managing TCP/IP-Tools on per user level

[Martin Christov]

Hello,
is it possible to allow or disable for all configured users the usage of ftp, tftp, telnet, rlogin, remsh, rcp etc under HPUX-11.00?
Regards:
Martin

[Herve BRANGIER]

Hi

For ftp you can use /etc/ftpusers. For others
services I don't know how to do at user level.
See /var/adm/inetd.sec for network level.

HTH

Herv?

[Martin Christov]

I am familiar with the functionality of WU-ftpd under HPUX. You are right.

/var/adm/inetd.sec allows management only at host-level:

I don't think that you can entry usernames there...?

[Ralf Hildebrandt]

You can use tcp_wrappers to restrict access on a per-user basis.

[Martin Christov]

Hello Ralph,
where can I get tcp_wrappers (exe or source) for HPUX-11.00?

[James R. Ferguson]

Hi Martin:

You can get tcp_wrappers from here:

ftp://ftp.porcupine.org/pub/security/index.html

...JRF...

[Bill Thorsteinson]

The above solutions apply to denying incoming use of
the tools. For outgoing use you can restict the access
privileges of tools. A command like
chmod 750 `which ftp`
will disable use of the command for most users. mode
700 will allow only the owner to execute the command.

Firewalls can be used to limit the reach of these commands.