Subject: Re: Too much

From: Bob Luckin <[email-masked]>
Date: Fri, 28 May 1999 11:19:01 CDT

> Hey guys(gals),
> 	thanks for the previous advice, I've gotten everything working
> right now, EXCEPT, does anyone know of a way to get around having all of
> those dang libraries in each guest users root? They add up to almost 3
> megs per user. With several hundred user on board, this will add up
> quickly when I implement the new *working* wu. Any advice would be oh so
> GREATly appreciated!!

If your operating system supports loopback mounts, you can use them to keep
a single copy of the libraries etc. and mount it under each user's home
directory...

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "Coder, adapt.  FTP Ada, redo C"
                                 [http://www.dhc.net/~luckin/palindromes.html]

---

From: Carles Xavier Munyoz Baldó <[email-masked]>
Date: Fri, 28 May 1999 18:35:26 +0200

Hello,
You may compile an static version of the ls command.
Follow the steps at the end of de document:
http://www.wildheart.org/wu-ftpd/

Greetings.
---
CTV-JET
Carles Xavier Munyoz Baldó / [email-masked]
http://www.ctv.es/USERS/carles
Dpto. Sistemas / System Department
Clave pública PGP / PGP public KEY
http://www.ctv.es/PGP-STAFF/carles.html
Tel: +34 96 584 52 91 - Fax: +34 96 584 48 96
---

---

From: Christopher Kist <[email-masked]>
Date: Fri, 28 May 1999 11:34:54 -0400 (EDT)

Hey guys(gals),

-ck

_____________________________________________________________________________
Christopher Kist				Phone: (757) 873-4500
VisiNet Network Operations			Fax:   (757) 873-4530	
([email-masked])
_____________________________________________________________________________

---

From: Gregory A Lundberg <[email-masked]>
Date: Sat, 29 May 1999 08:45:38 -0400 (EDT)

On Fri, 28 May 1999, Christopher Kist wrote:

> right now, EXCEPT, does anyone know of a way to get around having all
> of those dang libraries in each guest users root? They add up to
> almost 3 megs per user. With several hundred user on board, this will
> add up quickly when I implement the new *working* wu. Any advice would
> be oh so GREATly appreciated!!

The traditional way to do this is

  use hard links when the users are on the same filesystem.  symlinks will
  not work.  if you try them, don't bother asking why things are not
  working: you've been warned.

  use loopback mounts when on different filesystems.  The poor man's
  alternate here, for systems which do not support loopback mounts, is to
  use an NFS loopback.

The way I do this is:

- Choose a common point where all (or a large group) of users can be
  found.  On my servers, for instance, customer-users are in /home/users.

- Chroot (by making guest) the users to that common point.  I'm using
  2.5.0 (well duh) so I can do this without hacking in the passwd file or
  creating any new Unix groups:

    # /etc/ftpaccess

    # Make everyone a guest
    guestuser *

    # Oops, the username 'ftp' need to be real so anonymous FTP works.
    # (Consider this a KNOWN PROBLEM to be fixed in a future version.)
    realuser ftp

    # All users are in /home/users, all users are guests, set the chroot
    guest-root /home/users

- Follow the guest HOWTO and the FAQ to set up this area for guest use.
  This means I create /home/users/bin /home/users/etc etc.  For a complete
  look, see ftp://ftp.wu-ftpd.org/pub/wu-ftpd/examples/ .. which does not
  use these new features of ftpaccess, but shows the directory layout I 
  use.  Notice that I'm only creating one area for all users so I only
  need one copy of all the libs and other glue needed for FTP to work.

- Test to be sure everything works as it should.  At this point it should
  _except_ for one thing: users can cd into each other's directories.

- A new (since VR16) feature is 'restricted-uid'.  Think of this as a
  "soft chroot".  By that, I mean it appears to the user as if a chroot
  to their home directory has occurred, but the work is done in the
  daemon, not the OS.

  Because this work is done in the daemon, you should not rely on it to be
  as faithfull as a real chroot.  It *MIGHT* be possible to convince the
  daemon to allow access outside the user's home directory.

  Since this is a new feature, a few problems might occur.  In fact, some
  have.  So you want to be running 2.5.0 rather than a VR version to be
  sure you have the latest fixes for it.  FYI the problems were for
  Navigator and IE users and not security-related.

  A caveat: the daemon uses the home directory entry from the visible
  etc/passwd file.  This means the /home/users/etc/passwd in my example.
  It also means the home must be _locally_ correct.  In my example, I need
  to remove the /home/users prefix from the local etc/passwd file.

  # /etc/ftpaccess

  # Restrict all users to their home directories.
  restricted-uid *

- Be happy.  Dance in the streets.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195