topic Re: restrict ftp in Operating System - HP-UX

restrict ftp

Jose Ramirez_6 — Tue, 05 Nov 2002 19:30:35 GMT

good mornig.

I had problem when used the file ftpaccess,

I need to create an user, for example cdf, with the same caracteristic as the user anonymous.

thank you for help me.
JRM.

Re: restrict ftp

Christopher McCray_1 — Tue, 05 Nov 2002 19:55:13 GMT

Hello,

First, create an account (cdf) and give it a unique group id (i.e guestgroup).

In your ftpaccess file, create a class for this user and insert the guestgroup line:

class interfaces guest or , etc.

guestgroup

Then edit your /etc/passwd to giv it a chrooted home dir:

cdf:*:123:456::/home/cdf/./:/bin/false (make sure the default shell is present in /etc/shells.

Then make any appropriate entries in ftpaccess:

upload /home/cdf /incoming yes cdf 0660 dirs
upload /home/cdf / no

Also, mkdir usr/bin under the user's home directory and copy /usr/bin/ls into it and make $HOME/usr $HOME/usr/bin and $HOME/usr/bin/ls 555 permissions.

In case I forgot anything, look at these docs:

http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000062906536

http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000063248362

Others may be obtained using the keywords "ftpaccess" and "ftp only"

Hope this helps

Chris

Re: restrict ftp

Jose Ramirez_6 — Tue, 05 Nov 2002 20:43:00 GMT

I have done the change in the configuration and when i execute the command ftp with the user cdf the system reply with

550 Can't set guest privileges.

thank you for help me.

Re: restrict ftp

john korterman — Wed, 06 Nov 2002 10:26:11 GMT

Hi,
can send your ftpaccess file as attachment?
And also show the config line for the cdf user from /etc/passwd?

regards,
John K.

Re: restrict ftp

Rita C Workman — Wed, 06 Nov 2002 12:58:46 GMT

Christopher has everything perfect...except one little problem.

Do not use usr/bin/ls...

Instead copy /sbin/ls to /home/cdb/usr/bin and then chmod it.

Rgrds,
Rita

Re: restrict ftp

Rita C Workman — Wed, 06 Nov 2002 12:59:01 GMT

Christopher has everything perfect...except one little problem.

Do not use usr/bin/ls...

Instead copy /sbin/ls to /home/cdf/usr/bin and then chmod it.

Rgrds,
Rita

Re: restrict ftp

Christopher McCray_1 — Wed, 06 Nov 2002 13:44:05 GMT

Hello again,

What does your line for ftpd say in /etc/inetd.conf?

ftp stream tcp nowait root /usr/local/bin/tcpd ftpd -l -v -a -L -i -o

(keep in mind I'm using tcp wrappers, so your line might say ftpd instead of tcpd)

Have you tried bouncing inetd?

# inetd -c

Could you please post your ftpaccess file as requested before?

Chris