How to Create Restricted FTP User

[Sial_1]

Hi All,

i want to create restricted ftp user that user only able to ftp system and has access to only one directory (spose xyz) and subfolders of that directory, Cant browes any other directories of system and can not access system other than ftp. OS is OpenVMS 7.3-2

Thanks in Advance.

[Jan van den Ende]

Sial,

- create a username in a UIC group of only that user
- set that user /NOACCESS/NETWORK
- (of course, only TMPMBX & NETMBX privs, default & authorized)
- create a topdirectory for, and owned by, that user, set device & directory for the username to that directory
If the "normal" VMS protections are in effect on the system, (ie, WORLD: ) he can not reach any other directories.

-- if the system has (lots of ?) topdirectories with WORLD ACCESS permitted, then give (add to ?) those topdirectories an ACL specifying the username with ACCESS=NONE

That's all.

hth

Proost.

Have one on me.

jpe

[Karl Rohwedder]

The HGFTP FTP server (available on the freeware CD) can run in parallel to your standard FTP server. It allows to fine tune ftp clients as to which directories they may access and to what commands are available to them.

regards Kalle

[Willem Grooters]

Perhaps not exactly what you intend, but it works on my systems:

* Enable anonymous FTP. That will create a very restricted user in SYSUAF that will have no access to any location outside his login directory except the ones below.
* You are free to change default device and directory in SYSUAF to some 'safe' place if you wish. It simply works the same way.
* Set file ownership in that directory to any user you want - but NOT this anonymous user (and preferably, a non-system user).
* Set file protection S:RWE,O:RWE,G:,W:RE on the directory and all files below.
* You can create any directory tree below that and populate it with downloadble files, be sure to have ownership and protection set as the base directory.
Either a system suer or the owner (as set by you) have WRITE acccess to these directories. Since ANONYMOUS has acecss to just these directories, and is disallowed anywhere else, this user can only retrieve files from this directory.
You could limit access to specific files by specifying W:E on the directories; that will disallow browsing; direct access however of any explicitly named file (just GET, not MGET) will succeed.

I had this implemented on VMS 7.3-2, TCPIP 5.3 and runs up to date without problems. Of course abuse is tried, but FTP did just what I expect it to do in such cases: fail.

[John Gillings]

Sial,

Apart from normal OpenVMS protections - If defined, the logical name TCPIP$FTP_ANONYMOUS_DIRECTORY defines the directories that the FTP ANONYMOUS users are allowed to access.

[Robert Atkinson]

I concur with Karl - use HG FTP, as this allows you to define logicals that give access to a limited set of directories, rather than having to rely on UIC/ACL protection across the whole system.

Rob.