Linux security: limiting FTP users from logging in with telnet/ssh

Hi there,

I have a linux 6.2 box, for web hosting, and I am using proFTP for users to access their account. Each account is listed as a system user.

I am not wanting to provide shell access via telnet or SSH to any client, but have SSH available for my own login.

I am wondering if there is a location within SSH where I can allow only one login name (I have already disabled root login in SSH) to be able to access the system.

Any tips on this?

Thanks!
rapidhostAsked:
Who is Participating?
 
HahoConnect With a Mentor Commented:
to do this,
you should NOT let any ftp users have a valid shell.
for example:

*** ftpweb is a ftp only customer ***

ftpweb:*:1010:400:FTP Account:/home/ftp/ftpweb/./:/etc/ftponly

where upon SSH / telnet login attempts, it will execute "ftponly" script where ftponly script shows a warning message and denies login.

The ftponly script:

#!/bin/sh
#
# ftponly shell
#
trap "/bin/echo Sorry; exit 0" 1 2 3 4 5 6 7 10 15
#
IFS=""
Admin=secure@mydomain.com
#
/bin/echo
/bin/echo "********************************************************************"
/bin/echo "    You are NOT allowed interactive access."
/bin/echo
/bin/echo "     User accounts are restricted to ftp and web access."
/bin/echo
/bin/echo "  Direct questions concerning this policy to $Admin."
/bin/echo "********************************************************************"
/bin/echo
#
# C'ya
#
exit 0
0
 
HahoCommented:
an added protection is to use tcpwrappers, put SSH into inetd.conf and this will allow IP based authentication in addition to username authentication. :)
0
 
rapidhostAuthor Commented:
Thanks to both of you for your suggestions!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.