Linux security: limiting FTP users from logging in with telnet/ssh

Posted on 2001-06-12
Medium Priority
Last Modified: 2010-03-18
Hi there,

I have a linux 6.2 box, for web hosting, and I am using proFTP for users to access their account. Each account is listed as a system user.

I am not wanting to provide shell access via telnet or SSH to any client, but have SSH available for my own login.

I am wondering if there is a location within SSH where I can allow only one login name (I have already disabled root login in SSH) to be able to access the system.

Any tips on this?

Question by:rapidhost
  • 2

Accepted Solution

Haho earned 150 total points
ID: 6184873
to do this,
you should NOT let any ftp users have a valid shell.
for example:

*** ftpweb is a ftp only customer ***

ftpweb:*:1010:400:FTP Account:/home/ftp/ftpweb/./:/etc/ftponly

where upon SSH / telnet login attempts, it will execute "ftponly" script where ftponly script shows a warning message and denies login.

The ftponly script:

# ftponly shell
trap "/bin/echo Sorry; exit 0" 1 2 3 4 5 6 7 10 15
/bin/echo "********************************************************************"
/bin/echo "    You are NOT allowed interactive access."
/bin/echo "     User accounts are restricted to ftp and web access."
/bin/echo "  Direct questions concerning this policy to $Admin."
/bin/echo "********************************************************************"
# C'ya
exit 0

Expert Comment

ID: 6184880
an added protection is to use tcpwrappers, put SSH into inetd.conf and this will allow IP based authentication in addition to username authentication. :)

Author Comment

ID: 6185535
Thanks to both of you for your suggestions!

Featured Post

Train for your Pen Testing Engineer Certification

Enroll today in this bundle of courses to gain experience in the logistics of pen testing, Linux fundamentals, vulnerability assessments, detecting live systems, and more! This series, valued at $3,000, is free for Premium members, Team Accounts, and Qualified Experts.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
If you are looking for an automated solution for backup single or multiple Office 365 user mailboxes to Outlook data file, then you can use Kernel Office 365 Backup & Restore tool. Go through the video to check out the steps to backup single or mult…
Suggested Courses

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question