FTP access restrictions HELP!! (Please)

[Charles Harris]

Dear all,

I'm having another slight dilemna with FTP access and in particular user permissions.
I am trying to restrict users from being able to wander through a development server, although they can see files but not get or change them, - so far without sucess.
I have removed the FTPD umask which helped a bit, but wondered if there was any other way of tying down the server.

Any help or comments appreciated!!!!

-ChaZ-

[James A. Donovan]

The guides at http://www.wu-ftpd.org/HOWTO and http://www.landfield.com/wu-ftpd (click on Documents) provide a lot of good information on locking down FTP.

[Rita C Workman · Accepted solution]

As Jim said you can download wu-ftp. For myself I just did a chroot and set up my ftpaccess file to only grant particular group privileges for some and on others I only gave them guest privileges. To keep down the travel and secure them to their /home directory only I simply edited the /etc/paswd and add period slash to home directory:

user:passwd:uid:gid:UserName:/home/user/./:/bin/ksh

Others may know a better way, for me it worked,
/rcw

[Shannon Petry]

I wrote up a pretty descent FAQ some time ago for FTP Server configs. You can find it at http://www.invenioeng.com/systems/ftpd_faq.html

This may give you some help/pointers....

Regards,
Shannon

[Joseph C. Denman]

I agree with Rita. I would configure using the ftpaccess file. You could put a file listing for them to view? Plus they could put files there for you to distribute. Just a thought...


...jcd...

[Charles Harris]

Thanks for all the help! I'll checkout the references and give a few of the ideas a go. The only thing I noticed in the replies was reference to wu-ftpd, which sounds like what I use at home on my Linux box. Is this part of a standard HP-UX 10.20 distro or an addon ?

Again, thanks for the comments they are greatly appreciated!!!

-ChaZ-

[Shannon Petry]

WU_FTPD is a HP-UX 11 add on, or is available from the porting center for 10.20.

For security reasons, I usually recommend you build your own and disable the site_exec feature which I am pretty sure is built into the distro from the porting center.

Regards,
Shannon

[Brian Markus]

I took a different approach. I loaded ProFTPD from www.proftpd.net. It allows all the security you could ever wish for. It's easy to load, and extremly easy to manage. The conf file is simular to html.

Here's a samplefrom my conf file.
I set the user's root to /xfer/cusd46
require them to use their standard unix passwd
Just put allow for the permissions you want and deny for the ones you dont.
You can branch it off and do sub directorys as well. There's an example in here.


User xcusd46
Group users
AnonRequirePassword on



AllowAll


DenyAll





AllowAll


DenyAll






Hope this helps


Brian