NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/comp/sys/hp/14414

Text File | 1992-12-29 | 5.8 KB | 130 lines

Newsgroups: comp.sys.hp
Path: sparky!uunet!news.mentorg.com!news
From: [e-mail]
Subject: Re: Need Restricted FTP
Summary: sub-login anon ftp
Sender: [e-mail] (News User)
Message-ID: <[e-mail]>
Date: Tue, 29 Dec 1992 23:43:16 GMT
References: <[e-mail]> <frank.724454838@fam168>
Nntp-Posting-Host: mgpdxmms.mentorg.com
Organization: Mentor Graphics Corporation
Lines: 116

In article <frank.724454838@fam168> Frank Hoffmann <[e-mail]> writes:
>[e-mail] (Joseph Konton) writes:
>
>>My company has a need to provide ftp service to a customer in order to
>>exchange files with them.
>
>>In my reading of the manual, it indicates that an anonymous user is
>>limited to the directory structure /users/ftp, and that the user is
>>chrooted such that that directory appears to be the root directory.
>
>>I'd like to be able to do this for our customer so that they can only
>>access the files and directories that we wish them to have access to.
>
>>Anonymous ftp is not a suitable solution as we do not want just anyone
>>to have access to these files.
>
>>Is there a way to accomplish this?  Perhaps a customized version of the ftp
>>daemon?
>

Frank,

You can establish an ./etc/passwd file within the /users/ftp directory such
that
issuing a 'user xyz' command after logging in anonymously (as user 'ftp') then
places you into a second home directory lower in the /users/ftp hierarchy. We
did this for exchanging sensitive information with our vendors, making it
more secure by setting permissions for the second user account to owner only.

This feature of HP's ftpd is called "sub-login"s and is discussed in the man
page for ftpd. I've attached an excerpt.

Between that and using /usr/adm/inetd.sec, on the 'firewall' machine, makes the
whole thing reasonably useful.

Mark Silbernagel                |
Mentor Graphics Corporation     | ...Don't let the sands of time
8005 S.W. Boeckman Road         |    get in your shorts      ;')
Wilsonville, OR  97070-7777     |
[phone]                  |    [e-mail]

--

From HP's ftpd man page, HP-UX ver 8.05.

... quoted in part, and without permission.

" In order to permit anonymous FTP, there must be an entry in the
      passwd(4) database for an account named ftp.  The password field
      should be *, the group membership should be guest, and the login shell
      should be /bin/false.  For example (assuming the guest group ID is
      10):

           ftp:*:500:10:anonymous ftp:/users/ftp:/bin/false

      The anonymous ftp directory should be set up as follows:

      ~ftp    The home directory of the ftp account should be owned by user
              ftp and mode 555 (not writable).  Since ftpd does a chroot to
              this directory, it must have the following subdirectories and
              files:

              ~ftp/bin  This directory must be owned by root and mode 555
                        (not writable).  It should contain a copy of
                        /bin/ls.  This is needed to support directory
                        listing by ftpd.  The command should be mode 111
                        (executable only).  If the FTP account is on the
                        same file system as /bin, ~ftp/bin/ls can be hard
                        link, but it may not be a symbolic link, because of
                        the chroot.  The command must be replaced when the
                        system is updated.

              ~ftp/etc  This directory must be owned by root and mode 555
                        (not writable).  It should contain versions of the
                        files passwd, group, and logingroup.  See passwd(4)
                        and group(4).  These files must be owned by root and
                        mode 444 (readable only). These are needed to map
                        user and group ids in the LIST command, and to
                        support (optional) sub-logins of anonymous FTP.
                        Sub-logins can sometimes be used to allow access to
                        particular files by only specific remote users (who

 Hewlett-Packard Company            - 3 -      HP-UX Release 8.05: June 1991

 ftpd(1M)                                                           ftpd(1M)
                  Requires Optional ARPA Services Software

                        know the sub-login password) without giving those
                        remote users logins on the system.  A sub-login user
                        would access the system via anonymous ftp, and then
                        use USER and PASS to change to the sub-login user.

              ~ftp/etc/passwd
                        This file should contain entries for the ftp user
                        and any other users who own files under the
                        anonymous ftp directory.  Such entries should have *
                        for passwords.  ~ftp/etc/passwd should also contain
                        entries for any desired anonymous FTP sub-logins.
                        The sub-logins must have passwords, which must be
                        encrypted as in passwd(4).  Group IDs must be listed
                        in the anonymous FTP group file, ~ftp/etc/group.
                        The path names of home directories in
                        ~ftp/etc/passwd must be with respect to the
                        anonymous FTP home directory.  A sub-login home
                        directory should be owned by the sub-login user ID.
                        The shell field is ignored, and can be empty.

 For example, the anonymous FTP sub-login name subftp
                        would have an entry in the FTP passwd file that
                        resembles:

                             subftp:bAg6vI82aq5Yt:501:10:ftp sub-
                             login:/subftp:
"

end quote, end article.