Subject: [585] User Logins

From: Richard Wykes <[email-masked]>
Date: Wed, 26 Oct 1994 10:04:32 +0000 (GMT)

How can I set a seperate user logins other than anonymous but not let 
them be able to login via telnet ?

Richard Wykes

Site Supervisor
Computer Services
University College of Ripon & York St John
Ripon, North Yorkshire, England

---

From: [email-masked] (Judith Pellerin)
Date: Wed, 26 Oct 1994 06:00:09 -0400

On Oct 26, 10:04am, Richard Wykes wrote:
> Subject: [585] User Logins
>
>-- End of excerpt from Richard Wykes

Richard -

We use a 'secure' FTP setup that sounds like what you want. The passwd file
setup looks like this:

jdoe:xxxxxxxx:1115:9999:JohnDoe,,,,,,,:/usr/spool/ftp/./:/bin/false

This dumps John off in the ftp area when he comes in under ftp (you could have
him go directly to a specific subdir by adding the path as his home dir) and it
won't allow him to telnet in (no shell).

You must put the /bin/false entry in /etc/shells..

Also, make sure you define 9999 in /etc/group (i.e. staff::9999) and enter that
group name as guest group in your ftpaccess file (guestgroup staff).

This is great for new users who don't need to wander around the machine, and
pretty secure because you can require a userid and password and restrict group
access...the downside I've found is that since the users have no shell, they
can't change their own passwords (and you can't force that as a matter of
security), and they can't delete aging or unused files. Overall, that's been a
small price to pay, since it simplifies our requirement for a secure FTP site
for *very* novice users.

I hope I haven't forgotten anything...hope this helps...

judy

UNIX Systems Manager
Office of Space Access and Technology
NASA
email: [email-masked]

---

From: [email-masked] (Tim Morley)
Date: Wed, 26 Oct 1994 12:55 +0000 (GMT)

> them be able to login via telnet ?

The simplest way to do this, is to create a standard user account, but
set the shell to be a program that doesn't let them in. If you don't
want anything clever just putting /bin/true as their shell will stop
them logging in. If you wanted to be more clever (say print them a
message talling them why it doesn't work), you might have to write a
program that does this, if you do so though you should be care to make
sure it is impossible for the user to interupt this in a way that
might compromise the security.

Tim