Subject: Group questions...

From: Paul Jobe <[email-masked]>
Date: Tue, 11 May 1999 17:32:10 -0400

I have read many documents but still don't have a good idea why all
three
are used (BTW: upload.configuration.HOWTO was a big help ;)
I have also tried looking for these types of questions in FAQs and
throughout
this mailing list so if someone could just point me in the right
direction,
that would be great.

I guess I am a bit confused about the three group files within
wu-ftp (Version wu-2.4.2-academ[BETA-18]).

The three being:
	/etc/group
	/etc/ftpgroup
	/home/ftp/etc/group

Are both of these files necessary /etc/group and /home/ftp/etc/group 
or do you really only need one ?

Does the /home/ftp/etc/group file only work if "ftpadmin" owns
the files or directories (ie. Using the /home/ftp/etc/group file  
can not allow group access rights to files "ftpadmin" does not own) ?

Is /home/ftp/etc/group only necessary if you don't have access to
/etc/group  ???

My scenario,
file /etc/ftpgroup
test:password:archive
cnmtex:password:/var/ftp/cnmtex
cnmte:password:/var/ftp/pub/cnmte
rwasp:password:/var/ftp/pub/rwasp

What's the best way to set these passwords ??

How would user "ftp" use it ??
I tried a combination of...
$ ftp machine name
> quote site group cnmte
> quote site gpass password
530 Group access request incorrect

Any ideas ???
What I am really thinking is that I could have a single user "ftp"
login and after he/she logs in, "ftp" would not have access to
certain directories unless a "site group" is performed.
Is this possible or did I miss something...
I know I could do this with multiple accounts in /etc/passwd but then
don't know why there is a passwd in /etc/ftpgroup ??

Thanks a lot for your time,
Paul 

---If necessary, I have included my ftpaccess file below---

% cat ftpaccess
# I used ftpd -u002 because "defumask" didn't seem to work
# allow use of private file for SITE GROUP and SITE GPASS?
private yes

# passwd-check  <none|trivial|rfc822>  [<enforce|warn>]
passwd-check rfc822 warn

email [email-masked]

loginfails 2

readme  README*    login
readme  README*    cwd=*

message /welcome.msg            login
message .message                cwd=*

# below works fine...
compress        yes             all
tar             yes             all
chmod           yes             class=cnmte,class=rwasp
delete          yes             class=cnmte,class=rwasp
overwrite       yes             class=cnmte,class=rwasp
rename          yes             class=cnmte,class=rwasp
chmod           no              guest,anonymous
delete          no              guest,anonymous
overwrite       no              guest,anonymous
rename          no              guest,anonymous
umask           yes             all
##umask         no              guest,anonymous

path-filter anonymous /etc/pathmsg ^[-A-Aa-z0-9_\.]*$ ^\. ^- 
path-filter guest /etc/pathmsg ^[-A-Aa-z0-9_\.]*$ ^\. ^- 
path-filter ftp /etc/pathmsg ^[-A-Aa-z0-9_\.]*$ ^\. ^- 

log commands real
log transfers anonymous,real inbound,outbound

shutdown /etc/shutmsg

#extra precaution
noretrieve /etc/passwd

#class          name  who/whom              IP address
class           all   real,guest,anonymous  *
class           cnmte ftp                   *
class           rwasp pjobe                 *
limit   all     10   Any              /etc/banners/ftp.dead
limit   rwasp   10   Any              /etc/banners/ftp.dead
limit   cnmte   10   Any              /etc/banners/ftp.dead

# these don't seem to work or not matching with user
defumask     0002
defumask all 0002
defumask cnmte 0007
defumask rwasp 0007

##guestgroup    cnmte
##autogroup     cnmte   anonymous

# specify the upload directory information
upload  /var/ftp        *             no 
upload  /var/ftp        /bin          no
upload  /var/ftp        /etc          no
upload  /var/ftp        /lib          no
##upload  /var/ftp      /incoming     yes   root  daemon   0600 dirs
##upload  /var/ftp      /incoming     yes   ftp   ftp      0444 nodirs
upload  /var/ftp        /incoming     yes   ftp   ftp      0440 dirs 
3773
upload  /var/ftp        /incoming/*   yes   ftp   ftp      0440 nodirs
upload  /var/ftp        /pub          no
upload  class=cnmte     /var/ftp      /cnmtex    yes   ftp   cnmte   
0770 dirs  3770
upload  class=cnmte     /var/ftp      /pub/cnmte    yes   ftp   cnmte   
0770 dirs  3770
upload  class=rwasp     /var/ftp      /pub/rwasp    yes   ftp   rwasp   
0770 dirs  3770

# directory aliases...
alias   inc     /incoming
alias   cnmte   /pub/cnmte
alias   cnmtex  /pub/cnmtex
alias   rwasp   /pub/rwasp

GRCI Disclaimer:
The opinions expressed herein are strictly those of the 
author and do not necessarily reflect those of GRCI.

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 11 May 1999 18:54:45 -0400 (EDT)

On Tue, 11 May 1999, Paul Jobe wrote:

> three are used (BTW: upload.configuration.HOWTO was a big help ;) I
> have also tried looking for these types of questions in FAQs and
> throughout this mailing list so if someone could just point me in the
> right direction, that would be great.
> 
> I guess I am a bit confused about the three group files within wu-ftp
> (Version wu-2.4.2-academ[BETA-18]).
> 
> The three being:
> 	/etc/group
> 	/etc/ftpgroup
> 	/home/ftp/etc/group

/etc/group is used to determine group membership.  this effects mainly
initgroups() and the guestgroup clause in your ftpaccess file.

~ftp/etc/group is mainly used to show group names instead of numbers for
NLST (~ftp/bin/ls).

/etc/ftpgroup is used by SITE GROUP and SITE GPASS to map ftp-only
special-access groups to Unix groups and assign passwords for the ftp-only
groups.  Very, very few sites (read as: none) need this feature.

> Does the /home/ftp/etc/group file only work if "ftpadmin" owns the
> files or directories (ie. Using the /home/ftp/etc/group file can not
> allow group access rights to files "ftpadmin" does not own) ?

~ftp/etc should be at least a=x permissions.
~ftp/etc/passwd and ~fpt/etc/group should be at least a=r

> Is /home/ftp/etc/group only necessary if you don't have access to

No.  If you don't have access to /etc/group you cannot get initgroup()
functionality and the guestgroup feature won't work.

> 530 Group access request incorrect

You need to read the man pages to properly format this file: it is not
formatted the same as /etc/group and ~ftp/etc/group.  The privatepw
program is available from ftp.vr.net and the resource center; it allows
management of the passwords in /etc/ftpgroup.

> Any ideas ??? What I am really thinking is that I could have a single
> user "ftp" login and after he/she logs in, "ftp" would not have access
> to certain directories unless a "site group" is performed. Is this
> possible or did I miss something... I know I could do this with
> multiple accounts in /etc/passwd but then don't know why there is a
> passwd in /etc/ftpgroup ??

I think all you need do is read the man pages and get privatepw.  You're
on the right track for what you want to do without needing multiple
usernames/groups.  Most sites, though, will find it a lot easier to use
multiple usernames/groups since it does not require special training for
the human-user and can be used directly from all clients (not all clients
allow SITE commands: most importantly, web browsers do not support it).

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Bob Luckin <[email-masked]>
Date: Tue, 11 May 1999 20:28:47 CDT

> groups.  Very, very few sites (read as: none) need this feature.

Don't read as: none - I find this feature very useful...  :-)

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "Coder, adapt.  FTP Ada, redo C"
                                 [http://www.dhc.net/~luckin/palindromes.html]