Subject: [265] Re: [263] Question about ftponly

From: [email-masked] (Rand S. Huntzinger)
Date: Wed, 03 Aug 1994 15:47:30 +0500

> From [email-masked] Wed Aug  3 15:41 EDT 1994
> Date: Wed, 03 Aug 1994 15:33:54 -0300
> From: Dirce Richards <[email-masked]>
> Subject: [263] Question about ftponly
> To: [email-masked]
> Cc: [email-masked]
> Content-Transfer-Encoding: 7BIT
> 
> 
> I installed wu-ftp version 2.4. I am trying to use "guestgroup".
> I would like to allow members of the guestgroup only ftp access,
> and not rlogin. I would add an entry in passwd such as:
> 
> 	member:<passwd>:uid:gid:Guest:/home/ftp/./member:/etc/ftponly
> 
> But I don't know what the file ftponly should be like. Is it an
> script? What ownership/permissions should it have? 
> 
> Thanks in advance,
> 
> 	Dirce
> 

   I'm using this without /etc/ftponly existing.  This is simply a shell
which won't work so that the ftp only user won't be able to use the account
to login to the system as a non-ftp user.  If you like, you could create an
executable which would print a "You're not allowed to do that" message.

					Randy Huntzinger

---

From: [email-masked] (Jeremy Foot)
Date: Thu, 04 Aug 1994 08:43:40 -0300 (BST)

The whole point is that the shell for a guest account should NOT exist. The login
programme will fail to find it and hence refuse the login attempt ( thus 
preventing rlogins etc). You must however include an entry '/etc/ftponly' in the
file /etc/shells, otherwise you will still be refused entry by wuftpd.

Hope this helps
	Jeremy

---

From: [email-masked] (Jerry Scoggins)
Date: Mon, 08 Aug 1994 00:55:27 -0700

>Hi,
>how about  member:<passwd>:uid:gid:Guest:/home/ftp/./member:/bin/sh
>and a ~user/.profile like this: exit
>It works! 
>Only FTP-access.
>BTW: the ~user/.profile should not be writable by the user :-).
>Bye.

For safety, don't do this.  
The proper way is to edit /etc/shells to include /bin/false
Then change the command from /etc/ftponly to /bin/false in the /etc/passwd
file.  This is the recommended method and is rock solid.

++jerry(); // [email-masked]