topic Re: FTP Access in Operating System - HP-UX

FTP Access

Joe Profaizer — Tue, 06 Mar 2001 14:51:48 GMT

If I want to allow only root and a couple of other users to only have FTP "get" and "put" access on an HP-UX Server -- what's the easiest way to do so. So far, I can only find within SAM a method to dis-allow users. I'm looking for a method to only allow certain users.

..Joe

Re: FTP Access

melvyn burnard — Tue, 06 Mar 2001 14:58:24 GMT

you may want to take a look at the man page for inetd.sec, but I am unsure if this is exactly what you are looking for.

Re: FTP Access

James R. Ferguson — Tue, 06 Mar 2001 14:59:24 GMT

Hi Joe:

You can restrict users by defining them in /etc/ftpusers. See 'man (4) ftpusers'.

...JRF...

Re: FTP Access

Joe Profaizer — Tue, 06 Mar 2001 15:05:27 GMT

I have alot of users and only want three accounts to have ftp access. I don't want to have to remember to add users to /etc/ftpusers every time I create an account. Is there such a file just for "allowed" users? Also, what happens if I disable access to the following accounts:
uucp, www, sys, and nuucp

What function to the above accounts have?

Thanks,

..Joe

Re: FTP Access

Marcel Boon — Tue, 06 Mar 2001 15:07:11 GMT

Hi Joe,

Checkout these link:
http://www.docs.hp.com/hpux/onlinedocs/B2355-90685/B2355-90685.html

Marcel

Re: FTP Access

Bruce Regittko_1 — Tue, 06 Mar 2001 18:45:24 GMT

Hi,

The file /etc/ftpd/ftpusers is a list of those users who *can* use ftp, one user name per line. New accounts do not have to be added unless you want them to access your box via ftp from a remote client.

As for the system accounts, such as uucp, you do not need them in /etc/ftpd/ftpusers. Those accounts will not be using ftp.

--Bruce

Re: FTP Access

Shannon Petry — Tue, 06 Mar 2001 21:11:53 GMT

Another method of doing this is to create /etc/shells and put the 3 users you want to have access login shells into that file.
I.E. root's default shell is /sbin/sh
add /sbin/sh to /etc/shells (new file).
The other two users, use a shell that you do not normally use. I.E. If you always use "/usr/bin/sh" for your users, move the users you want to ftp to a shell of /usr/bin/ksh. Then add /usr/bin/ksh to /etc/shells.
By default, any login shell is okay. Once the /etc/shells file is there, it restricts access to those who have matching shells. This may require wu-ftpd, but I dont think so....

Also, if you are running the HP version of wu-ftp, then there is a ftphosts file. simply make the entries in this file for who you want to ftp and a generic global deny. I.E.
deny * *
allow johndoe host1
allow root *
allow me *
Field 1 is allow or deny. Field 2 is the user. Field 3 is the host or domain. Of course an "*" is "ALL".

Regards,
Shannon

Re: FTP Access

Sean C. DeZurik — Tue, 06 Mar 2001 23:48:07 GMT

/etc/ftpd/ftpusers is used to reject users and all uucp accounts should be in it.

You can then use /var/adm/inetd.sec to restrict ftp to certain hosts. You can also use the -a option to ftpd and use /etc/ftpd/ftpaccess to restrict ftp access to a set of hosts.

Re: FTP Access

James A. Donovan — Tue, 06 Mar 2001 23:59:41 GMT

You can "auto-build" your ftpusers file by using a little script.

#!/bin/sh
cat /etc/passwd|grep -v user1|grep -v user2 |grep -v user3|cut -f 1 -d":" > /etc/ftpd/ftpusers
/usr/sbin/inetd -c