topic FTP access only in Operating System - HP-UX

FTP access only

patrick coutinho — Mon, 10 May 2004 07:30:17 GMT

Hi,

A query, if a user has ftp access only (no telnet access) , he can still ftp a .profile file of his own creation to his own directory and then get FULL privileges. That's true is it not ? Any ideas on how to address this security issue.

Thanks & Rgds

Pat

Re: FTP access only

Joseph Loo — Mon, 16 Sep 2024 09:19:59 GMT

hi,

that is possible only if you allow him to ftp it to his/her home directory as well as more than read permission for the .profile file.

however, since telnet is not available by causing an exit everytime the user try to telnet, i am unsure how he/she is able to get FULL prvileges.

regards.

Re: FTP access only

Geoff Wild — Mon, 10 May 2004 08:03:03 GMT

Privileges arn't controlled by .profile - no matter what they put in it, they can't change their shell from /etc/passwd....

Rgds...Geoff

Re: FTP access only

Mark Grant — Mon, 10 May 2004 08:05:14 GMT

Even if there were something in the .profile, for example and environment variable or something that controlled access to some software somewhere, they still wouldn't be able to overwrite their own .profile IF you remove write access from it.

A user does not need write access to their .profile

Re: FTP access only

Jeff_Traigle — Mon, 10 May 2004 11:08:05 GMT

Depends how you're denying telnet access. If you're doing it correctly and have their shell set to /usr/bin/false, then them overwriting their .profile is irrelevant as Geoff alluded.

However, the comments about making sure .profile is read only or not owned by the user to disallow overwriting it anyway isn't quite accurate, I think. Wouldn't this be the same as users being able to overwrite their .profile in a telnet session? This is controlled by the home directory permissions, not the .profile permissions, right? Unless you want to block people from uploading files to their home directories on the server entirely by doing that, I don't think you can protect the .profile that way.

Re: FTP access only

Rodney Hills — Mon, 10 May 2004 11:14:23 GMT

If a user only needs ftp access, then set their shell to "/usr/bin/false" in /etc/passwd.

ftp will still work, but they won't be able to login via telnet.

HTH

-- Rod Hills

Re: FTP access only

patrick coutinho — Tue, 11 May 2004 00:31:23 GMT

Thanks everyone for those thoughts. Very valuable to me. This forum is really super.

Rgds

Pat

Re: FTP access only

generic_1 — Tue, 11 May 2004 01:02:10 GMT

If possible in your evnrironment, I would suggest turning off ftp and telnet and implementing scp/ssh :). This way unencrypted passwords are not going accross your network. Just my two cents. Also does not hurt to define the ftpaccess file when using ftp.

Re: FTP access only

patrick coutinho — Tue, 11 May 2004 01:38:32 GMT

Thanks Jeff

Re: FTP access only

Joseph Loo — Tue, 11 May 2004 02:30:40 GMT

hi patrick,

any reason why jeff gets the points and we get none???

regards.

Re: FTP access only

patrick coutinho — Tue, 11 May 2004 02:48:53 GMT

I am sorry guys. did not mean to offend anyone. I thought i had already assigned points to everyone before the last reply. My mistake. must be something with browser. My apologies. Points assigned.

Many thanks once again to everyone.

Rgds

Pat