Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 20 Aug 2003 14:32:49 -0600
From:      Scott Gerhardt <scott@g-it.ca>
To:        Walter Hop <freebsd@walter.transip.nl>, Blake Swensen <blake@pyramus.com>
Cc:        FreeBSD ISP List <freebsd-isp@FreeBSD.ORG>
Subject:   Re: Best methods for preventing SSH allowing FTP
Message-ID:  <BB693711.640A%scott@g-it.ca>
In-Reply-To: <8010538263.20030820200924@blue.calx.nl>

next in thread | previous in thread | raw e-mail | index | archive | help

What about using /sbin/nologin and
/etc/login.access with the following entry (or similar):
-:ALL EXCEPT wheel:console
-:ALL EXCEPT wheel:ALL

This will deny shell access to all but wheel.  Of course, you can add other
groups to make security more granular.  The login.access provide a little
more security if you forget to set a "nologin" shell for an user.

Cheers,


 -- 
Scott Gerhardt, P.Geo.
Gerhardt Information Technologies [G-IT]




On 8/20/03 12:09 PM, "Walter Hop" <freebsd@walter.transip.nl> wrote:

> [in reply to blake@pyramus.com, 20-8-2003]
> 
>> Anyone have suggestions for the best methods for locking an account so
>> that a user or a group can only ftp/POP/IMAP and prevent all other
>> access.
> 
> We make use of two special shells to limit access and make it more clear
> what an account is used for. These are just shell scripts:
> 
> /usr/local/bin/ftponly
> /usr/local/bin/mailonly
> 
> They just contain something like this:
> 
>   #!/bin/sh
>   echo "No SSH login allowed."
>   exit 1
> 
> For FTP accounts, we set the user's shell to /usr/local/bin/ftponly.
> The FTP daemon by default checks if the shell is in /etc/shells so we have
> added the ftponly shellscript to /etc/shells. When people would SSH in,
> they'd get the "No SSH login allowed" message.
> 
> For mail accounts, we set the user's shell to /usr/local/bin/mailonly.
> We have not added this shell to /etc/shells, so FTP and SSH login are
> disallowed while our mailserver (uw-imap and pop3) does not care about
> this. The 'mailonly' shell is never executed, it is just there to make
> administration easier.
> 
> cheers,
> walter
> 
> _______________________________________________
> freebsd-isp@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-isp
> To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"


-- 
Scott Gerhardt, P.Geo.
Gerhardt Information Technologies [G-IT]




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?BB693711.640A%scott>