restricting ftp access

[djc_1]

Hello,
I would like to restrict the use of ftp to certain users on the system.

I know one approach is to put all the users that I don't want to have access in /etc/ftpd/ftpusers , however I would prefer to take the approach of making no one be able to use ftp and then allowing specific users to have access. This will stop me having to update /etc/ftpd/ftpusers everytime a user is added to the system.

I have looked at /etc/ftpd/ftpaccess and cannot see an obvious way of making the change as I want.

Can anyone suggest:
1)Is it possible to restrict ftp access in the way I want
2)If so how do you do it

Thanks in advance

[Richard Hepworth]

Hi,

You could run a job daily to add all users in /etc/passwd to the ftpusers file and exclude those that are allowed, by cross referencing your own 'allowed' list of users from a file.

regards,

Richard

[Court Campbell]

# man ftphosts

[Tim Nelson]

Part of my user create script is to add that user to the ftpusers file.

Another check I also had was to run a script on occasion to make sure specifs users by group were in the ftpusers file.

Many ways to skin the cat...

[Reshma Malusare]

Hi,

1] /etc/ftpd/ftpaccess --> configuration file is the primary configuration file for defining how the ftpd daemon operates. It is not necessary to enable the ftpacess file inorder to run ftpd. The configuration files allow you to configure FTP features, such as the number of FTP login tries permitted, FTP banner displays, logging of incoming and outgoing file transfers, access permissions, use of regular expressions, etc.

2] Now you dont want to go for /etc/ftpd/ftpusers --> Restricts FTP access for specified users. This file shows entries which dont have access for ftp.
deny ftp access to selected users.


3]so check /etc/ftpd/ftphosts -->Lets you allow/deny FTP account access according to source IP addresses and host names.

4]/etc/ftpd/ftpgroups -->The group password file for use with the SITE GROUP and SITE GPASS commands


YOu go for third option here......

Thanks & Regards
Reshma

[djc_1]

Hello,
It looks like ftphosts is the way foreward. I have looked at the man page put could do with a bit more documentation on

1) how wildcards work

2) how allow and deny, in particular I assume that if I have allow such and such user from such and such host everything else is denied and if I use deny, everying that is not specied is allowed

3) how ftphosts is affected by other files, i.e does ftphosts overrule ftpusers

Is the documentation from the wuftp website relevant or is there specific hpux documentation?

Thanks you for your help so far

[paolo barila]

Hi,
consider using proftpd, a highly configurable GPL-licensed FTP server software

downloadble freely from hp as part of

"Internet Express for HP-UX"


Pablo

[Court Campbell]

I believe you can remove ftpusers. then in the ftphosts file put:

allow user1 *
allow user2 *
allow user3 *
deny * *

Try it and see.

[Stefan Mirevski]

Just a small feedback to the suggested solution.

I had a similar problem and adding

/etc/ftpd/ftphosts

with:

allow user1 *
allow user2 *
allow user3 *
deny * *

worked excellent!

I guess I cannot grant points, but at least I can give this technical feedback and say:
Thanks to all who continuously take care to help via this forum!!!