topic Re: SFTP with /usr/bin/false or /sbin/false in Operating System - HP-UX

SFTP with /usr/bin/false or /sbin/false

Ivan_86 — Wed, 07 Jun 2006 11:35:17 GMT

Hi,
I configure SFTP with chroot jail, in the L2000 with 11.iv1

I want to create an sftp user, i create user with /usr/bin/false as shell user. when i test the connection using sftp , it didn't work. if i change the shell, /bin/sh ie normale shell , it work. Just work with /bin/sh,
but i need to have a user who can do ftp only and the same user can't connected via login.

Too configure the file /etc/shells, this file contain the next :
# more /etc/shells
/usr/bin/sh
/usr/bin/ksh
/usr/bin/csh
/sbin/sh
/usr/bin/false
/sbin/false

In the inetd.conf configure the next line
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -a 022

The entry of the user in the passwd is this:

appuser:V/ZjljOq236MU:121:20:Prueba usuario SFTP:/newroot/./home/appuser:/bin/fa
lse

please can i have suggestion.

regards

Re: SFTP with /usr/bin/false or /sbin/false

Joseph C. Denman — Wed, 07 Jun 2006 11:51:16 GMT

Be sure to add /usr/bin/false to /etc/shells

...jcd...

Re: SFTP with /usr/bin/false or /sbin/false

Ivan_86 — Wed, 07 Jun 2006 11:53:25 GMT

Yes i be sure.

# more /etc/shells
/usr/bin/sh
/usr/bin/ksh
/usr/bin/csh
/sbin/sh
/usr/bin/false
/sbin/false

Re: SFTP with /usr/bin/false or /sbin/false

Joseph C. Denman — Wed, 07 Jun 2006 11:54:02 GMT

Looks like the entry in the passwd file is /bin/fa ???? I should be /usr/bin/false.

...jcd...

Re: SFTP with /usr/bin/false or /sbin/false

Darrel Louis — Wed, 07 Jun 2006 11:54:19 GMT

Hi,

FTP and SFTP are making use of two different protocols.
SFTP won't make use of /etc/ftpd/ftpaccess file.
Both should work, but we're making use of /usr/bin/false.
What are really using ftp or sftp?

Darrel

Re: SFTP with /usr/bin/false or /sbin/false

Ivan_86 — Wed, 07 Jun 2006 11:58:52 GMT

Thanks for you respons

Darrel, I use SFTP

Joseph, the line is bad copy
appuser:V/ZjljOq236MU:121:20:Prueba usuario SFTP:/newroot/./home/appuser:/bin/false

Re: SFTP with /usr/bin/false or /sbin/false

Joseph C. Denman — Wed, 07 Jun 2006 12:08:12 GMT

You don't have /bin/false in /etc/shells.

...jcd...

Re: SFTP with /usr/bin/false or /sbin/false

Darrel Louis — Wed, 07 Jun 2006 12:10:42 GMT

Ivan,

It works as it should, if you try to ftp to the server, with /usr/bin/false, you can ftp your data.

This is what I get:
$ scp score_tool-hpux.sh hosta:
lost connection
$ ssh hosta
Last login: Wed Jun 7 19:07:07 2006 from hostb
Connection to acen51 closed.

Darrel

Re: SFTP with /usr/bin/false or /sbin/false

Ivan_86 — Wed, 07 Jun 2006 12:51:50 GMT

I add /bin/false in the /etc/shells

# more /etc/shells
/usr/bin/sh
/usr/bin/ksh
/usr/bin/csh
/sbin/sh
/usr/bin/false
/sbin/false
/bin/false

The user in the passwd is :

appuser:V/ZjljOq236MU:121:20:Prueba usuario SFTP:/newroot/./home/appuser:/bin/false

Whe i try connected show this :

# sftp -oPort=9378 appuser@10.199.11.138
Connecting to 10.199.11.138...
Password:
Connection closed

Re: SFTP with /usr/bin/false or /sbin/false

Darrel Louis — Wed, 07 Jun 2006 14:05:29 GMT

Ivan,

Try ftp
Check what the results are.
Sftp is using the same protocol/port as ssh.

Darrel

Re: SFTP with /usr/bin/false or /sbin/false

Joseph C. Denman — Thu, 08 Jun 2006 09:12:07 GMT

Hmmm.... Does sftp require a shell when logging in????? As Darrell stated, try to FTP to the system and post your result.

...jcd...