How to forbid the command ftp > ! /bin/ksh

[Manceau]

Hi,

I want to forbid /bin/ksh when a user is on ftp prompt.

What can I do ?

[harry d brown jr]

Manceau,

What OS are you running?

live free or die
harry

[Bill Hassell]

Using the ! to escape ftp is a server setting. On the server side, look at the ftp daemon configs to forbid shell escape (and perhaps the site and quote commands too).

[harry d brown jr]

In 11.x, I'm not sure you can, but maybe you want to look into using tftp if you can't trust your users? Plus you have the pipe commands, like ls -l "| more", where more allows you to "escape" to a shell.

live free or die
harry

[S.K. Chan · Accepted solution]

You can try this ..

Set the SHELL variable to /bin/false in your user environment. That should restrict the use of all "!" command within ftp.

[Steven Sim Kok Leong]

Hi,

Remove /bin/ksh from /etc/shells will forbid a user with the login shell /bin/ksh from FTP'ing into the system.

Hope this helps. Regards.

Steven Sim Kok Leong

[Christopher Caldwell]

When they run
ftp > ! /bin/ksh

the shell is executed on the local host; thus ftpd server configs aren't in play:

man ftp


! [blah] Invoke a shell on the local host.

I suppose you can do things like restrict users from having a valid shell (/usr/bin/false, /usr/bin/ftponly), but those are generally server side configurations, and I'd have to wonder (if you limit them on the client side), how they got to the ftp command to begin with.

[Manceau]

Thank you for your help.

Philipe MANCEAU.