ftp user getting permission denied to change directory

[Ray Allen_1]

Hi All,

I can ftp the server successfully, but when I try to cd to an oracle directory I am getting permission denied on most of the directories.
For example:
Using binary mode to transfer files.
ftp> cd /home
250 CWD command successful.
ftp> cd /u06prd
550 /u06prd: Permission denied.
ftp> cd /u01prd
250 CWD command successful.
ftp> cd /u02prd
550 /u02prd: Permission denied.
ftp> cd ..
250 CWD command successful.
ftp> cd /u02prd
550 /u02prd: Permission denied.
ftp> pwd
257 "/" is current directory.
ftp> cd /u03prd
550 /u03prd: Permission denied.
ftp> cd /u04prd
550 /u04prd: Permission denied.
ftp> cd /u05prd
250 CWD command successful.
ftp> cd /u07prd
550 /u07prd: Permission denied.


Here are the permissions on the directories.

root@nholaw1:/etc>ll /u01prd
total 0
drwxr-xr-x 4 root sys 96 May 15 2006 app
drwxr-xr-x 2 root root 96 Feb 9 19:39 lost+found
root@nholaw1:/etc>ll /u02prd
total 0
drwxr-xr-x 2 root root 96 Nov 7 2005 lost+found
drwxr-xr-x 4 oracle users 96 Nov 23 2005 oradata
root@nholaw1:/etc>ll /u06prd
total 0
drwxr-xr-x 2 root root 96 Nov 7 2005 lost+found
drwxr-xr-x 4 oracle dba 96 Feb 10 02:42 oracle
root@nholaw1:/etc>ll /u03prd
total 0
drwxr-xr-x 2 root root 96 Nov 7 2005 lost+found
drwxr-xr-x 4 oracle users 96 Nov 23 2005 oradata
root@nholaw1:/etc>ll /u05prd
total 0
drwxr-xr-x 2 root root 96 Nov 7 2005 lost+found
drwxr-xr-x 4 oracle dba 96 Apr 5 2006 oradata
root@nholaw1:/etc>ll /u07prd
total 0
drwxr-xr-x 2 root root 96 Nov 7 2005 lost+found
drwxr-xr-x 4 oracle users 96 Nov 23 2005 oradata


As you can see some of the directories have the same permissions, but one I can cd to, and the other I can't.

Here is the ftp line in /etc/inetd.conf
ftp stream tcp6 nowait root /usr/lbin/ftpd ftpd -l -u 002


Any ideas would be greatly appreciated.

[Mel Burslan]

your ll commands give us the permissions and ownership of th files inside these directories.

how about the same ll commands' output but with the -d switch this time, like

ll -d /u05prd

and so on ?

[Ray Allen_1]

root@nholaw1:/etc>ll -d /u01prd
drwxrwxrwx 4 oracle dba 96 Nov 7 2005 /u01prd
root@nholaw1:/etc>ll -d /u02prd
drwxrw-rw- 4 oracle dba 96 Nov 23 2005 /u02prd
root@nholaw1:/etc>ll -d /u03prd
drwxrw-rw- 4 oracle dba 96 Nov 23 2005 /u03prd
root@nholaw1:/etc>ll -d /u04prd
drwxrw-rw- 4 oracle dba 96 Nov 23 2005 /u04prd
root@nholaw1:/etc>ll -d /u05prd
drwxrwxrwx 4 oracle dba 1024 Aug 17 2006 /u05prd
root@nholaw1:/etc>ll -d /u06prd
drwxrw-rw- 4 oracle dba 96 Sep 17 2007 /u06prd
root@nholaw1:/etc>ll -d /u07prd
drwxrw-rw- 4 oracle dba 96 Nov 23 2005 /u07prd
root@nholaw1:/etc>

[Bill Hassell · Accepted solution]

You have bad permission on several directories. The correct permissions would be 775 or 755 where execute permission is permitted on the directories. This does not affect only ftp, it affects all users that are not in the dba group.

> drwxrwxrwx 4 oracle dba /u01prd

Yikes! 777 means every file in the directory can be removed by anyone -- not a good setting at all

> drwxrw-rw- 4 oracle dba /u02prd

Bad permissions. You must have execute to look inside a directory.

Thde rest are the same, either 777 (poor security) or 766 (no directory search capability). Set to all to 755 or 775.

[Ray Allen_1]

Bill.
Thanks. When I change the permissions to 775 or 755 as you recommended, should I use the -R option with it?

[Mel Burslan]

using -R option to chmod only matters if you have directories under these levels (which I see you do) and you want your ftp users to be able to descend into those directories. If you do, you should use -R, otherwise not.

hope this helps.

[Bill Hassell]

Sysadmin Rule:
NEVER use -R with chmod or chown!!!

You will screw things up. The chown/chmod -R commands are not selective. They will hit files as well as directories and that's bad. The 7 digit will add execution to every file even though the files are never to be executed (ie, data files). And the hardcoded 775 or 755 will remove setuid/setgid/sticky bits which will break programs that used to work OK.

To fix this problem, you must first examine the entire directory tree, then see what must be fixed and what must be excluded:

find /u01prd -type d -exec ll {} -d \;

If a previous sysadmin used -R on the directories, you have two choices: find out from Oracle what each directory permission should be and set each one correctly, or set the directories to the same value. This command will set only directories:

find /u01prd -type d -exec chmod 775 {} \;

[Ray Allen_1]

Thanks guys. Points well taken. I used chmod 775 without -R and now I am able to cd to the directory.

Thanks again.

[Ray Allen_1]

Used chmod 775 without -R and now I am able to cd to the directories.