FTP Processes /etc/passwd Command

[Craig Johnson_1]

On one 11.11 machine I have, if I put /usr/bin/false in there, not only does login not work but either does FTP.

Why would ftp process that field? On other 11.11 servers I see the desired behaviour, which is no login but ftp allowed.

[Bill Hassell · Accepted solution]

This is correct behavior. The ftpd daemon 'validates' a login by checking the userID in /etc/passwd and seeing if the shell for the user is 'standard' or listed in the file: /etc/shells. The man page for shells covers this file's format. The file is normally not present--you have to create it if you want non-standard shells. The starting point for /etc/shells is found in the man page for getusershell:

/sbin/sh
/usr/bin/sh
/usr/bin/rsh
/usr/bin/ksh
/usr/bin/rksh
/usr/bin/csh
/usr/bin/keysh

Just add /usr/bin/false to the list and not ftp login will work.

[Craig Johnson_1]

Thanks - I got talking with another admin last night who told me the same thing. I'm a little rusty after a year of not really doing pure admin work, and though when I build two servers recently and remembered /etc/shells, I completely skipped on it here. Thanks!

Craig