file server access control

[Chun-Pang Li]

Hi,

How can I prevent the regular users of my file server from telnet, rlogin..etc? They only can mount their home directory from file server. But administrators still can get through it by those services.

Thanks,

[RikTytgat]

Hi,

Several possibilities:

- You could use the file /var/adm/inetd.sec to restrict access to those service if coming from certain hosts (cfr manpage inetd.sec(4)). This also means that administrators will not be able to use the services from a 'normal user's' host.
- You could specify /bin/false as the login shell for those users not allowed to login. They would still be able to use the telnet, ... services, but they cannot login using their username.

Hope this helps,
Rik

[Brian M. Fisher]

I agree with Rik. I would start by disabling all services on the server that are not required in the /etc/inetd.conf file.
some of the services that are not usually required are: finger, exec, uucp, inetd internal services (daytime time echo discard chargen), and rpc services.

After you have made those changes, modify the /var/adm/inetd.sec file to either allow certain hosts or networks access or deny certain hosts or networks access.

Good Luck,
Brian
<*(((>< er

[Antoanetta Naghiu]

Do not forget to recycle the inetd daemon after modification: inetd -c