [email-masked] (Andy Wessels)
Date: Thu, 6 Jun 1996 17:26:56 -0500

----------
X-Sun-Data-Type: text
X-Sun-Data-Description: text
X-Sun-Data-Name: text
X-Sun-Charset: us-ascii
X-Sun-Content-Lines: 36

> From [email-masked] Thu Jun  6 17:18 CDT 1996
> Date: Thu, 6 Jun 1996 18:06:23 -0400 (EDT)
> From: Dan Foster <[email-masked]>
> To: [email-masked]
> Cc: [email-masked]
> Subject: chroot steps for Solaris 2.4/2.5.1?
> Mime-Version: 1.0
> Content-Transfer-Encoding: 7bit
> X-Listprocessor-Version: 7.1 -- ListProcessor by CREN
> 
> Howdy!

dan, 
  fyi...it is also on the cdrom for solaris...i believe that it is on slice 
3 of the cd. it has been a while since i had to dig in their. (slice 3 for
the 'm' architecture...adjust accordingly if on 'd' or 'c' architecture.

Hope this helps!!

andy.
[email-masked]
----------
X-Sun-Data-Type: default
X-Sun-Data-Description: default
X-Sun-Data-Name: ftpd.1m.cat
X-Sun-Charset: us-ascii
X-Sun-Content-Lines: 528

in.ftpd(1M)           Maintenance Commands            in.ftpd(1M)

NAME
     in.ftpd, ftpd - file transfer protocol server

SYNOPSIS
     in.ftpd [ -dl ] [ -t_t_i_m_e_o_u_t ]

DESCRIPTION
     in.ftpd is the Internet File Transfer Protocol (FTP)  server
     process.   The  server  is  invoked  by  the Internet daemon
     inetd(1M) each time a connection to  the  FTP  service  (see
     services(4)) is made.

OPTIONS
     -d           Debugging information is logged to  the  system
                 log daemon syslogd(1M).

     -l           Each FTP session is logged to  the  system  log
                 daemon syslogd(1M).

      - t_t_i_m_e_o_u_t    Set  the   inactivity   timeout   period   to
                 _t_i_m_e_o_u_tseconds.   The FTP server will timeout an
                 inactive session after 15 minutes.

  Requests
     The  FTP  server  currently  supports  the   following   FTP
     requests; case is not distinguished.

     ABOR        abort previous command

     ACCT        specify account (ignored)

     ALLO        allocate storage (vacuously)

     APPE        append to a file

     CDUP        change to parent of current working directory

     CWD         change working directory

     DELE        delete a file

     HELP        give help information

     LIST        give list files in a directory (ls -lg)

     MKD         make a directory

     MODE        specify data transfer _m_o_d_e

     NLST        give name list of files in directory (ls)

     NOOP        do nothing

SunOS 5.4           Last change: 18 Oct 1993                    1

in.ftpd(1M)           Maintenance Commands            in.ftpd(1M)

     PASS        specify password

     PASV        prepare for server-to-server transfer

     PORT        specify data connection port

     PWD         print the current working directory

     QUIT        terminate session

     RETR        retrieve a file

     RMD         remove a directory

     RNFR        specify rename-from file name

     RNTO        specify rename-to file name

     STOR        store a file

     STOU        store a file with a unique name

     STRU        specify data transfer _s_t_r_u_c_t_u_r_e

     TYPE        specify data transfer _t_y_p_e

     USER        specify user name

     XCUP        change to parent of current working directory

     XCWD        change working directory

     XMKD        make a directory

     XPWD        print the current working directory

     XRMD        remove a directory

     The remaining FTP requests specified in RFC 959  are  recog-
     nized, but not implemented.

     The FTP server will abort an active file transfer only  when
     the  ABOR  command is preceded by a Telnet Interrupt Process
     (IP) signal and a Telnet Synch signal in the command  Telnet
     stream, as described in RFC 959.

     in.ftpd interprets file names according to the globbing con-
     ventions  used  by  sh(1).  This allows users to utilize the
     metacharacters:  _**** _???? _[[[[ _]]]] _{{{{ _}}}} _~~~~

     in.ftpd authenticates users according to four rules.

SunOS 5.4           Last change: 18 Oct 1993                    2

in.ftpd(1M)           Maintenance Commands            in.ftpd(1M)

           1)    The user name must be in the password data base,
                 /etc/passwd,  and  have  a  password that is not
                 null.  A password must always be provided by the
                 client  before  any  file operations may be per-
                 formed.

           2)    If  the  user   name   appears   in   the   file
                 /etc/ftpusers, ftp access is denied.

           3)    ftp access is denied if the user's  shell  (from
                 /etc/passwd)   is   not   listed   in  the  file
                 /etc/shells.  If the file /etc/shells  does  not
                 exist,  then the user's shell must be one of the
                 following:

                       /usr/bin/sh  /usr/bin/csh /usr/bin/ksh
                       /usr/bin/jsh /bin/sh      /bin/csh
                       /bin/ksh     /bin/jsh     /sbin/sh
                       /sbin/jsh

           4)    If the user name is  "anonymous"  or  "ftp",  an
                 entry  for  the user name _f_t_p must be present in
                 the password and shadow files.  The user is then
                 allowed  to  log in by specifying any password -
                 by convention this is given as the user's e-mail
                 address  (such  as  [email-masked]).   Do not
                 specify a valid shell in the password  entry  of
                 the  _f_t_p  user, and do not give it a valid pass-
                 word (use NP in the encrypted password field  of
                 the shadow file).

     For anonymous ftp users, in.ftpd takes special  measures  to
     restrict  the  client's  access privileges.  The server per-
     forms a chroot(2) command to the home directory of  the  ftp
     user.   In order that system security is not breached, it is
     recommended that the ftp subtree be constructed  with  care;
     the following rules are suggested.

     ~ftp        Make the home directory owned by ftp and unwrit-
                 able by anyone.  This directory should not be on
                 a file system mounted with the nosuid option.

     ~ftp/bin    Make this directory owned by the super-user  and
                 unwritable by anyone.  Make this a symbolic link
                 to  ~ftp/usr/bin  The  program  ls(1)  must   be
                 present to support the list commands.  This pro-
                 gram should have mode 111.

SunOS 5.4           Last change: 18 Oct 1993                    3

in.ftpd(1M)           Maintenance Commands            in.ftpd(1M)

     ~ftp/usr/lib
                 Make this directory owned by the super-user  and
                 unwritable by anyone.  Copy the following shared
                 libraries from /usr/lib into this directory.:

                 ld.so*
                 libc.so*
                 libdl.so*
                 libintl.so*
                 libw.so*
                 libnsl.so*
                 libsocket.so*
                 nss_nis.so*
                 nss_nisplus.so*
                 nss_dns.so*
                 nss_files.so*
                 straddr.so*

     ~ftp/etc    Make this directory owned by the super-user  and
                 unwritable  by  anyone.   Copies  of  the  files
                 passwd(4), group(4), and  netconfig(4)  must  be
                 present  for  the  ls  command to work properly.
                 These files should be mode 444.

     ~ftp/pub    Make this directory mode 777 and owned  by  ftp.
                 Users  should  then  place files which are to be
                 accessible via the  anonymous  account  in  this
                 directory.

     ~ftp/dev    Make this directory owned by the super-user  and
                 unwritable  by  anyone.  First perform ls -lL on
                 the device files listed below to determine their
                 major  and  minor  numbers,  then  use  mknod to
                 create them in this directory.

                 /dev/zero
                 /dev/tcp
                 /dev/udp
                 /dev/ticotsord

EXAMPLES
     To set up anonymous ftp, add  the  following  entry  to  the
     /etc/passwd file. In this case, /export/ftp was chosen to be
     the anonymous ftp area, and the shell  is  the  non-existant
     file  /nosuchshell.   This prevents users from logging in as
     the ftp user.
         ftp:x:30000:30000:Anonymous FTP:/export/ftp:/nosuchshell
     Add the following entry to /etc/shadow:
         ftp:NP:6445::::::

SunOS 5.4           Last change: 18 Oct 1993                    4

in.ftpd(1M)           Maintenance Commands            in.ftpd(1M)

     The following is  a  shell  script  that  will  set  up  the
     anonymous  ftp  area.   It  presumes that names are resolved
     using NIS.

     #!/bin/sh
     # script to setup SunOS 5.3 anonymous ftp area
     #

     # handle the optional command line argument
     case $# in

        # the default location for the anon ftp comes from the passwd file
        0) ftphome="`grep '^ftp:' /etc/passwd | cut -d: -f6`"
           ;;

        1) if [ "$1" = "start" ]; then
              ftphome="`grep '^ftp:' /etc/passwd | cut -d: -f6`"
           else
              ftphome=$1
           fi
           ;;

        *) echo "Usage: $0 [anon-ftp-root]"
           exit 1
           ;;
     esac

     if [ -z "${ftphome}" ]; then
        echo "$0: ftphome must be non-null"
        exit 2
     fi

     # This script assumes that ftphome is neither / nor /usr so ...
     if [ "${ftphome}" = "/" -o "${ftphome}" = "/usr" ]; then
        echo "$0: ftphome must not be / or /usr"
        exit 2
     fi

     # If ftphome does not exist but parent does, create ftphome
     if [ ! -d ${ftphome} ]; then
         # lack of -p below is intentional
         mkdir ${ftphome}
     fi

     echo Setting up anonymous ftp area ${ftphome} for SunOS 5.3

     # Ensure that the /usr/bin directory exists
     if [ ! -d ${ftphome}/usr/bin ]; then
         mkdir -p ${ftphome}/usr/bin
     fi

     cp /usr/bin/ls ${ftphome}/usr/bin

SunOS 5.4           Last change: 18 Oct 1993                    5

in.ftpd(1M)           Maintenance Commands            in.ftpd(1M)

     chmod 111 ${ftphome}/usr/bin/ls

     # Now set the ownership and modes to match the man page
     chown root ${ftphome}/usr/bin
     chmod 555 ${ftphome}/usr/bin

     # this may not be the right thing to do
     # but we need the bin -> usr/bin link
     if [ -r ${ftphome}/bin ]; then
         mv -f ${ftphome}/bin ${ftphome}/Obin
     fi
     ln -s usr/bin ${ftphome}

     # Ensure that the /usr/lib and /etc directories exist
     if [ ! -d ${ftphome}/usr/lib ]; then
         mkdir -p ${ftphome}/usr/lib
     fi
     if [ ! -d ${ftphome}/etc ]; then
         mkdir -p ${ftphome}/etc
     fi

     #Most of the following are needed for basic operation, except
     #for libnsl.so, nss_nis.so, libsocket.so, and straddr.so which are
     #needed to resolve NIS names.

     cp /usr/lib/ld.so /usr/lib/ld.so.1 ${ftphome}/usr/lib

     for lib in libc libdl libintl libw libnsl libsocket \
        nss_nis nss_nisplus nss_dns nss_files
     do
        cp /usr/lib/${lib}.so.1 ${ftphome}/usr/lib
        rm -f ${ftphome}/usr/lib/${lib}.so
        ln -s ./${lib}.so.1 ${ftphome}/usr/lib/${lib}.so
     done

     cp /usr/lib/straddr.so.2 ${ftphome}/usr/lib
     rm -f ${ftphome}/usr/lib/straddr.so
     ln -s ./straddr.so.2 ${ftphome}/usr/lib/straddr.so

     cp /etc/passwd /etc/group /etc/netconfig ${ftphome}/etc

     chmod 555 ${ftphome}/usr/lib/*
     chmod 444 ${ftphome}/etc/*

     # Now set the ownership and modes
     chown root ${ftphome}/usr/lib ${ftphome}/etc
     chmod 555 ${ftphome}/usr/lib ${ftphome}/etc

     # Ensure that the /dev directory exists
     if [ ! -d ${ftphome}/dev ]; then
         mkdir -p ${ftphome}/dev

SunOS 5.4           Last change: 18 Oct 1993                    6

in.ftpd(1M)           Maintenance Commands            in.ftpd(1M)

     fi

     # make device nodes. ticotsord and udp are necessary for
     # 'ls' to resolve NIS names.
     prefix="/devices/pseudo/mm@0:"

     for device in zero
     do
        line=`ls -l ${prefix}${device} | sed -e 's/,//'`
        major=`echo $line | awk '{print $5}'`
        minor=`echo $line | awk '{print $6}'`
        rm -f ${ftphome}/dev/${device}
        mknod ${ftphome}/dev/${device} c ${major} ${minor}
     done

     prefix="/devices/pseudo/clone@0:"

     for device in tcp udp ticotsord
     do
        line=`ls -l ${prefix}${device} | sed -e 's/,//'`
        major=`echo $line | awk '{print $5}'`
        minor=`echo $line | awk '{print $6}'`
        rm -f ${ftphome}/dev/${device}
        mknod ${ftphome}/dev/${device} c ${major} ${minor}
     done
     chmod 666 ${ftphome}/dev/*

     ## Now set the ownership and modes
     chown root ${ftphome}/dev
     chmod 555 ${ftphome}/dev

     if [ ! -d ${ftphome}/pub ]; then
        mkdir -p ${ftphome}/pub
     fi
     chown ftp ${ftphome}/pub
     chmod 777 ${ftphome}/pub

DIAGNOSTICS
     in.ftpd logs various errors to syslogd, with a facility code
     of daemon.

  Info Severity
     These messages are logged only if the -l flag is specified.

     FTPD: connection from _h_o_s_t at _t_i_m_e
                 A connection was made to ftpd from the host _h_o_s_t
                 at the date and time _t_i_m_e.

     FTPD: User _u_s_e_r timed out after _t_i_m_e_o_u_t seconds at _t_i_m_e
                 The user _u_s_e_r was logged out  because  they  had
                 not  entered any commands after _t_i_m_e_o_u_t seconds;
                 the logout occurred at the date and time _t_i_m_e.

SunOS 5.4           Last change: 18 Oct 1993                    7

in.ftpd(1M)           Maintenance Commands            in.ftpd(1M)

  Debug Severity
     These messages are logged only if the -d flag is specified.

     FTPD: command: _c_o_m_m_a_n_d
                 A command line containing _c_o_m_m_a_n_d was read  from
                 the FTP client.

     lost connection
                 The FTP client dropped the connection.

     <--- _r_e_p_l_y_c_o_d_e
     <--- _r_e_p_l_y_c_o_d_e-
                 A reply was sent to  the  FTP  client  with  the
                 reply  code  _r_e_p_l_y_c_o_d_e.  The next message logged
                 will include the  message  associated  with  the
                 reply.  If a - follows the reply code, the reply
                 is continued on later lines.

SEE ALSO
     ftp(1), ls(1), aset(1M), inetd(1M), mknod(1M),  syslogd(1M),
     chroot(2),  getsockopt(3N), group(4), inetd.conf(4), netcon-
     fig(4), netrc(4), passwd(4), services(4)

     Postel, Jon, and Joyce Reynolds, _F_i_l_e  _T_r_a_n_s_f_e_r  _P_r_o_t_o_c_o_l  (
     FTP  ),  RFC  959,  Network Information Center, SRI Interna-
     tional, Menlo Park, Calif., October 1985.

NOTES
     The anonymous account is inherently dangerous and should  be
     avoided when possible.

     The server must run as the super-user to create sockets with
     privileged  port numbers.  It maintains an effective user id
     of the logged in user, reverting to the super-user only when
     binding  addresses  to sockets.  The possible security holes
     have been extensively scrutinized, but are  possibly  incom-
     plete.

     /etc/ftpusers contains a list of users who cannot access the
     system; the format of the file is one user name per line.

SunOS 5.4           Last change: 18 Oct 1993                    8

----------
X-Sun-Data-Type: default
X-Sun-Data-Description: default
X-Sun-Data-Name: ftpd.1m
X-Sun-Charset: us-ascii
X-Sun-Content-Lines: 2

.so man1m/in.ftpd.1m
.\" @(#)ftpd.1m 1.0 93/10/11 SMI;

---

From: [email-masked] (Thomas White)
Date: Fri, 7 Jun 1996 07:17:51 -0400

I've got it..
did you already get it ??
tw
> From [email-masked] Thu Jun  6 18:45 EDT 1996

--
*******************************************************************************
Bear Stearns is not responsible for any recommendation, solicitation, offer or
agreement or any information about any transaction, customer account or account
activity contained in this communication.
*******************************************************************************

---

From: [email-masked] (Thomas White)
Date: Fri, 7 Jun 1996 07:18:43 -0400

Yup.. looks like you did.

tw

---

From: Dan Foster <[email-masked]>
Date: Fri, 7 Jun 1996 09:55:57 -0400 (EDT)

I want to thank all the people that helped!  *Greatly* appreciated.

I will be acquiring a SMP box as a workstation, so hopefully I'll also 
acquire some more time to hack at wu-ftpd and submit any patches.

-Dan