Subject: chroot for real users

From: "Paul J. Campbell" <[email-masked]>
Date: Tue, 18 May 1999 10:38:48 -0400

hi all,

i have successfully setup wuftp with both real and guest users. i would
like to further configure my environment to chroot all the real users. the
closest configuration parameter i see to do this is -rRootDirectory but this
falls short primarily since i can not limit the scope to the individual
account with out something like -rRootDirectory/%U (also my inetd is giving
me grief about the length of the in.ftpd argument list). i don't want to 
enroll my real users in a guestgroup as that is would be too restrictive.

thanks
/pc

Paul Campbell
------------
[email-masked], MailStop: 3-3S, Group: S2 (ENGRG),
Location: 3.3.201, Phone: 1-508-323-2360

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 18 May 1999 11:33:22 -0400 (EDT)

On Tue, 18 May 1999, Paul J. Campbell wrote:

> i have successfully setup wuftp with both real and guest users. i
> would like to further configure my environment to chroot all the real
> users. the closest configuration parameter i see to do this is
> -rRootDirectory but this falls short primarily since i can not limit
> the scope to the individual account with out something like
> -rRootDirectory/%U (also my inetd is giving me grief about the length
> of the in.ftpd argument list). i don't want to enroll my real users in
> a guestgroup as that is would be too restrictive.

No.  What you want to do is make everyone a guest user.

If it seems too restrictive, you're not thinking about your security model
in the right way.

There are features in the current version of the daemon (VR17) which make
all this vastly easier to set up and manage.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195