topic FTP Restriction in Operating System - HP-UX

FTP Restriction

Fuad_1 — Sat, 18 Sep 2004 05:16:20 GMT

I would restric a user account to ftp only, the problem that the user is part of group that is can not be changed, as the files that will pushed needs to be accessed from users in same group, which is an appliaction group. So, How I can use the ftpaccess, while I can not change the user group to already restricted gourp in the system "ftponly"

Re: FTP Restriction

bhavin asokan — Sat, 18 Sep 2004 06:12:48 GMT

hi,

make an entry in the /var/adm/inetd.sec file

ftp deny username

regds,

Re: FTP Restriction

Robert-Jan Goossens — Sat, 18 Sep 2004 06:13:39 GMT

Hi Fuad,

Not perfect but, why not setup this user just for ftp only. Don't change the group for that users to ftponly.
---
Now add a user to the system. Use a group that is 'application group' and make the user's shell /usr/bin/ftpshell.
---

Regards,
Robert-Jan

Re: FTP Restriction

bhavin asokan — Sat, 18 Sep 2004 06:23:35 GMT

sorry,
the older reply is for an ipaddress not foe a user.

make a file ftpusers in /etc/ftpd folder
enter your user name to be restricted in that.
this will prevent that user from ftp access.

regds,

Re: FTP Restriction

Sridhar Bhaskarla — Sat, 18 Sep 2004 11:34:56 GMT

Hi Fuad,

You don't need to modify ftpaccess file if you want to make the user account "ftponly". Just make the shell as "/usr/bin/false" in /etc/passwd file. If you don't have a /etc/shells file, create one with all valid shells with one shell per line and add /usr/bin/false also to it. That will enable user to do ftp and not telnet/rlogin etc.,

-Sri

Re: FTP Restriction

Fuad_1 — Sat, 18 Sep 2004 23:31:21 GMT

Hi,

I would restrict the ftp user, so it can not traverse the filesystem, restricted to ftp specific directory.

Re: FTP Restriction

Sridhar Bhaskarla — Sat, 18 Sep 2004 23:50:50 GMT

Hi,

Well. You can still do it even after changing the group to 'ftponly'.

1. Make the user's home directory like /home/user/./
2. Create a group say 'ftponly' and change the primary group of the user to ftponly.
3. Add the following lines to your /etc/ftpd/ftpaccess file

guestgroup ftponly

With the above user will not be able to move above /home/user structure. Then use 'upload' directive in ftpaccess to change the ownership and group of the uploaded files. For ex., adding the following will make the ownership and group set to user and appgrp with permissions 0440.

upload /home/user * yes user appgrp 0440

You will have to add -a to your ftpd line in /etc/inetd.conf and refresh inetd - inetd -c.

-Sri