Re: Best methods for preventing SSH allowing FTP

From: Scott Gerhardt (scott_at_g-it.ca)
Date: 08/20/03

  • Next message: gstein_at_lyra.org: "received your email" 
    Date: Wed, 20 Aug 2003 14:32:49 -0600
To: Walter Hop <freebsd@walter.transip.nl>, Blake Swensen <blake@pyramus.com>

    What about using /sbin/nologin and
    /etc/login.access with the following entry (or similar):
    -:ALL EXCEPT wheel:console
    -:ALL EXCEPT wheel:ALL

    This will deny shell access to all but wheel. Of course, you can add other
    groups to make security more granular. The login.access provide a little
    more security if you forget to set a "nologin" shell for an user.

    Cheers,

     --
    Scott Gerhardt, P.Geo.
    Gerhardt Information Technologies [G-IT]

    On 8/20/03 12:09 PM, "Walter Hop" <freebsd@walter.transip.nl> wrote:

    > [in reply to blake@pyramus.com, 20-8-2003]
    >
    >> Anyone have suggestions for the best methods for locking an account so
    >> that a user or a group can only ftp/POP/IMAP and prevent all other
    >> access.
    >
    > We make use of two special shells to limit access and make it more clear
    > what an account is used for. These are just shell scripts:
    >
    > /usr/local/bin/ftponly
    > /usr/local/bin/mailonly
    >
    > They just contain something like this:
    >
    > #!/bin/sh
    > echo "No SSH login allowed."
    > exit 1
    >
    > For FTP accounts, we set the user's shell to /usr/local/bin/ftponly.
    > The FTP daemon by default checks if the shell is in /etc/shells so we have
    > added the ftponly shellscript to /etc/shells. When people would SSH in,
    > they'd get the "No SSH login allowed" message.
    >
    > For mail accounts, we set the user's shell to /usr/local/bin/mailonly.
    > We have not added this shell to /etc/shells, so FTP and SSH login are
    > disallowed while our mailserver (uw-imap and pop3) does not care about
    > this. The 'mailonly' shell is never executed, it is just there to make
    > administration easier.
    >
    > cheers,
    > walter
    >
    > _______________________________________________
    > freebsd-isp@freebsd.org mailing list
    > http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org" 

    -- 
Scott Gerhardt, P.Geo.
Gerhardt Information Technologies [G-IT]
_______________________________________________
freebsd-isp@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-isp
To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
  • Next message: gstein_at_lyra.org: "received your email"

    Relevant Pages

    • Re: Help: tar & find
      ... >> characters with syntactic significance to the shell. ... > archievs with that time stamp. ... Gerhardt Information Technologies ...
      (freebsd-questions)
    • Re: Crash upon accessing View menu in Windows Explorer
      ... if the same thing happens with another admin account it may ... > 1) The problem occurs not just in Windows Explorer and My Computer, etc., ... > 4) I checked which Shell Extensions (using the Shell Viewer program you ... > similar Shell Extension called $Address, ...
      (microsoft.public.windowsxp.general)
    • Re: Crash upon accessing View menu in Windows Explorer
      ... own account. ... I checked which Shell Extensions (using the Shell Viewer program you ... similar Shell Extension called $Address, also a Shell Browser UI ...
      (microsoft.public.windowsxp.general)
    • RE: User?s and Shells
      ... the shell as well the password for an account. ... Disabling the password makes ... The ideal solution is to have a binary program for the account shell ... defense in depth/layers is the key to security. ...
      (Focus-Linux)
    • Re: Only an ftp account
      ... > You may also want to add that user to /etc/ftpchroot which will chroot ... >> How would I be able to give an account to someone where they can only ... >> login and use FTP? ... Let me just point out that just changing the shell to /sbin/nologin ...
      (FreeBSD-Security)