Re: How do I force an FTP user to '/home/ftpdir'?

I'm in your boat too.
However, if you allow the /ftp/customer123/upload/* stuff to upload or 
download any file name in a specific directory then there is a concern 
regarding the /../.. stuff.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





Tom Hightower <tomh5480@xxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
02/22/2005 10:57 AM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
midrange-l@xxxxxxxxxxxx
cc

Subject
Re: How do I force an FTP user to '/home/ftpdir'?






rob@xxxxxxxxx said the following on 
2/21/2005 7:59 AM:
> Tom,
> 
> Two area's of concern. 
> QIBM_QTMF_SVR_LOGON  Will be where you set initial directory.
> QIBM_QTMF_SERVER_REQ will be where you make sure that they do not go to 
> another directory.  Beware of a patch I need to make to my version, (as 
> pointed out on this list).  If you lock them down to a directory 
> /ftp/customer123/upload/*, the hack would be 
> /ftp/customer123/upload/../../customer456/upload
> It was suggested that I actually do the CD and then just check the 
> resultant directory against what directory was intended.
> 
> Rob Berendt

I know I should just write something real intelligent, but in the case 
of '../..' - I just deny the command.  I figure they're not likely to 
enter that in a brower or GUI ftp client, and - if they're writing a 
script - they can enter each 'cd ..' on a separate line.

But mostly, I wasn't sure how to check to see where I wind up after 
doing '../..'.  Maybe when I have time to experiment...

Tom


-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.