topic Re: Creating a secure ftp user in Operating System - HP-UX

Creating a secure ftp user

Laurence Beard — Thu, 18 Nov 2004 20:53:03 GMT

Hi,

I have been trying to create an ftp user that can login into a specific directory and can not cd .. or change to another directory.

Is this possible. I have considered using the restricted user shell with no success.

regards

Re: Creating a secure ftp user

Sridhar Bhaskarla — Thu, 18 Nov 2004 21:00:28 GMT

Hi Laurence,

You will need to use 'ftpaccess' file with 'chroot'ed home directory.

1. Make the user's home directory like /home/user/./ in /etc/passwd file.
2. Create a group say 'ftponly' and change the primary group of the user to ftponly.
3. Add the following lines to your /etc/ftpd/ftpaccess file (if you don't have an ftpaccess file, then copy it from /usr/newconfig/etc/ftpd/ directory)

guestgroup ftponly

With the above user will not be able to move above /home/user structure. If you want you can further set the restrictions using 'upload' directive. 'man ftpaccess' for more option.

You will have to add -a to your ftpd line in /etc/inetd.conf and refresh inetd ( inetd -c ).

BTW, this works only from 11.0 and above. For 10.20, you will have to install wu_ftp software.

-Sri

Re: Creating a secure ftp user

Sanjay_6 — Thu, 18 Nov 2004 22:23:17 GMT

Hi Laurence,

You need to setup ftpaccess for this user/group. Do "man ftpaccess" for more info on ftpaccess.

Here is a sample doc from itrc on how to setup restricted ftp access for a user,

http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000073346999

The itrc doc id is BC0814KBRC00007719.

Hope this helps.

Regds

Re: Creating a secure ftp user

Steven E. Protter — Thu, 18 Nov 2004 22:25:15 GMT

Make sure the shell for the user in /etc/profile is /bin/false

If there is a user that owns the ftpd binaries that should be the same.

Its possible with buffer overflows to trick the ftp daemon into running commands and even getting a shell prompt. This will prevent that.

SEP

Re: Creating a secure ftp user

Laurence Beard — Thu, 18 Nov 2004 22:41:29 GMT

Thanks all