Subject: [291] Re: [289] Re: [263] Question about ftponly

From: Jon Hamilton <[email-masked]>
Date: Fri, 05 Aug 1994 04:57:41 -0500

>> and not rlogin. I would add an entry in passwd such as:
>> 
>> 	member:<passwd>:uid:gid:Guest:/home/ftp/./member:/etc/ftponly
>> 
>> But I don't know what the file ftponly should be like. Is it an
>> script? What ownership/permissions should it have? 
>> 
>Hi,
>how about  member:<passwd>:uid:gid:Guest:/home/ftp/./member:/bin/sh
>and a ~user/.profile like this: exit
>It works! 

It does, but only so long as the user isn't very intent on gaining access.
Much better would be to put /etc/ftponly in /etc/shells, and make it a c
program which does nothing but an exit().  

>Only FTP-access.
>BTW: the ~user/.profile should not be writable by the user :-).

That's not the concern.  If the user has write permission in his/her
home directory, he/she can overwrite the file with whatever he/she
pleases.

--
+----------------------------------------------------------------+
|   Jon Hamilton  [email-masked] | [email-masked]      |
|   CS Solaris Systems Support Group, Iowa State University      |
+----------------------------------------------------------------+

---

From: [email-masked]
Date: Fri, 05 Aug 1994 15:02:48 +0200 (MDT)

...
> home directory, he/she can overwrite the file with whatever he/she
Of course no write permissions to the home-directory too.
Perhaps directorys below...

Do someone see a security-risc?

-- 
    			          ? \!/ ?
                                   (o o)
-------------------------------oOOo-(_)-oOOo----------------------------------
1stName Name  : Slobodan Gavric     ._      Organ.:Heinrich-Heine-Universitaet
Phone (Voice) : +49 211 3113916     o<o     E-Mail :
Town :40225 Duesseldorf,Germany               [email-masked]