RE: Chroot feature on proxy-suite

Thanks. It seems that I can start ftp-proxy daemon as standalone. When I
tried to access outside ftp server, i.e. ftp.sun.com, I got a messages:

# ftp ftp-proxy.liz.com
Connected to ftp-proxy.liz.com
220 ftp-proxy FTP server (Version 1.9 - 2002/05/02 15:14:55) ready.
Name (ftp-proxy:ryan): [email protected]
501 Invalid destination in user name.
Login failed.
ftp>quit


I commented out "chroot" statement in the configuration file so the ftp
proxy server runs as normal. I did the same thing to
acess ftp.sun.com. and I can access the ftp server without problem. It
seemed to me that ftp proxy server can't run chroot mode at least for client
side. Is this true? Thanks in advance.

Ryan Jiang
Liz Claiborne, Inc.
(201) 295-7171

-----Original Message-----
From: Marius Tomaschewski [mailto:[email protected]]
Sent: Monday, July 22, 2002 8:39 AM
To: [email protected]
Cc: Ruiyuan Jiang
Subject: Re: [proxy-suite] Chroot feature on proxy-suite


On Fri, Jul 19, 2002 at 12:52:46PM -0400, Ruiyuan Jiang wrote:
> Hi, all
> 
> I would like to use chroot() feature for proxy-suite (Sun Blade 100,
Solaris
> 9). Under /var/proxy-suite/rundir, I created directories dev, etc, usr. I
> linked /dev/null to null in the dev directory.

No, a link can't work - use mknod instead and create a real
$ServerRoot/dev/null device.

> I copied /usr/lib/libc.so to usr/lib directory and copied
> /etc/passwd and group files to etc subdirectory.

Make sure, there are no real passwords. You can also create
dummy files instead, i.e.


$ServerRoot/etc/passwd:
root:*:0:0:root:/:/bin/false
ftp-proxy:*:5000:5000:proxy user:/:/bin/false

$ServerRoot/etc/group:
root:*:0:root
ftp-proxy:*:5000:

or specify the User and Group as UID/GID numbers
in the ftp-proxy.conf...

> I tried to start ftp-proxy standalone and I got a message:
> 
> # ./ftp-proxy
> ftp-proxy [9278] <07/19-16:13:13> TECH-ERR can't write config file into
> chroot 
> 
> I tried to create var/run directory under /var/proxy-suite/rundir for pid
> file and var/log under /var/proxy-suite/rundir for log file but I got the
> same message when I tried to start the daemon. Does anyone know which
config
> file is? Thanks in advance.

The proxy writes its config into the chroot if it is not there,
to be able to reload it on SIGHUP.

Copy your /etc/proxy-suite/ftp-proxy.conf into the chroot as well.
An other solution is to make the config directory in the chroot
  $ServerRoot/etc/proxy-suite/
writeable to the user the proxy runs as... But this is not needed
if you copy the config yourself.

Gruesse,
 Marius Tomaschewski <[email protected]>
--
 SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement
 PGP public key available:   http://www.suse.de/~mt/mt.pgp
 Fprint:  EA 1F 92 75 1A F9 82 07  A1 28 DE 7A 32 E8 97 18