FTP access only

[patrick coutinho]

Hi,

A query, if a user has ftp access only (no telnet access) , he can still ftp a .profile file of his own creation to his own directory and then get FULL privileges. That's true is it not ? Any ideas on how to address this security issue.

Thanks & Rgds

Pat

[Joseph Loo]

hi,

that is possible only if you allow him to ftp it to his/her home directory as well as more than read permission for the .profile file.

however, since telnet is not available by causing an exit everytime the user try to telnet, i am unsure how he/she is able to get FULL prvileges.

regards.

[Geoff Wild]

Privileges arn't controlled by .profile - no matter what they put in it, they can't change their shell from /etc/passwd....


Rgds...Geoff

[Mark Grant]

Even if there were something in the .profile, for example and environment variable or something that controlled access to some software somewhere, they still wouldn't be able to overwrite their own .profile IF you remove write access from it.

A user does not need write access to their .profile

[Jeff_Traigle · Accepted solution]

Depends how you're denying telnet access. If you're doing it correctly and have their shell set to /usr/bin/false, then them overwriting their .profile is irrelevant as Geoff alluded.

However, the comments about making sure .profile is read only or not owned by the user to disallow overwriting it anyway isn't quite accurate, I think. Wouldn't this be the same as users being able to overwrite their .profile in a telnet session? This is controlled by the home directory permissions, not the .profile permissions, right? Unless you want to block people from uploading files to their home directories on the server entirely by doing that, I don't think you can protect the .profile that way.

[Rodney Hills]

If a user only needs ftp access, then set their shell to "/usr/bin/false" in /etc/passwd.

ftp will still work, but they won't be able to login via telnet.

HTH

-- Rod Hills

[patrick coutinho]

Thanks everyone for those thoughts. Very valuable to me. This forum is really super.

Rgds

Pat

[generic_1]

If possible in your evnrironment, I would suggest turning off ftp and telnet and implementing scp/ssh :). This way unencrypted passwords are not going accross your network. Just my two cents. Also does not hurt to define the ftpaccess file when using ftp.

[patrick coutinho]

Thanks Jeff

[Joseph Loo]

hi patrick,

any reason why jeff gets the points and we get none???

regards.

[patrick coutinho]

I am sorry guys. did not mean to offend anyone. I thought i had already assigned points to everyone before the last reply. My mistake. must be something with browser. My apologies. Points assigned.

Many thanks once again to everyone.

Rgds

Pat