Deny ftp, only for root

[Victor_5]

I want open ftp only for root, I don't want to modify ftpusers since I have a lot of users, any idea?

[Michael Steele_2]

Install SSH and DENY ALL for ftp in it's config file but root?

[Rita C Workman]

Never did this..

But here's a thought to at least try..

Maybe create a unique group and make root the only member. Then in your ftpaccess make root & this group the only ones that can have access.

Might even try setting the option private option to yes in the ftpaccess file, thus requiring a password. See man ftpaccess.

Like I said...just a thought,
Rita

[Jairo Campana]

check the info :
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xcd135bd3782dd711abdc0090277a778c,00.html

[H.Merijn Brand (procura]

Make use of a less known feature (eviiiiil!)

# cd
# mkdir private
# cp /bin/sh private
# chmod 700 private
# cd /etc
# echo ~/private/sh >shells

Now change the shell for root to ~/private/sh using chsh

Explanation: if /etc/shells is found, ftp will only work for users whose logon shell is mentioned in there

Enjoy, have FUN! H.Merijn

[Steven E. Protter]

ftpusers is a counter-intuitive denial file. All you probably need to enable root ftp access is to take root out of that file, save it.

To deny access, just add root to the file.

That's probably the best way to go.

Almost sounds like you want to do two opposing tasks, as I obvoiusly misread your post.

SEP

[Alexander M. Ermes]

Hi there.
Why not create a file /etc/ftpd/ftpusers with all the usernames in it, which will not be allowed to use ftp ?
Rgds
Alexander M. Ermes

[Steven E. Protter]

Additional note: After posting my post it occurred to me that I should actually test my ftpusers functionality on my HP-UX 11.11 servers.

To my horror, it did not block root ftp login, even though I followed my own procedure. The procedjure did work on 11.00.

The issue was that Washington University changed certain functionality in the ftp server and you have to go to HP, get and install a binary to make my denial scheme work.

Right not the binaries are not on a public ftp server, but if you have a support contract, they'll hook you up.

SEP