FTP home directory restriction

[nibble]

guys, how can i restrict an ftp-user to stick only to his working directory? meaning, no matter how he issues "cd ..", he cannot change directory to the higher directory. what he can transfer is only to his subdirectory.

thanks a lot...

[eran maor]

Hi

this is a know issue ,
please follow this guide line :

The new version of FTP is supplied to HP-UX 11.00 through patch [PHNE_14479/PACHRDME/English]
and this must be installed on your system. Please check the release notes
provided at /usr/share/doc/RelNotes_newftp.txt for further information on
the enhancements provided by this FTP revision.

There are three kinds of logins provided wu-ftp;
* anonymous FTP
* real FTP
* guest FTP

The focus of this document is how to setup a 'guest' ftp account to get
around the sublogin problems encountered with HP-UX 11.00.

Guest accounts require explicit user entries in the system /etc/passwd
file but performs a chroot to a designated directory, thus maintaining
integrity.

Steps to be followed;

1. Make the edits to the /etc/passwd file

ftpguest:4rL2HZkDatENY:505:125::/home/ftp/ftpguest/./:/usr/bin/false
^^^
- '.' Is the delimiter to determine where the chroot will be performed. In
this example, after logging in '/' will in effect be /home/ftp/ftpguest.
If the delimiter was placed between ftp and ftpguest then '/' would be
/home/ftp ftpguest was used as the account name in this example but you
could use any name you like.

2. /usr/bin/false will have to be added to the /etc/shells file.
See man(4) shells for further details

3. Make the edits to the /etc/group file

ftpgroup::125:ftpguest

- Create and set the permissions and ownership for the directory
(/home/ftp/ftpguest) to what suits you best.

4.
Add an entry into the ftpaccess file. This file will most probably have to
be copied from the /usr/newconfig/etc/ftpd/ftpaccess to /etc/ftpd/ftpaccess.

Add a guestgroup entry (in the /etc/ftpd/ftpaccess file) to allow a group
of users to be treated as 'guests'. This entry will correspond to the entry
in the /etc/group file. Here is a sample of the ftpaccess file to use guest
groups.

# specify which group of users will be treated as "guests".
guestgroup ftpgroup

5. Edit the /etc/inetd.conf file and add the '-a' option to enable ftpd to
use the ftpaccess file. Here is an example;

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -a

You will need to reconfigure inetd by running /usr/sbin/inetd -c to
reread the /etc/inetd.conf file after making the change.

6. Since this is similar to anonymous FTP in the respect that you are in a
chrooted area (the path to / is different than on your system) you will
also have to replicate the /usr/bin and /etc directories. The easiest way
to do this is to use SAM to create an anonymous FTP setup and then replicate
the /etc & /usr/bin directories into your ftp guest root directory. Here
is an example of how you would replicate the ~ftp/usr and ~ftp/etc directory
to your new ftp guest directory. We use the ftpguest user in this example.

cp -R ~ftp/usr ~ftpguest/usr
cp -R ~ftp/etc ~ftpguest/etc

At this point you should have the files and programs needed for your
ftpguest user.

** This is dependent upon where the '.' delimiter has been positioned. If
the delimiter is positioned prior to the ftp username then only the root
directory (/home/ftp) needs to contain a /usr & /etc directory structure.
If the delimiter is placed post the username then each individual user
will require this directory structure.

** NOTE: When providing the 'ls' command, use /sbin/ls, not /usr/bin/ls.

7. Another thing I noticed is that you must touch the file /etc/ftpd/ftpgroups.
If you do not, you will see messages in syslog.log indicating that ftpd could
not stat this file.

[nibble]

thanks but, its not actually a guest account. its a normal account. and btw, i dont have root access to the system. what i have is only sam with user creation... i jes wonder if i can restrict the user to his own directory while on ftp.

[Jose Mosquera]

Hi,

Are you in HP-UX 11.0?

In HP-UX 11.0 yo need do:

1) In the /etc/inetd.conf file add "-l" option in the entry:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

2) Reconfigure the Internet daemon:
#inetd -c

3) In the /etc/passwd user definition:
user:NJL6Ik2LGc:96:20::/home/user/./:/bin/sh
The trick here is >/./< definition

4) In the /etc/ftpd/ftpaccess set "guestgroup" name, i.e:
guestgroup ftpguest

5) Define in /etc/group the ftpguest entry adding the "user" related in /etc/passwd file.

6) To allow "list" capacities on the /home/user ($HOME dir of "user" do:

#mkdir -p usr/bin
#chmod -R 555 usr
#cp /sbin/ls /home/user/usr/bin

If you are on 10.20 pls tell me.

Rgds.