RE: Best methods for preventing SSH allowing FTP

From: Troy Settle (troy_at_psknet.com)
Date: 08/20/03

  • Next message: Scott Gerhardt: "Re: Best methods for preventing SSH allowing FTP" 
    To: "'Blake Swensen'" <blake@pyramus.com>
Date: Wed, 20 Aug 2003 14:18:21 -0400

    Once upon a time, I used /usr/bin/passwd as the shell (users could
    telnet/ftp in to change their passwords). I then started using
    /usr/bin/false. I now use /sbin/nologin.

    On my primary mail and ftp machines, I no longer use the system passwd
    facility to manage user accounts, it's all in a MySQL database, which my
    billing software manages directly using ODBC. 

    --
  Troy Settle
  Pulaski Networks
  http://www.psknet.com
  540.994.4254 ~ 866.477.5638
  Pulaski Chamber 2002 Small Business Of The Year
  
> -----Original Message-----
> From: owner-freebsd-isp@freebsd.org 
> [mailto:owner-freebsd-isp@freebsd.org] On Behalf Of Walter Hop
> Sent: Wednesday, August 20, 2003 2:09 PM
> To: Blake Swensen
> Cc: FreeBSD ISP List
> Subject: Re: Best methods for preventing SSH allowing FTP
> 
> [in reply to blake@pyramus.com, 20-8-2003]
> 
> > Anyone have suggestions for the best methods for locking an 
> account so
> > that a user or a group can only ftp/POP/IMAP and prevent all other
> > access.
> 
> We make use of two special shells to limit access and make it 
> more clear
> what an account is used for. These are just shell scripts:
> 
> /usr/local/bin/ftponly
> /usr/local/bin/mailonly
> 
> They just contain something like this:
> 
>     #!/bin/sh
>     echo "No SSH login allowed."
>     exit 1
> 
> For FTP accounts, we set the user's shell to /usr/local/bin/ftponly.
> The FTP daemon by default checks if the shell is in 
> /etc/shells so we have
> added the ftponly shellscript to /etc/shells. When people 
> would SSH in,
> they'd get the "No SSH login allowed" message.
> 
> For mail accounts, we set the user's shell to /usr/local/bin/mailonly.
> We have not added this shell to /etc/shells, so FTP and SSH login are
> disallowed while our mailserver (uw-imap and pop3) does not care about
> this. The 'mailonly' shell is never executed, it is just there to make
> administration easier.
> 
> cheers,
> walter
> 
> _______________________________________________
> freebsd-isp@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-isp
> To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
> 
_______________________________________________
freebsd-isp@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-isp
To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
  • Next message: Scott Gerhardt: "Re: Best methods for preventing SSH allowing FTP"

    Relevant Pages

    • Re: How do I disable shell access but allow FTP and E-mail?
      ... I want to create seperate user accounts for Shell access ... > accounts for unencrypted activities (FTP and E-mail) and a seperate ... It's a remotely hosted dedicated server, ...
      (comp.os.linux.security)
    • How do I disable shell access but allow FTP and E-mail?
      ... I want to create seperate user accounts for Shell access ... and for FTP and E-mail access. ... account for SSH logins. ...
      (comp.os.linux.security)
    • Re: ftp nologin problem
      ... 530 Login incorrect. ... tell me how can I correct this problem cause I don't want to give user a shell. ... accounts can be used with FTP. ... rsync or scp over ssh. ...
      (freebsd-questions)
    • Re: Titel neben =?UTF-8?B?TWVuw7wgc3RhdHQgZGFyw7xiZXI6IEV1cmUgQmV3ZXJ0dW5nPw==?=
      ... das ist reine Haarspalterei. ... Manche FTP Server erlauben es, "virtuelle Verzeichnisse" zu bauen - also ... Shell und in der Shell führt der Client dann irgendwelche Befehle ... Das ist aber unabhängig von ssh und funktioniert z.B. mit rsh ...
      (de.comp.os.unix.apps.kde)
    • Re: Only an ftp account
      ... > You may also want to add that user to /etc/ftpchroot which will chroot ... >> How would I be able to give an account to someone where they can only ... >> login and use FTP? ... Let me just point out that just changing the shell to /sbin/nologin ...
      (FreeBSD-Security)