[Zope] ftp and virtual hosting question

[Richard Barrett]

At 13:44 12/03/2002 -0500, Jiann-Ming Su wrote:
>On Tue, 12 Mar 2002, Richard Barrett wrote:
>
> > Are you asking whether standard Zope can accept an FTP login and, 
> depending
> > on the user ID  presented, automatically do an FTP cd to the user's "home"
> > folder, having determined where that is by computation from which acl_user
> > folder their user ID is defined in?
> >
>
>Yes, that's what I'm asking.  What's the alternative for doing a wholesale
>upload?  Is WebDAV the solution?

The database being handled by Zope is a tree rooted at '/'. From your 
earlier posts you have sub-trees below the root each of which constitutes a 
web site.

When delivering data to users via HTTP, you are using Apache 
Proxypass/RewriteRule with Zope's the Virtual Host Monster to give the 
appearance of multiple separate web sites.

However, viewed through Zope direct interfaces i.e. through the TCP 
interfaces it provides, regardless of protocol, be it HTTP, FTP or WebDAV, 
the fact that the 'virtual web sites' all exist within a common 
hierarchical structure cannot be totally hidden.

So the answer to the question is No, not through Zope's direct interfaces. 
But bearing in mind what you said previously the effects of this can be 
mitigated.

At 10:21 12/03/2002 -0500, Jiann-Ming Su wrote:
>That is, if I have an acl_uers/ folder in /VirtualHost/Host1, how do I
>get a defined user for Host1 to ftp directly into /VirtualHost/Host1?
>
>Right now, I have to authenticate through the acl_users/ in the root folder,
>which gives me access to a bunch of other folders as well.

You may be able to achieve part of what you want to do as follows :

1. You do not have to put have all the user ids declared in acl_users in 
the root '/' folder.

2. You can declare the user ids, per virtual host, in acl_users within each 
virtual host's 'root' folder as per the following example layout.

     /--|
        |--hosta--|
        |         |--vhost1--|
        |         |          |--acl_users
        |         |          |
        |         |
        |         |--vhost2--|
        |         |          |--acl_users
        |         |          |

3. Remove the 'FTP Access' privilege for everybody except role Manager from 
'/' and 'hosts'.

4. Assign your users the local role of Member for the 'home' virtual host 
folder.

5. Give the Member role 'FTP Access' privilege for each of the virtual host 
folder.

6. With this set up each user can FTP login and then FTP cd to their 'home' 
virtual host folder.

7. The fact that the user do not have 'FTP Access' privilege over '/' 
folder, indeed that their user id doesn't exist at the root folder level 
doesn't prevent them FTP logging in.

8. The user's can successfully FTP cd to their 'home' virtual host folder 
having logged in but will be prevented from FTP cd'ing to any other virtual 
host folder.

9.  Users cannot discover by examination the content of intermediate 
folders between '/' and their 'home' virtual host folder as they cannot FTP 
cd to these intermediate folders or perform FTP ls operations on them.

10. The downside is that the users have to know the path to their 'home' 
virtual host folder from '/'.

How well this will work from the user standpoint depends to some extent on 
the FTP access tools the user chooses.

a. I find that with this arrangement I can access and upload directory 
trees and their contents using IE5 under Win2K using a ftp scheme URLs of 
the form ftp://<userid>:<passwd>@wickwar.ftel.co.uk:8021/hosts/vhost1/. But 
note the need to embed the user id and password in the URL. You do not get 
a prompt for credentials with ftp scheme URLs like you do with http scheme 
URLs. You have to present them as part of the URL. This is nasty in that 
someone looking over your shoulder can see them on the screen on they are 
'visible' un-encrypted in transit between your browser and the server to 
any intermediate proxies. In the worst case they might even appear in some 
logs.

b. WS_FTP works OK as long as the the Remote Site Folder for the connection 
is preset to the correct value. Otherwise, WS_FTP tries to list the folder 
it first gets to: typically '/'. This fails if the user doesn't have 'FTP 
Access' permissions and WS_FTP then regards the connection attempt as 
having failed. Security should be better in that this is proper connection 
oriented working and the credentials are only exposed at login time.

c. Linux command line FTP presents no particular problems in use.

As for WebDAV, I cannot say how this would work as I'm not familiar with 
using it.

Hope this helps your thinking on the topic.


>--
>Jiann-Ming Su  jsu2@emory.edu  404-712-2603
>Development Team Systems Administrator
>General Libraries Systems Division