Securing FTP

[David Goza]

We allow some of our users to ftp from Windows 98 into
our HP 9000 to download files into Excel or Word. Is there a way I can restrict their FTP access to only certain files or directories. Right now they, when they log in to FTP, it takes them directly to certain directories, but they have full access to other areas. Does any one know how to change that?

[linuxfan]

Hi David,

Look at the doc Richard mentions in this thread, gives you step by step method
http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0xc9398ffa98a2d5118ff10090279cd0f9,00.html

-Regards
Ramesh

[Joseph C. Denman]

What version of HPUX are you using?

11.0 and above, you can set up a ftpaccess file.

man ftpaccess

10.xx, I would recommend downloading wu-ftp.

...jcd...

[Santosh Nair_1]

Make sure that you start up the ftpd daemon with the -a option in /etc/inetd.conf. Then set up /etc/ftpd/ftpaccess with the chroot option for your users (see the ftpaccess man page).

Hope this helps.

-Santosh

[Sanjay_6]

Hi David,

Have a look at these threads. Might help.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0x4c6d46ff9277d511abcd0090277a778c,00.html

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90685/B2355-90685_top.html&con=/hpux/onlinedocs/B2355-90685/00/00/14-con.html&toc=/hpux/onlinedocs/B2355-90685/00/00/14-toc.html&searchterms=ftpaccess&queryid=20010613-090738

hope this helps.

thanks

[Kevin Wright]

check out http://www.wu-ftpd.org/
this will give you step by step instructions for chrooted users and anonymous ftp..On hpux /sbin/ls is static, so the configuration is quite simple as apposed to other flavors of unix.

[David Goza]

Thanks for all the help, but I need some clarification. After reading through all the material, I can only conclude that you can give a user access to only 1 (one) directory branch setup. Is this correct? What I really need is to give a user access to more than one directory branch - our Live and our Test area but not let them ftp into any thing else. Can this be done???

[Joseph C. Denman]

I believe you can create links under his home to the dirs you need him to travel.

...jcd...

[Sharon Prothero]

Instead of allowing anonymous ftp access why not give the users unix login accounts (or one to share) & then restrict what they can see using normal file permissions and/or access control lists?

[Ovidiu D. Raita]

I'd have to disagree with Joseph: you cannot "escape" from the chroot directory even by creating links. The link is just and entry in the directory, is interpreted as text and appended to the chroot directory.

For example if the chroot dir is /home/ftp
and you run
ftp> cd other_dir
which is a link to /root/other_dir
then ftp will be looking for /home/ftp/root/other_dir
and not for
/root/other_dir as you would think.

You can do a short test just to verify this behaviour.

If you are able to reorganize the file systems a little bit you could create links to the chroot subdirectories (not from them to another directory).

Ovidiu