From owner-freebsd-isp Wed Jul 26 9:56: 5 2000 Delivered-To: freebsd-isp@freebsd.org Received: from alydar.infoteam.com (alydar.infoteam.com [207.246.83.5]) by hub.freebsd.org (Postfix) with ESMTP id 44D7C37B713 for ; Wed, 26 Jul 2000 09:56:01 -0700 (PDT) (envelope-from kmartin@infoteam.com) Received: by alydar.infoteam.com (Postfix, from userid 1000) id C3B3A5E1E; Wed, 26 Jul 2000 12:55:56 -0400 (EDT) Date: Wed, 26 Jul 2000 12:55:56 -0400 From: Kenn Martin To: freebsd-isp@FreeBSD.ORG Subject: Re: limiting telnet-users Message-ID: <20000726125556.A87381@alydar.infoteam.com> References: <200007241704.TAA13257@ns1.i-p-d.nl> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2i In-Reply-To: <200007241704.TAA13257@ns1.i-p-d.nl>; from chem@i-p-d.nl on Mon, Jul 24, 2000 at 07:15:04PM +0200 Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, Jul 24, 2000 at 07:15:04PM +0200, chem@i-p-d.nl wrote: > Hi, > > I have been investigating a way to limit telnet-users to their own home-dir. > Problem with chroot is that a lot of dirs would have to be copied to the home- > dir, in order for them to work with telnet. We only give telnet-access to users > that specifically ask for it, because ftp is to limited. I remember a post from > about a year ago, of someone who managed it by setting the permissions of the > home-dirs and the dir above at a specific way, i believe in combination with a > specific umask. Can't find that posting in the archives, though. > > I would love to hear some solutions to this problem and/or some pointers. In conjunction with proper permissions, we use the bash shell for the more privileged users and the restricted version, rbash (or bash -r), for anyone else that we decide to grant telnet access to (though we usually require ssh). You can build bash from /usr/ports/shells. You might evaluate if this matches your needs. From 'man bash': RESTRICTED SHELL If bash is started with the name rbash, or the -r option is supplied at invocation, the shell becomes restricted. A restricted shell is used to set up an environment more controlled than the standard shell. It behaves identi- cally to bash with the exception that the following are disallowed or not performed: o changing directories with cd o setting or unsetting the values of SHELL, PATH, ENV, or BASH_ENV o specifying command names containing / o specifying a file name containing a / as an argu- ment to the . builtin command o importing function definitions from the shell envi- ronment at startup o parsing the value of SHELLOPTS from the shell envi- ronment at startup o redirecting output using the >, >|, <>, >&, &>, and >> redirection operators o using the exec builtin command to replace the shell with another command o adding or deleting builtin commands with the -f and -d options to the enable builtin command o specifying the -p option to the command builtin command o turning off restricted mode with set +r or set +o restricted. These restrictions are enforced after any startup files are read. When a command that is found to be a shell script is exe- cuted (see COMMAND EXECUTION above), rbash turns off any restrictions in the shell spawned to execute the script. Kenn To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message