how to create one user account which only can ftp and cannot telnet

[Eric Unix]

how to create one user account which only can ftp and cannot telnet

BR
eric

[Suraj K Sankari · Accepted solution]

Hi,

Just edit the last field of that users entry at /etc/passwd file

example
smith:*:100:100:8A-74(office):/home/smith:/usr/bin/sh

make it
smith:*:100:100:8A-74(office):/home/smith:/usr/bin/false

now smith can't login via telnet or ssh.

Suraj

[Ganesan R]

Hi,

Normally user shell is defining where the user should go upon login. If you specify null shell (/usr/bin/false), then that user cannot get any shell.

When you create a user specify null shell.

#useradd -s /usr/bin/false username

[Eric Unix]

Hello Sirs

Thanks for your kind inputs, but i cannot ftp or fstp now after change " :/usr/bin/sh " to " :/usr/bin/false " .

The error show up -->
Fatal : unable to initialise SFTP : could not connect

Please help me

BR
eric

[Taifur]

Hi Eric & Unix,

You can do it from sam and give the user permission for ftp and deiny perpermission for telnet.


Rgds//
Taifur

[Dennis Handly]

>I cannot ftp or fstp now after change to /usr/bin/false.

You'll probably have to include that in /etc/shells.

[Eric Unix]

Hello Dears

Which function in sam , wouldy you kindly give the path of sam . Thanks a lot.

BR
eric

[Eric Unix]

Hello Daniel

How to "You'll probably have to include that in /etc/shells" .

Thanks a lot

[Suraj K Sankari]

Hi,

You can modify this file /etc/shells if /usr/bin/false is not there then open this file and add this line /usr/bin/false
save the file and try...

Suraj

[Suraj K Sankari]

Hi again,

find similar thread in below link.
http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1239877142211+28353475&threadId=957193

Suraj

[Dennis Handly]

>How to "include that in /etc/shells".

Just use vi on that file and add that line. If not there, you'll need to add the default shells:
/sbin/sh
/usr/bin/sh
/usr/bin/rsh
/usr/bin/ksh
/usr/bin/rksh
/usr/bin/csh
/usr/bin/keysh

You may want to leave out those r* shells. (And the scummy C shell, just to discourage it's use. ;-)

[Ganesan R]

Hi Eric,

Steps are little different for sftp. If you are using sftp use the shell opt/ssh/utils/sftponly instead of /usr/bin/false.

entry in password file should look like this..

user1:x:149:20:SFTP only user:/home/user1:/opt/ssh/utils/sftponly

[James R. Ferguson]

Hi:

> How to "You'll probably have to include that in /etc/shells" .

You might be amazed how questions like this can be answer by querying the manpages.

# man shells

...offers the principal insight, and following its "see also" references:

# man man getusershell

...tells you even more!

Regards!

...JRF...

[Eric Unix]

Hello ALL

Thanks for all of your help, and it work now . But if i want to user sftp. I found there are no " opt/ssh/utils/sftponly " in my current system. How to make it available ?

BR
thanks a lot.

ERIC

[James R. Ferguson]

Hi (again):

> I found there are no " opt/ssh/utils/sftponly " in my current system. How to make it available ?

If you have Secure SHell installed you should have this:

# swlist|grep -i "secure shell"
T1471AA A.05.10.006 HP-UX Secure Shell

If you need this, then see:

http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

Regards!

...JRF...

[UVK]

#touch /opt/ssh/utils/sftponly

and add those users to whom u want to give sftp access to that file

-uvk

[Eric Unix]

Hello All

After add "/opt/ssh/utils/sftponly" in passwd file and touch /opt/ssh/utils/sftponly file

But show up error " access denied " after key in password in sftp tool

Please kidnly help me .

BR
eric

[avizen9]

please go through this doc

http://docs.hp.com/en/B2355-90685/ch02s07.html

[Suraj K Sankari]

Hi,

Are you able to do ssh into the box, if yes then check the file permission which you create now, what is the permission now?

check this also is there any # (hash) mark there in file /etc/ssh/sshd_config

Subsystem sftp /usr/libexec/openssh/sftp-server

Suraj

[Ganesan R]

Hi Eric,

Just touch the file is not enough.

#swlist |grep -i secure
T1471AA A.04.50.009 HP-UX Secure Shell

It should list like above. If not I would advice you to download and install HP secure shell from here..

http://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA

That will create all the necessary files for you.