topic Re: ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell? in Operating System - HP-UX

ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell?

Joe Profaizer — Wed, 09 Oct 2002 12:55:00 GMT

Do I just insert /bin/false as the shell for the account for this to happen. We only want these accounts to have ftp access ONLY.

Thanks!!

Re: ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell?

Andrej Drobnic — Wed, 09 Oct 2002 12:56:01 GMT

Yes.
Don't forget to add "/bin/false" to /etc/shells or ftp access won't work.

Re: ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell?

A. Clay Stephenson — Wed, 09 Oct 2002 12:57:23 GMT

That will allow your user to access FTP but nothing else. If you are running ftp on 11x then you can use /etc/ftpd/ftpaccess for even better control. Man ftpaccess for details.

Re: ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell?

Joe Profaizer — Wed, 09 Oct 2002 12:58:34 GMT

What if /etc/shells doesn't exist. Should I just create it. Will that affect my other shell programs? Do I need to add the other shell programs to /etc/shell?

Re: ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell?

BFA6 — Wed, 09 Oct 2002 13:01:05 GMT

Hi,

If /etc/shells doesn't exist, you will need to create it and add into any of the shells that use ftp, including /bin/false

Regards,

Hilary

Re: ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell?

Ian Dennison_1 — Wed, 09 Oct 2002 13:02:38 GMT

If you really want to tighten security, use the ftpaccess file and switch on its utilisation in /etc/inetd.conf.

A User in ftp can still cause damage to the system by downloading, modyfing and uploading files.

But you never heard that from me.

Share and Enjoy! Ian Dennison

Re: ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell?

Michael Elleby III_1 — Wed, 09 Oct 2002 13:03:15 GMT

Hello-

I guess I would be quick to say yes, but in addition to giving the user a bogus shell, is it also your intention to keep the user in a certain directory (chroot jail) and not be able to move around in filesystems on your server?

Mike Elleby

Re: ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell?

Shannon Petry — Wed, 09 Oct 2002 13:08:03 GMT

Once you create the /etc/shells files, make sure to put all your valid shells for "connections" inside or you will have other problems.
I.E. my /etc/shells looks like this...
/sbin/sh
/bin/sh
/usr/bin/sh
/bin/csh
/usr/bin/csh
/bin/ksh/
/usr/bin/ksh
/usr/bin/false

Note: IBM and Solaris make ID's with shells in /bin, and not like HP in /usr/bin. Adding these shells by default makes for less problems/debugging later in a mixed environment.

Regards,
Shannon

Re: ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell?

Joe Profaizer — Wed, 09 Oct 2002 13:24:15 GMT

Thanks to all. Issue resolved.