topic Re: Prevent passwd file from being copy in Operating System - HP-UX

Prevent passwd file from being copy

yc_2 — Tue, 24 Oct 2000 01:00:37 GMT

Hi,

Is there a way to prevent the password file being copied or ftp ?

If not possible, is there a way to trap who has ftp or copied this file and get notify ?

Any advise is apprecaited.

Rgds,
YC

Re: Prevent passwd file from being copy

Vinit Adya — Tue, 24 Oct 2000 01:08:46 GMT

Hi,
You could use tsconvert to convert the system to a trusted system and the passwords are moved to a TCB area.
This will also enable other features as password lifetime etc.

Re: Prevent passwd file from being copy

Madhu Sudhan_1 — Tue, 24 Oct 2000 04:11:31 GMT

Leong:
I completely agree with Adya. You need to make the system a Trusted System to prevent users to read the /etc/passwd file. Once the System is converted to a trusted system a protected password database at /tcb/files/auth gets created and a a "*"
replaces the password field in /etc/passwd.
For a detailed information on adminstering trusted system, here is the URL.

http://docs.hp.com/cgi-bin/onlinedocs.py?mpn=B2355-90121&service=hpux&path=../B2355-90121/00/00/1&title=Administering%20Your%20HP-UX%20Trusted%20System

Enjoy !
......Madhu

Re: Prevent passwd file from being copy

Andreas Voss — Tue, 24 Oct 2000 05:47:09 GMT

Hi,

to have full information about ftp sessions edit the /etc/inetd.conf:
Change the line:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l
TO:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -v
Now reinitialize inetd with: inetd -c
After this you get all ftp commands and files logged in /var/adm/syslog/syslog.log

Regards

Re: Prevent passwd file from being copy

yc_2 — Tue, 24 Oct 2000 07:20:57 GMT

Hi Andreas,

Thanks for your advise.

Is there a way to know what files being down loaded because the syslog.log only capture the ftp login name but not the name of the files that being down loaded.

Rgds,
YC

Re: Prevent passwd file from being copy

Andreas Voss — Tue, 24 Oct 2000 07:34:01 GMT

Hi,

if you have added the -v option in /etc/inetd.conf at ftp line and reinitialized inetd with inetd -c you get a complete list what a user has done in a ftp session, looks like:
Oct 24 09:28:33 hpk2202 ftpd[7175]: connection from PC203 at Tue Oct 24 09:28:33 2000
Oct 24 09:28:33 hpk2202 ftpd[7175]: FTP LOGIN FROM PC203, voss
Oct 24 09:28:33 hpk2202 ftpd[7175]: FTP: cwd /baan/FT/RETRIEVAL
Oct 24 09:28:33 hpk2202 ftpd[7175]: PORT
Oct 24 09:28:33 hpk2202 ftpd[7175]: FTP: retrieve ftp.out
Oct 24 09:28:34 hpk2202 ftpd[7175]: FTP: delete ftp.out
Oct 24 09:28:34 hpk2202 ftpd[7175]: User voss logged out

As you can see the user changed to dir /baan/FT/RETRIEVAL (cwd), copied the file ftp.out (retrieve) and finally removed that file (delete).

Regards

Re: Prevent passwd file from being copy

yc_2 — Tue, 24 Oct 2000 08:10:16 GMT

Hi Andreas,

It works in ver 10.20 but not in 11.00. Does it required any patches ?

Re: Prevent passwd file from being copy

Andreas Voss — Tue, 24 Oct 2000 08:18:04 GMT

Hi,

on HP-UX 11.00 use instead -l -L:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -L -v

Regards

Re: Prevent passwd file from being copy

Darren Miller — Wed, 25 Oct 2000 21:35:51 GMT

Leong,

At HP-UX 11, a new version of ftp was released, which includes a config file called /etc/ftpd/ftpaccess that allows you to both deny ftp access to /etc/passwd and log all files uploaded and downloaded from your server. Here's what you need to do:

1) Add a "-a" to the end of the ftp line in /etc/inetd.conf.

2) Force inetd to re-read it's config file: inetd -c

3) Create the /etc/ftpd/ftpaccess file with the following lines:

class everyone real,guest,anonymous *
noretrieve /etc/passwd
log transfers anonymous,guest,real inbound,outbound
log commands anonymous,guest,real

This will keep a log of all commands and files accessed via ftp. The commands are logged in /var/adm/syslog/syslog.log, and the files, I think, are logged in /var/adm/syslog/xferlog.

There is much more you can do in ftpaccess. For more information, see the man page for ftpaccess and ftpd. Also take a look at the sample ftpaccess file in /usr/newconfig/etc/ftpd/ftpaccess.

Hope that helps!

both of the