Restricted FTP access

[vinod_25]

Hi Experts,

I need to create a restricted FTP user with following characteristics:

1. His home directory (/home/ftpuser) should be his root directory. i.e the ftpuser should not be able to move below his home directory.

I have tried adding /./ to his home directory in /etc/passwd but still the user is able to browse below his home directory.

2. The ftpuser should not be able to login to the system. I used the login shell as /usr/bin/false and it worked.

Here is the extract of /etc/passwd:
ftpuser:78MbM5mloIoAw:103:20::/home/ftpuser/./:/usr/bin/false

Please suggest/provide me step by step method of creating a FTP user with restricted access.

I heard that by /etc/ftpaccess entries we can achieve the same. Looking forward for your expert comments and procedures.

Points will be awarded w.r.t my query's solution :-)

Best regds,
Vinod

[Steven E. Protter]

Shalom,

It would be helpful to know your HP-UX release and that you are using the wu-fptd server that is standard.

My answer assumes this.

All you need to do is chroot your users in the ftpaccess file.

You will also have to provide the ls utility so they can list files.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1080103

http://www.bastille-linux.org/jay/blackhat-2002-july-Attacking-and-Securing-Unix-FTP-Servers.ppt

SEP

[john korterman]

Hi Vinod,

I do not think that ftpacces can restrict the user from browsing below his own home directory; cd-restrictions only work upwards.
You would probably have to deny him access by e.g. removing the x-option from directories, but other members may bring better news!

regards,
John K.

[Ivan Krastev · Accepted solution]

See also this kb doc - http://www5.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000083049198


DocID is UARPAKBAN00000806

regards,
ivan

[vinod_25]

Ivan,

Excellent Technical document!!! Served my purpose....

Thank you all for your timely help and direction...


Satisfactorily closing the thread ... Assigning points to all

Vinod

[vinod_25]

Ivan's solution was brilliant and it has step by step process of creating a restricted FTP user