🚀 go-pugleaf

In article <drector.722195714@math.uci.edu>, drector@math.uci.edu (David Rector) writes:

> If you find it necessary to have an "incoming" directory, that is a
> directory with write privileges, be sure to check it regularly for
> unwanted material, or you might find yourself playing host to an
> unwanted---or even illegal---bulletin board.  A favorite trick of
> bb creators is to hide their files from the ls command by prefixing the
> file names with periods or other unprintable characters.  Use the
> -a option to ls, or use du, to search for unwanted files.

If you only need an "incoming" directory for outside users to drop files
off for users of the machine, try this trick:

d-wxr-xr-x  2 ftp      nobody        512 Oct 11 12:08 incoming/

Anonymous users can write files, but can't list or read them, while users
on the machine can do directory listings and read the files.  You still
need to clean out junk, but no "bulletin board" problems.  Note that
this doesn't work if you have some brain-dead "ftpd" that doesn't make
anonymous ftp files world readable (Convex).

Heck, might as well mention everything as long as I'm here.  On the flip side
of "incoming" would be "pub":

dr-xrwxrwt  2 ftp      nobody        512 Nov 10 17:23 pub/

Where anonymous users can list and read but not write, while local users
can do anything (except delete each others' files).

As for the rest, most should be mode 555:  the parent directory, as well as
bin, and any other needed stuff (etc, dev, ...), owned by root.  Depending
on how much info you want to give out, you can either omit etc/passwd and
etc/group altogether, or include modified versions (passwd: no passwords,
groups, home directories, shell of /bin/false just in case;  group: no
passwords or user lists).  The "ftpd" man page usually gives some info about
which other files are needed, for shared libraries, etc.

Anybody else have any helpful hints?

--
Bill Stapleton
     wls@csd4.csd.uwm.edu
     uwmcsd4!wls