Subject: [365] SUMMARY: Question about ftponly

From: Dirce Richards <[email-masked]>
Date: Tue, 16 Aug 1994 11:16:50 -0300

My original question was:

I installed wu-ftp version 2.4. I am trying to use "guestgroup".
I would like to allow members of the guestgroup only ftp access,
and not rlogin. I would add an entry in passwd such as:

	member:<passwd>:uid:gid:Guest:/home/ftp/./member:/etc/ftponly

But I don't know what the file ftponly should be like. Is it an
script? What ownership/permissions should it have? 

Thanks in advance,

	Dirce
========================
Most suggestions were unanimous, in adding /etc/ftponly in the /etc/shells.
A suggestion to create ~user/.profile was not advised. I used the first
idea, and it worked.

You can use /etc/ftponly, as above. Simply add a line to /etc/shells like:
/etc/ftponly

and it should work. Or, as another user suggested to me, which I have
implemented, use /bin/false and put _that_ in your /etc/shells. Then they
won't be able to get a login, either. 
----------
   I'm using this without /etc/ftponly existing.  This is simply a shell
which won't work so that the ftp only user won't be able to use the account
to login to the system as a non-ftp user.  If you like, you could create an
executable which would print a "You're not allowed to do that" message.

------------
The whole point is that the shell for a guest account should NOT exist. The login
programme will fail to find it and hence refuse the login attempt ( thus 
preventing rlogins etc). You must however include an entry '/etc/ftponly' in the
file /etc/shells, otherwise you will still be refused entry by wuftpd.

It does, but only so long as the user isn't very intent on gaining access.
Much better would be to put /etc/ftponly in /etc/shells, and make it a c
program which does nothing but an exit().  
------------
>Only FTP-access.
>BTW: the ~user/.profile should not be writable by the user :-).

That's not the concern.  If the user has write permission in his/her
home directory, he/she can overwrite the file with whatever he/she
pleases.
----------
how about  member:<passwd>:uid:gid:Guest:/home/ftp/./member:/bin/sh
and a ~user/.profile like this: exit
It works! 
Only FTP-access.
BTW: the ~user/.profile should not be writable by the user :-).
Bye.
------------------
For safety, don't do this.  
The proper way is to edit /etc/shells to include /bin/false
Then change the command from /etc/ftponly to /bin/false in the /etc/passwd
file.  This is the recommended method and is rock solid.

======================================
Thanks to all who responded!

[email-masked] (Patrick Salsbury)
[email-masked] (Jerry Scoggins)
[email-masked]
Jon Hamilton <[email-masked]>
[email-masked] (Jeremy Foot)
[email-masked] (Rand S. Huntzinger)