These classnotes are depreciated. As of 2005, I no longer teach the classes. Notes will remain online for legacy purposes

UNIX03/Chroot Setup In Passwd

Classnotes | UNIX03 | RecentChanges | Preferences

For our example, we will be using a user called "Mort". Mort will be the user who will have a chroot'ed guest account for FTP purposes.

Create Mort's entry in /etc/passwd and /etc/group. Do so manually, or use adduser or whatever your Unix supports. If you use adduser, you will probably have to make manual modifications to get the /./ information in the home path.

What is this /./ thing? That's the general way to enable chroot'ed accounts on a system. We have not seen this before because everything we have chroot'ed has performed this step automatically.

/etc/passwd:

 mort:*:403:400:Mortimer Snerd:/home/web/mort/./:/etc/ftponly
                                             ^^^

The /./ sequence determines where the chroot() is done to. If you want the chroot() done to the web directory and a chdir() to mort, it would look like this:

 mort:*:403:400:Mortimer Snerd:/home/web/./mort/:/etc/ftponly
                                        ^^^
(make sure "/etc/ftponly" is in /etc/shells.)

/etc/group:

 client::400:mort 
Set Mort's password as you wish.

The current releases of wu-ftpd come with /etc/ftpaccess enabled by default. If your version does not do this for some reason, you must do one of two thing to properly use /etc/ftpaccess:

compile the source to use /etc/ftpaccess by default; modify the source to set

 use_accessfile = 1;
or run the daemon with the -a option.

/etc/ftpaccess:

 class   local   real,guest,anonymous ......
 ...                  ^^^^^
define 'guest' in the proper classes. This is site dependent.

 delete     no   anonymous,guest               # delete permission?
 overwrite  no   anonymous,guest               # overwrite permission?
 rename     no   anonymous,guest               # rename permission?
 chmod      no   anonymous,guest               # chmod permission?
 umask      no   anonymous,guest               # umask permission?
 ...                       ^^^^^
decide if guest should be in this permission list. This is site dependent.
 path-filter  guest      /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
 ...
 guestgroup client
 ...


Classnotes | UNIX03 | RecentChanges | Preferences
This page is read-only | View other revisions
Last edited June 14, 2003 1:07 pm (diff)
Search:
(C) Copyright 2003 Samuel Hart
Creative Commons License
This work is licensed under a Creative Commons License.