FTP Access

[Joe Profaizer]

If I want to allow only root and a couple of other users to only have FTP "get" and "put" access on an HP-UX Server -- what's the easiest way to do so. So far, I can only find within SAM a method to dis-allow users. I'm looking for a method to only allow certain users.

..Joe

[melvyn burnard]

you may want to take a look at the man page for inetd.sec, but I am unsure if this is exactly what you are looking for.

[James R. Ferguson]

Hi Joe:

You can restrict users by defining them in /etc/ftpusers. See 'man (4) ftpusers'.

...JRF...

[Joe Profaizer]

I have alot of users and only want three accounts to have ftp access. I don't want to have to remember to add users to /etc/ftpusers every time I create an account. Is there such a file just for "allowed" users? Also, what happens if I disable access to the following accounts:
uucp, www, sys, and nuucp

What function to the above accounts have?

Thanks,

..Joe

[Marcel Boon]

Hi Joe,

Checkout these link:
http://www.docs.hp.com/hpux/onlinedocs/B2355-90685/B2355-90685.html

Marcel

[Bruce Regittko_1]

Hi,

The file /etc/ftpd/ftpusers is a list of those users who *can* use ftp, one user name per line. New accounts do not have to be added unless you want them to access your box via ftp from a remote client.

As for the system accounts, such as uucp, you do not need them in /etc/ftpd/ftpusers. Those accounts will not be using ftp.

--Bruce

[Shannon Petry]

Another method of doing this is to create /etc/shells and put the 3 users you want to have access login shells into that file.
I.E. root's default shell is /sbin/sh
add /sbin/sh to /etc/shells (new file).
The other two users, use a shell that you do not normally use. I.E. If you always use "/usr/bin/sh" for your users, move the users you want to ftp to a shell of /usr/bin/ksh. Then add /usr/bin/ksh to /etc/shells.
By default, any login shell is okay. Once the /etc/shells file is there, it restricts access to those who have matching shells. This may require wu-ftpd, but I dont think so....

Also, if you are running the HP version of wu-ftp, then there is a ftphosts file. simply make the entries in this file for who you want to ftp and a generic global deny. I.E.
deny * *
allow johndoe host1
allow root *
allow me *
Field 1 is allow or deny. Field 2 is the user. Field 3 is the host or domain. Of course an "*" is "ALL".



Regards,
Shannon

[Sean C. DeZurik]

/etc/ftpd/ftpusers is used to reject users and all uucp accounts should be in it.

You can then use /var/adm/inetd.sec to restrict ftp to certain hosts. You can also use the -a option to ftpd and use /etc/ftpd/ftpaccess to restrict ftp access to a set of hosts.

[James A. Donovan]

You can "auto-build" your ftpusers file by using a little script.

#!/bin/sh
cat /etc/passwd|grep -v user1|grep -v user2 |grep -v user3|cut -f 1 -d":" > /etc/ftpd/ftpusers
/usr/sbin/inetd -c