ftp login

[Chakravarthi]

hi,

i want to create a account in a redhat linux box which is used only for ftp(wu-ftp) purpose and i should not be able to login using telnet or ssh using this login.

please give suggestions.

regards
chakri

[kcpant]

hi,

you can edit allow & deny entries of the services you want to be given access or restriction for specific user.

[Ivan Ferreira]

Use /bin/false or /sbin/nologin as the user shell (depends of which one exist on your system). Ensure that the shell selected is included in /etc/shells.

[Alexander Chuzhoy]

Use useradd -s /sbin/nologin "username"
when you create users for FTP logins.

[Chakravarthi]

hi,

sorry i forgot to mention that i'm using sftp not ftp, and given solution is not working for sftp.

any more suggestions?

-chakri

[Ajay Agarwal]

You can create an ftpuser minus shell. Check out the details at the following url:

http://www.linux.com/guides/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/chap29sec295.shtml

[Sergejs Svitnevs · Accepted solution]

You should build chrooted environnment for sftp, create a new user and change their shell to restricted ssh.

Check out the following link:
http://gentoo-wiki.com/HOWTO_SFTP_Server_(chrooted,_without_shell)

Regards,
Sergejs

[Ivan Ferreira]

You said wu-ftpd first, but anyway, to do that, you must use public key authentication.

After you created your public key pairs, copy id_dsa.pub to the remote host in $HOME/.ssh/authorized_keys. Once you get public key authentication working, edit the authorized_keys file and add the command= option before the key, like this:

command="/usr/local/sbin/ssh-dummy-shell" ssh-dss AAAASDF.....


Create the ssh-dummy-shell script:

if [ "$SSH_ORIGINAL_COMMAND" = "/usr/libexec/openssh/sftp-server" ]
then
/usr/libexec/openssh/sftp-server
else
echo "Restricted"
fi

Change the permissions to the file

chmod 755 /usr/local/sbin/ssh-dummy-shell

Have fun.

[Chakravarthi]

Thank you all for the response
-chakri