Re: question on "upload" directive in /etc/ftpaccess

Hi David,

Yes, I can protect these using file permissions.  In fact, I am doing this 
right now.

I am asking for the solution for the following reasons:
        - Firstly, I am curious for the solution
        - Secondly, I wish to place a number of "layers" to the security.

As for your notes on upload, I think that they are the best I have yet 
seen.

Your notes state that the statement:

        upload <root-dir> <dirglob> yes testuser admin 0664 dirs

is interpreted as:

        - those users with a home directory <root-dir> are allowed to 
upload to areas matching <dirglob>
        - uploaded files will be created with "testuser:admin" ownership 
and 0664 permissions
        - users are allowed to create directories

I assume that, for guest users, <dirglob> is relative to the chrooted 
environment.  Is this correct?

Considering the following example:

        /user has the following contents:

                /bin
                        /ls
                /etc
                        /passwd
                        /group
                /home
                /ftp

        /user/etc/passwd has the following entries:
                testuser::1000:10::/home:
                ftp::2000:20::/ftp:
        /user/etc/group has the following entries:
                admin::10:
                staff::20:

I would have expected the following lines in /etc/ftpaccess:

        defumask 0317
        guestuser *
        guest-root /user
        upload  /user/*  /     no
        upload  /user/*  /*    yes testuser admin 0660 nodirs

to have the following meaning:

        - both statements apply to users with home directories under /user 
(such as /user/testuser)
        - the 'ftp' user will be unable to upload to /user
        - the 'ftp' user will be able to upload to /user/ftp, with files 
being created with "testuser:admin" ownership and 0660 permission

The trouble is that the last 'upload' statement is allowing users to 
upload to /user.

If I change the last upload statement to:

        upload  /user/* /ftp2 yes testuser admin 0660 nodirs

it works, but I want to have the statement reference all subdirectories of 
/user (In my real-world example, I have 100 users -- it would be tiresome
to have to put in 100 upload directives).

If I change the last upload statement to:

        upload /user/* /*/ yes testuser admin 0660 nodirs

it:
        - doesn't allow users to upload to /user
        - allows users to upload to their home directories
but:
        - the file ownership and permissions are not "testuser:admin" and 
"0660"
instead:
        - the file ownership is that of the logged in user
        - the file permission is defined by the "defumask" directive 
(0460)

Any ideas?

Thanks very much for your assistance,
Aaron

ps. is there any documentation on the regular expression syntax used in 
the <dirglob>
field of the 'upload' directive?





David Mackintosh <[email protected]>
01/03/2005 11:39 PM
 
        To:     [email protected]
        cc:     [email protected]
        Subject:        Re: question on "upload" directive in 
/etc/ftpaccess
 Reference:   
  Expires on 







Hi Aaron

On Tue, Mar 01, 2005 at 05:44:51PM +1100, [email protected] 
wrote:
> Hi,
> 
>         - users are not allowed to upload to the following directories:
>                 /user
>                 /user/bin
>                 /user/etc
>                 /user/public

Is there some reason why you can't protect these directories with 
file-system
permissions to prevent upload?

You can see my notes on upload here: 

http://xdroop.dhs.org/space/wu-ftp/upload

-- 
 /\oo/\
/ /()\ \ David Mackintosh | [email protected]
         gpg --recv-keys --keyserver subkeys.pgp.net 0x35A6A47A
         Mystery attachment?  http://xdroop.dhs.org/space/GPG



**********************************************************************
Disclaimer:  This e-mail is intended for the use of the addressee and may contain information that is confidential, commercially valuable or subject to legal or parliamentary privilege.  If you are not the intended recipient you are notified that any review, re-transmission, disclosure, use or dissemination of this communication is strictly prohibited by several Commonwealth Acts of Parliament.  If you have received this communication in error please notify the sender immediately and delete all copies of this transmission together with any attachments.
**********************************************************************