/etc/ftpaccess file question

[Ronelle van Niekerk]

If I place an entry for a user in the ftpaccess file can I still use the -u option in inetd.conf?
Or will we have to place another entry in the ftpaccess file for all the other users?

We only want to restrict one user and leave all the others the way they are now.

[Con O'Kelly]

Hi

If you only want to restrict 1 user & its a simple scenario, then I think you can add that username to /etc/ftpd/ftpusers file.
See man ftpusers.

This will ensure that the user cannot login using ftp.

Cheers
Con

[Ronelle van Niekerk]

I want to restrict the user's access, not ban the user completely.

[Rajeev Shukla]

For restricting users from doing ftp the file is /etc/ftpusers in 10.20 and 11.x its /etc/ftpd/ftpusers

All the users you put in that file (/etc/ftpd/ftpusers) will no longer have access to ftp on this server.

Rajeev

[Ronelle van Niekerk]

Let me clarify:

We want to "restrict" this specific user to one directory and make suer the file has specific permissions.

I know the line for this in /etc/ftpd/ftpaccess, my question is:

If I insert this line for the user do I have to add another line for all the other users that we do not want to "restrict" or can we leave the ftp line in inetd.conf as is with the extra -a option?

[twang]

I prefer using the /var/adm/inetd.sec file to specify what ip address can use ftp,
sample entry is as follows:
ftp allow 192.1.168.46 192.1.169

[Michael Tully]

Your best bet is to set the user as being a restricted user with a restricted shell and not utilising anonymous. Changing the ftpaccess file I am fairly sure is not going to make any difference.

e.g.
# useradd -u 2020 -g users -d /home/userx -s /usr/bin/rksh -c "restricted user" -m userx

[twang]

Steps to create a restricted user with a restricted shell:

1. cp /usr/newconfig/etc/ftpd/ftpaccess
/etc/ftpd/ftpaccess

2. create a group for ftp users called ftpgrp

3. create the new ftp user ftpuser and restrict home to /home/ftpuser

# useradd -m -d /home/ftpuser -s /usr/bin/false -g ftpgrp ftpuser

4. add the /usr/bin/false

5. edit /etc/inetd.conf file:
ftp tcp stream nowait root /usr/lbin/ftpd ftpd -a

6. edit /etc/passwd file:
ftpuser:xxxxxxxxxx:1000:1000::/home/ftpuser/./:/usr/bin/false

7. # inetd -c

[Ronelle van Niekerk]

I already know the line to add to ftpaccess to make this work and it WILL work, I have tested it on a test machine.
If you really want to know, this is the line I will be adding:
upload /user/home/dir /dir/to/upload yes username group 037

It works. THe files get uploaded with the umask of 037.

All I want to know is:
Can I keep my inetd.conf ftp line as is:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -u007 -t7200
and just add a -a option to read the ftpaccess file?

Or must I change the line to:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -a
and add another line to ftpaccess for all the other users (for whom I would like to have a umask of 007)?

I don't want to tie down ip addresses.
I don't want to ban any users.