topic Re: Need small help on FTP access in Operating System - Linux

Need small help on FTP access

girishb — Tue, 15 Aug 2006 11:04:14 GMT

Hi,

I have vsftp server installed on SUSE Linux 9.0 OS.

I need to deny ftpuser (its a user account) all the access services except performing ftp to the server.

Please scrap in with the solutions.

Thanks in advance.

Girish

Re: Need small help on FTP access

Steven E. Protter — Tue, 15 Aug 2006 12:23:41 GMT

Shalom Girish,

If the user always has the same host name you can deny access based on ip address with iptables, only on ports 20 and 21.

You control this with vsftpd.conf

http://vsftpd.beasts.org/vsftpd_conf.html
http://elibrary.fultus.com/technical/topic/com.fultus.redhat.elinux4/manuals/rhel-rg-en-4/s2-ftp-vsftpd-conf.html

SEP

Re: Need small help on FTP access

Manuel Wolfshant — Tue, 15 Aug 2006 19:15:58 GMT

Just use for that user a shell which only allows ftp. For instance, you could have in /etc/passwd:
ftp:x:14:50:FTP User:/archives/arhive:/sbin/nologin

Depending on your needs, you could also chroot the user in its home dir (see the man page). Please also verify if you need (or not) to add the shell you setup for that user to the file /etc/shells.

A secondary line of securing is tcp_wrappers (controlling access to daemons via /etc/hosts.{allow,deny}.
And last but not least, iptables, as has already been suggested. However, please DO NOT use the old and incorrect way of allowing ports 20 and 21; the correct way is to allow port 21 and use the connection tracking facilities of iptables (-m state --state RELATED,ESTABLISHED) which will allow both active and passive ftp to function (unlike the port 20/21 variant). Just make sure the relevant conntrack modules are loaded.