Setting Up wuftpd for Non-Anonymous Accounts - User environment
(Page 2 of 3 )

Setup a chroot user environment for each location
This is a bit trickier. What you're essentially doing is creating a skeleton root filesystem with enough of the pieces necessary (libraries, password files, etc.) to allow Unix to do a chroot when the user logs in.

I find this process very weird, in some ways, as you have to create a number of odd files. First create all the directories. For the purposes of this example, let's assume your true root is "/usr/www". So first, cd to /usr/www. Then

$ mkdir bin
$ mkdir dev
$ mkdir etc
$ mkdir usr
$ mkdir usr/lib

Chmod them all to 0555:

$ chmod 0555 {bin,dev,etc,usr,usr/lib}

Next, you have to populate each of these areas. Copy /bin/ls and /bin/more to /usrw/ww/bin. chmod their permissions to 111. (You don't want users to be able to modify the binaries.)

Cd to dev. You'll need to create a zero file so that Unix can make zeroes. Don't ask me - read the man page. A simple command creates it:

$ mknod -m 666 zero c 1 5
$ chown root.mem zero

Next, figure out what libraries you need to copy to make ls and more work. You can do this by entering ldd ls and ldd more. Whatever libraries they use, copy them to /usr/www/usr/lib.

Finally, create the group and passwd files in etc. This should not be the same as your true ones. The passwd file in the chroot environment should have entries like:

root:*:0:0:Root:/:/bin/noshell
frogstar:*:5035:2010::/frogstar/:/bin/noshell

You shouldn't include passwords - just use a * to prevent a password from being used. Users will be able to read this file, but it's really meaningless. It's just needed by the ftp daemon. The group file should correspond to your normal group file.

frogstars:*:2010:frogstar

If you use the same UID and GID (user and group ids), then ls will correctly display ownership. You want to create groups, even with a single member, to use the guestgroup directive in the ftpaccess file described below.

You should now be set to allow users to FTP into this environment. If you want to create totally protected environments, you need to go down a level for each Web directory and create all of these files - there may be an easier way, but I don't know of it.

Next: The /etc/ftpaccess file >>
 

More Administration Articles
More By Glenn Fleishman

Comments On: Setting Up wuftpd for Non-Anonymous Accounts

>>> Be the FIRST to comment on this article!