Prevent passwd file from being copy

[yc_2]

Hi,

Is there a way to prevent the password file being copied or ftp ?

If not possible, is there a way to trap who has ftp or copied this file and get notify ?

Any advise is apprecaited.


Rgds,
YC

[Vinit Adya]

Hi,
You could use tsconvert to convert the system to a trusted system and the passwords are moved to a TCB area.
This will also enable other features as password lifetime etc.

[Madhu Sudhan_1]

Leong:
I completely agree with Adya. You need to make the system a Trusted System to prevent users to read the /etc/passwd file. Once the System is converted to a trusted system a protected password database at /tcb/files/auth gets created and a a "*"
replaces the password field in /etc/passwd.
For a detailed information on adminstering trusted system, here is the URL.

http://docs.hp.com/cgi-bin/onlinedocs.py?mpn=B2355-90121&service=hpux&path=../B2355-90121/00/00/1&title=Administering%20Your%20HP-UX%20Trusted%20System

Enjoy !
......Madhu

[Andreas Voss]

Hi,

to have full information about ftp sessions edit the /etc/inetd.conf:
Change the line:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l
TO:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -v
Now reinitialize inetd with: inetd -c
After this you get all ftp commands and files logged in /var/adm/syslog/syslog.log

Regards

[yc_2]

Hi Andreas,

Thanks for your advise.

Is there a way to know what files being down loaded because the syslog.log only capture the ftp login name but not the name of the files that being down loaded.



Rgds,
YC

[Andreas Voss]

Hi,

if you have added the -v option in /etc/inetd.conf at ftp line and reinitialized inetd with inetd -c you get a complete list what a user has done in a ftp session, looks like:
Oct 24 09:28:33 hpk2202 ftpd[7175]: connection from PC203 at Tue Oct 24 09:28:33 2000
Oct 24 09:28:33 hpk2202 ftpd[7175]: FTP LOGIN FROM PC203, voss
Oct 24 09:28:33 hpk2202 ftpd[7175]: FTP: cwd /baan/FT/RETRIEVAL
Oct 24 09:28:33 hpk2202 ftpd[7175]: PORT
Oct 24 09:28:33 hpk2202 ftpd[7175]: FTP: retrieve ftp.out
Oct 24 09:28:34 hpk2202 ftpd[7175]: FTP: delete ftp.out
Oct 24 09:28:34 hpk2202 ftpd[7175]: User voss logged out

As you can see the user changed to dir /baan/FT/RETRIEVAL (cwd), copied the file ftp.out (retrieve) and finally removed that file (delete).

Regards

[yc_2]

Hi Andreas,

It works in ver 10.20 but not in 11.00. Does it required any patches ?

[Andreas Voss · Accepted solution]

Hi,

on HP-UX 11.00 use instead -l -L:
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -L -v

Regards

[Darren Miller]

Leong,

At HP-UX 11, a new version of ftp was released, which includes a config file called /etc/ftpd/ftpaccess that allows you to both deny ftp access to /etc/passwd and log all files uploaded and downloaded from your server. Here's what you need to do:

1) Add a "-a" to the end of the ftp line in /etc/inetd.conf.

2) Force inetd to re-read it's config file: inetd -c

3) Create the /etc/ftpd/ftpaccess file with the following lines:

class everyone real,guest,anonymous *
noretrieve /etc/passwd
log transfers anonymous,guest,real inbound,outbound
log commands anonymous,guest,real

This will keep a log of all commands and files accessed via ftp. The commands are logged in /var/adm/syslog/syslog.log, and the files, I think, are logged in /var/adm/syslog/xferlog.

There is much more you can do in ftpaccess. For more information, see the man page for ftpaccess and ftpd. Also take a look at the sample ftpaccess file in /usr/newconfig/etc/ftpd/ftpaccess.

Hope that helps!



both of the