ABORT_LOGIN_ON_MISSING_HOMEDIR and FTP

[Steve Bonds]

Strangely, this directive does not seem to apply to ftp logins-- i.e. if the home directory is missing it happily logs the user in to the root directory.

This is probably because ftp is not using login() for some reason. Anyone have any insight?

Is there a good way to keep FTP users out if the home directory goes away? (i.e. because of a ServiceGuard package failover.)

Thanks,

-- Steve

[someone_4]

Hi,
Might depend on what kind of ftp you have set. Is this only an ftp user? Or a user that can ftp or anonymous ftp. I attached a doc on how to ristrict ftp to their own home dir. But I dont know what will happend if the home dir gets deleted. But maybe someone has a better way to do it.

- Richard

[Steve Bonds]

Thanks for the info!

Unfortunately, what happens when one of these restricted-to-the-home-directory users has their directory deleted, is they can now log in to "/".

Which is why I started exploring this neat new /etc/default/security directive...

-- Steve

[someone_4]

hi steve,
I just tried it .. I added a user and deleted the home dir. And guess what? When I ftp I am in the home dir. =(
How about that??

- Richard

[Mark Greene_1]

I just tried this on a AIX system: create a user, delete the home dir, and then tried to ftp as that user from another system. The ftp was refused. I could telnet in as that user, and did get the message that the home dir was missing and that I was logged-in at the root dir. So, I would call the HP support number and report this as a bug.

HTH
mark