Restrict Ftp only user access and directory access

[Todd McDaniel_1]

Okay, I have a situation where I have a box with securID logins but we have a few "mechanized IDs" used by our application for FTP purposes. However, those ids do have passwords which means they can be su'ed over to if you know they password. So far as I know the password cant be restricted to any great degree.


My question is this. we were going to try the login shell /bin/false but I have never used that before. Any suggestions on that?

Also, My other question is how to restrict the user to their Home directory but allow ftp access to other directories. Is that even possible?

All suggestions are welcome.

[Sridhar Bhaskarla · Accepted solution]

Hi Todd,

As long as you use /bin/false as the shell and add it as a valid shell in /etc/shells file, you should be ok.

They will not be able to SU to these accounts but they will be able to ftp.

For more restrictions, use 'ftpaccess' file. It will be enabled if you add -a flag to ftpd line in inetd.conf. Man 'ftpaccess' for more information.

-Sri

[Todd McDaniel_1]

In the past we had used /bin/nologin to FORCE su to the mech Id if it was used to track folks' access to it.

But an adventurous user ventured into a few other dirs he shouldn't have.

[Steven E. Protter]

/bin/false

Will completley make the user id useless for su - access.

To restrcit ftp access, consider using chroot to make the home directory the root directory for the user. You will need to put some basic binaries in the home directory to maintain ftp functionality.

SEP

[Todd McDaniel_1]

Thanks Guys,

I think ftpaccess is the way to go. It will do what Steve talked about and I wont have to move any exes to /.