Re: proxy-suite - problems at startup

On Wed, Jun 09, 2004 at 12:38:51PM +0200, Ralf Ronneburger wrote:
> Hi Marius,
> 
> >>thanks for your reply, I did only today get to try this. Unfortunately 
> >>that did not work out. Now I have a dir ftp-proxy writeable to 
> >>nobody/nogroup in /var/log, but the ftp-proxys log to 
> >>/var/lib/ftp-proxy-test1/rundir/var/log/ftp-proxy and they still don't 
> >>want to start up at boot. Any other ideas?
> >
> >
> >No. Same idea, but better realization :-) :
> >
> >Of course, you have to create all directories:
> >
> >mkdir -m0750 /var/lib/ftp-proxy-test1/
> >mkdir -m0750 /var/lib/ftp-proxy-test1/rundir/
> >mkdir -m0750 /var/lib/ftp-proxy-test1/rundir/var/
> >mkdir -m0750 /var/lib/ftp-proxy-test1/rundir/var/log
> >mkdir -m0750 /var/lib/ftp-proxy-test1/rundir/var/log/ftp-proxy
> >chown -R $User  /var/lib/ftp-proxy-test1/
> >chgrp -R $Group /var/lib/ftp-proxy-test1/
> 
> This looks somewhat strange - does the user running the proxy have to 
> own the whole chroot-directory?

Please try out/adopt the sample script in ftp-proxy/rc.script
for your purposes.
Except of the /etc/rc.status sourcing, that is SuSE specific,
you should be able to get it running on FreeBSD/OpenBSD as well.
(you may fake one definig some rc_* functions the script uses,
 remove them from script or copy the file from SuSE Linux),


Sorry - this was broken:

    > >mkdir -m0750 /var/lib/ftp-proxy-test1/
    > >mkdir -m0750 /var/lib/ftp-proxy-test1/rundir/
    > >mkdir -m0750 /var/lib/ftp-proxy-test1/rundir/var/
    > >mkdir -m0750 /var/lib/ftp-proxy-test1/rundir/var/log
    > >mkdir -m0750 /var/lib/ftp-proxy-test1/rundir/var/log/ftp-proxy

    mkdir -m0750 /var/lib/ftp-proxy-test1/{dev,lib,etc}
    mkdir -m0750 /var/lib/ftp-proxy-test1/etc/proxy-suite

    chown -R root   /var/lib/ftp-proxy-test1/
    chgrp -R $Group /var/lib/ftp-proxy-test1/
    chown -R $User  /var/lib/ftp-proxy-test1/rundir/var/log/ftp-proxy

Other dirs than log-dir has to be at least executeable (to be able
to access files inside)...

The proxy should be able to write to $ServerRoot/$LogDestination
and for config reloads (SIGHUP) also to be able to read the config
from $ServerRoot/$ConfigDir/ftp-proxy.conf (it makes a copy itself
if it does not exists).

Further it should be able to write to $ServerRoot/dev/{log,null}
(on Free/OpenBSD also /dev/ipnat or /dev/pf), have (and be able
to read them) all libs it requires in $ServerRoot/lib as well as
some files in $ServerRoot/etc.

Note: static linked proxy on Linux still needs some libs in chroot,
since the glibc loads them on demand.

Use "strace", "truss", "ktrace" or however they are named to
see what's missing or where you get a permission denied...


> In the other option that you wrote me the user only owns the
> log-directory. So I made him owner of the log-directory in
> the rundir, but it did not work out...

Kind regards,
 Marius Tomaschewski <[email protected]>
--
 SUSE LINUX AG, Nuernberg  --  Product Developement
 PGP public key on:   http://www.suse.de/~mt/mt.pgp
 DF17 271A AD15 006A 5BB9  6C96 CA2F F3F7 373A 1CC0

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]