ftp with restricted shell 11.X

[Ron Van Cleave]

Hi,

We would like to limit ftp user access to
the applicable home directory and below.

My understanding is that this can be done
via the restricted shell and ./ home
directory via the /etc/passwd file.

The above works for a login session using
a rsh shell type, however the ftp session
still has the ability to ftp up the directory
structure.

So, the shell has been change to /usr/bin/ftponly
so as to only allow ftp access, however this
scenario still allows the ftp session to cd
up the directory structure.

Here's an example entry from /etc/passwd
ftpuser:*:UID:GID:,,,:/home/ftpbp/./ftpuser:/usr/bin/false
or
ftpuser:*:UID:GID:,,,:/home/ftpbp/./ftpuser:/usr/bin/rsh

We have not incorporated the ftpaccess file
in that we do not want to restrict all users
to a specific list of directories.

Has anyone experienced similar results or
any suggestions as to whet we might be missing

Thanks Ron.

[Victor BERRIDGE]

Hi,
look at the man page for "ftpaccess".

Best regards

Victor

[Vincenzo Restuccia]

See http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90685/B2355-90685_top.html&con=/hpux/onlinedocs/B2355-90685/00/00/14-con.html&toc=/hpux/onlinedocs/B2355-90685/00/00/14-toc.html&searchterms=ftpaccess&queryid=20010419-081457

[Ron Van Cleave]

Not attempting to do this via ftpaccess
in that it is our understanding that
this will restrict all access to a
specified list of users?

Is this an incorrect understanding?

[Joseph C. Denman]

you can still set it up where other users can have full access through ftp. Just because you restrict one does not mean you have to rescrict all.

ftpaccess is what you need to setup to do what you are attempting to do.

man 4 ftpaccess


...jcd...

[Ron Van Cleave]

The ftpaccess worked to restrict the ftp
login's so that they are unable to
traverse the filesystem.

Specifically the entry:
# Specify which group of users will be
# treated as "guests".
# NOTE: groupname must be a real group
# name in the real system file
# /etc/group.
guestgroup ftpgroup

It seems that the combination of the
passwd, restricted shell and ftpaccess
file configuration that results in the
desired functionality

The manpage as usual is not intuitively
helpful for newbies, so was able to find
some example ftpaccess files and those
helped to clarify the specifics of the
various constructs.

See http://web.hpl.hp.com/services/rcsweb/techs/post-host/ftp/ftpaccess.html

Thanks for the help.

Ron.

[Christopher Caldwell]

ftp on 11.X classes users.

You're either real, guest, or anonymous.

Use the /etc/group file to discriminate among the users.

For the folks who need full access, class them as real. For the folks that need to be chroot'd, make the guests using the guestgroup directive. The server will chroot to their home directory.

Set up their directories like
/home/./user

don't forget to copy /sbin/ls to /home/bin/ls if you want these folks to get directory listings.