campus: SecurityIf you want to set up your own ftp server you should read this section very carefully. Keep in mind that by connecting your system to a network you always run the risk of breaking into it. Below are some of the most important things to pay attention to to get a secure system. As far as that is possible at all.
Sample configurationAs a rule of thumb a good configuration should have as few lines as possible. This includes users, groups and paths.
General settingsI recommend that both pedantic mode and warnings are turned on to make sure campus understands the configuration. Start campus at least once after every change in the configuration with both options turned on so you can check if there is a problem. When you are sure that campus just rants about things that you are sure are ok turn them off again.The default port for ftp is 21 so campus should be started with this port number. Remember to disable the builtin ftp-server that comes with the BeOS® before you try to start campus. You can do this in the Network Preferences panel. Otherwise campus will complain that port 21 already is in use. If you see that campus does not get the port you don't have to restart it, just disable the built-in ftp-server and restart the network and campus will function correctly. Change the idle time to whatever you want but please keep it within reasonable limits since no reality check is performed in campus, it will use whatever value you specified.
UsersIn most cases you want to have an anonymous access to your system. The user line for this could look like this:user ftp alias anonymous homedir /boot/home/ftp changeroot public This creates a new user with name ftp and one alias, anonymous. The user will have his homedirectory set to /boot/home/ftp. Because the changeroot option is given the user will not be able to see files above his home directory. Finally because of public no password is needed for login. The next line allows remote administration: user admin password SomePassword homedir /boot/home/config/settings changeroot
This user has access to the directory in which campus_settings resides.
GroupsIt is not necessary to create groups of user. Groups are a possibility for the system administrator to keep the members field of path lines short.
PathsThe first path line should always be:deny / users all permissions all This line denies all users the right to do anything at all in the system. To allow the anonymous user access to his home directory: allow /boot/home/ftp users ftp permissions cd,list,get This allows the user ftp to change the current directory, list files and directories and retrieve files.
If you want to have a directory where the users can store files: deny /boot/home/ftp/incoming users ftp permissions all allow /boot/home/ftp/incoming users ftp permissions cd,put This allows the user to write into /incoming (From his point of view) and to make it the current directory. He is not allowed to list the contents of /incoming nor may he retrieve files from there. To allow remote administration you have to add these lines:
allow /boot/home/config/settings users admin permissions delete Remember: Every user should have the minimal set of permissions to do the job. For remote administration campus_settings is the only file of interest. It may be retrieved, changed on the local system and then uploaded again. The user must have delete permission for the directory because he has to overwrite the existing camus_settings.
Copyright © 1997-99 Stegemann & Co., Inc., All Rights reserved. Created: March 4, 1998. Last modified: April 25, 1999. |