|
|
campus - FTP-server for
BeOS®
Path lines
Path lines are different from user and group lines in that they do not
gebin woth path but directly with what kind of path line they are.
There are two types of path lines:
- deny lines
- allow lines
Deny lines deny access for certain users and groups to a certain path,
which can be either a directory, in which case the deny includes all
directories below the one specified in the deny line or a single file.
Path lines have to begin with Deny or Allow,
the other options can be in arbitrary order.
Note: In the unregistered version only 5 path lines are
allowed.
Format:
Deny Path Users user1,user2,...
Permissions permission1,permission2,...
Allow Path Users user1,user2,...
Permissions permission1,permission2,...
See campus: File Security for details on how to
create a secure configuration.
Changes in release 3.0
The behaviour of the path lines has changed a little bit to have a more
fine grained control over the file permissions. A little example will
make this clear: Imagine you have a standard ftp server with a big
public directory for people to download files and an incoming directory
for the files which people upload to your server. This simple directory
hierarchy looks like this:
/boot/home/ftp
/boot/home/ftp/incoming
In /boot/home/ftp reading should be possible but writing should
not be allowed. On the incoming directory the situation is different,
here writing is permitted and reading is not Additionally it is a good
idea to disallow listing of the inocming directory. A first (and wrong)
approach for this would be:
- deny / users all permissions all
First deny access for all files for anybody.
- allow /boot/home/ftp users ftp permissions cd,list,get
Allow read and list access for the public directory tree.
- deny /boot/home/ftp/incoming users ftp permissions all
Deny everything for the incoming directory.
- allow /boot/home/ftp/incoming users ftp permissions put,cd
And now make it possible to cd to the incoming dir and allow uploading
of files. We don't want everyone to see what is in the incoming directory
so list is not on the list of permitted actions.
Although this seems correct it is not! Try to put the above lines in your
configuration and you will see that in a listing of /boot/home/ftp
the incoming directory is missing! How can this happen? The explanation
is easy once you remember what the lines do:
When /boot/home/ftp is listed, all entries in the directory are
read and each of them is checked to see wether a list operation is allowed
on that item. In the case of incoming, listing is not allowed so
it will not be listed. What we wanted was that the contents of
incoming will be invisible for the user but the directory itself should
be seen by the user. Here is how to do it, replace the last line above with
these two lines:
- allow /boot/home/ftp/incoming users ftp permissions put,cd,list
This allows the listing of the directory itself when the ftp home directory is
listed.
- allow /boot/home/ftp/incoming/* users ftp permissions list
This is what we wanted: The user is not allowed to see any file in the
incoming directory. Note that if a .message file is in
the directory it will be sent to the ftp client, even if file downloads
are not possible.
New features in release 3.0
Keyword replacement
In release 3.0 it is possible to use patterns and keyword
replacement in path lines. This makes it possible to simplify configurations
for servers with a lot of users. In previous versions it was necessary
to have one allow line to allow each user access to its home directory,
for example his or her homepage directory. Now it is possible to write
something like this:
Allow /boot/home/ftp/$UserName Users UserOne,UserTwo,UserThree permissions cd,list,get
Here $UserName will be replaced by the names given in the Users
directive, i.e. the line above replace these three lines:
Allow /boot/home/ftp/UserOne Users UserOne permissions cd,list,get
Allow /boot/home/ftp/UserTwo Users UserTwo permissions cd,list,get
Allow /boot/home/ftp/UserThree Users UserThree permissions cd,list,get
Patterns
You can now use patterns with asterisks in them to specify the path of a allow/deny line.
Say for example that you have .login and .message files in your ftp directory hierarchy
and wat to display them to the user but you don'T want them to show up in the file listing.
Here is how to do it:
Deny *.login Users all Permissions all
Deny *.message Users all Permissions all
This should be the last line so that no other line after it allows access to the
List of possible actions
Allow lines allow the user/group to perform certain actions. The names of the
actions and a description of what they stand for is given here:
Permission |
User is allowed/denied to... |
all |
do everything from list below. |
list |
list a directory. |
get |
retrieve a file. |
put |
upload a file. (If a file with the same file name exists
the permission to delete it is checked.) |
chmod |
change the permission bits of a file. |
cd |
change to the directory. |
delete |
delete a file. (For deleting a directory the delete permission
for the the parent directory is checked.) |
idle |
change the maximum idle time. (Maximum idle time is forced to
be between 30 and 7200 seconds.) |
umask |
change the file creation mask. |
rename |
rename a file. |
mkdir |
create a new directory. |
Copyright © 1997-2002 Stegemann & Co., Inc., All Rights reserved.
Created: May 7, 2000. Last modified: January 12, 2002.
|