Contents 
 
What's new ? 
 
Overview 
Installation 
GUI preferences 
 
Global configuration 
IP Access configuration 
User configuration 
Group configuration 
Access configuration 
 
Dotfiles 
Attributes 
Using campus 
Features 
File Security 
 
Bugs and missing features 
Things to do 
Licence 
History 
 
Contact 
Internet Suite 
 
FAQ 
campus - FTP-server for BeOS®

campus: Access configuration

Path lines

Path lines are different from user and group lines in that they do not gebin woth path but directly with what kind of path line they are. There are two types of path lines:
  1. deny lines
  2. allow lines
Deny lines deny access for certain users and groups to a certain path, which can be either a directory, in which case the deny includes all directories below the one specified in the deny line or a single file.

Path lines have to begin with Deny or Allow, the other options can be in arbitrary order.

Note: In the unregistered version only 5 path lines are allowed.

Format:
Deny Path Users user1,user2,... Permissions permission1,permission2,...
Allow Path Users user1,user2,... Permissions permission1,permission2,...

See campus: File Security for details on how to create a secure configuration.

Changes in release 3.0

The behaviour of the path lines has changed a little bit to have a more fine grained control over the file permissions. A little example will make this clear: Imagine you have a standard ftp server with a big public directory for people to download files and an incoming directory for the files which people upload to your server. This simple directory hierarchy looks like this:
/boot/home/ftp
/boot/home/ftp/incoming
In /boot/home/ftp reading should be possible but writing should not be allowed. On the incoming directory the situation is different, here writing is permitted and reading is not Additionally it is a good idea to disallow listing of the inocming directory. A first (and wrong) approach for this would be:

  • deny / users all permissions all
    First deny access for all files for anybody.
  • allow /boot/home/ftp users ftp permissions cd,list,get
    Allow read and list access for the public directory tree.
  • deny /boot/home/ftp/incoming users ftp permissions all
    Deny everything for the incoming directory.
  • allow /boot/home/ftp/incoming users ftp permissions put,cd
    And now make it possible to cd to the incoming dir and allow uploading of files. We don't want everyone to see what is in the incoming directory so list is not on the list of permitted actions.
Although this seems correct it is not! Try to put the above lines in your configuration and you will see that in a listing of /boot/home/ftp the incoming directory is missing! How can this happen? The explanation is easy once you remember what the lines do:
When /boot/home/ftp is listed, all entries in the directory are read and each of them is checked to see wether a list operation is allowed on that item. In the case of incoming, listing is not allowed so it will not be listed. What we wanted was that the contents of incoming will be invisible for the user but the directory itself should be seen by the user. Here is how to do it, replace the last line above with these two lines:

  • allow /boot/home/ftp/incoming users ftp permissions put,cd,list
    This allows the listing of the directory itself when the ftp home directory is listed.
  • allow /boot/home/ftp/incoming/* users ftp permissions list
    This is what we wanted: The user is not allowed to see any file in the incoming directory. Note that if a .message file is in the directory it will be sent to the ftp client, even if file downloads are not possible.

New features in release 3.0

Keyword replacement
In release 3.0 it is possible to use patterns and keyword replacement in path lines. This makes it possible to simplify configurations for servers with a lot of users. In previous versions it was necessary to have one allow line to allow each user access to its home directory, for example his or her homepage directory. Now it is possible to write something like this:

Allow /boot/home/ftp/$UserName Users UserOne,UserTwo,UserThree permissions cd,list,get

Here $UserName will be replaced by the names given in the Users directive, i.e. the line above replace these three lines:

Allow /boot/home/ftp/UserOne Users UserOne permissions cd,list,get
Allow /boot/home/ftp/UserTwo Users UserTwo permissions cd,list,get
Allow /boot/home/ftp/UserThree Users UserThree permissions cd,list,get

Patterns
You can now use patterns with asterisks in them to specify the path of a allow/deny line. Say for example that you have .login and .message files in your ftp directory hierarchy and wat to display them to the user but you don'T want them to show up in the file listing. Here is how to do it:

Deny *.login Users all Permissions all
Deny *.message Users all Permissions all

This should be the last line so that no other line after it allows access to the

List of possible actions
Allow lines allow the user/group to perform certain actions. The names of the actions and a description of what they stand for is given here:

Permission  User is allowed/denied to... 
all  do everything from list below. 
list  list a directory. 
get  retrieve a file. 
put  upload a file. (If a file with the same file name exists the permission to delete it is checked.) 
chmod  change the permission bits of a file. 
cd  change to the directory. 
delete  delete a file. (For deleting a directory the delete permission for the the parent directory is checked.) 
idle  change the maximum idle time. (Maximum idle time is forced to be between 30 and 7200 seconds.) 
umask  change the file creation mask. 
rename  rename a file. 
mkdir  create a new directory. 


Copyright © 1997-2002 Stegemann & Co., Inc., All Rights reserved.
Created: May 7, 2000. Last modified: January 12, 2002.