ftp account only needs ftp access -- No interactive login. Do I just use /bin/false as the shell?

[Joe Profaizer]

Do I just insert /bin/false as the shell for the account for this to happen. We only want these accounts to have ftp access ONLY.

Thanks!!

[Andrej Drobnic]

Yes.
Don't forget to add "/bin/false" to /etc/shells or ftp access won't work.

[A. Clay Stephenson · Accepted solution]

That will allow your user to access FTP but nothing else. If you are running ftp on 11x then you can use /etc/ftpd/ftpaccess for even better control. Man ftpaccess for details.

[Joe Profaizer]

What if /etc/shells doesn't exist. Should I just create it. Will that affect my other shell programs? Do I need to add the other shell programs to /etc/shell?

[BFA6]

Hi,

If /etc/shells doesn't exist, you will need to create it and add into any of the shells that use ftp, including /bin/false

Regards,

Hilary

[Ian Dennison_1]

If you really want to tighten security, use the ftpaccess file and switch on its utilisation in /etc/inetd.conf.

A User in ftp can still cause damage to the system by downloading, modyfing and uploading files.

But you never heard that from me.

Share and Enjoy! Ian Dennison

[Michael Elleby III_1]

Hello-

I guess I would be quick to say yes, but in addition to giving the user a bogus shell, is it also your intention to keep the user in a certain directory (chroot jail) and not be able to move around in filesystems on your server?

Mike Elleby

[Shannon Petry]

Once you create the /etc/shells files, make sure to put all your valid shells for "connections" inside or you will have other problems.
I.E. my /etc/shells looks like this...
/sbin/sh
/bin/sh
/usr/bin/sh
/bin/csh
/usr/bin/csh
/bin/ksh/
/usr/bin/ksh
/usr/bin/false

Note: IBM and Solaris make ID's with shells in /bin, and not like HP in /usr/bin. Adding these shells by default makes for less problems/debugging later in a mixed environment.

Regards,
Shannon

[Joe Profaizer]

Thanks to all. Issue resolved.