Subject: [592] Re: [588] Re: [585] User Logins

From: Richard Wykes <[email-masked]>
Date: Wed, 26 Oct 1994 14:35:28 +0000 (GMT)

> Date:          Wed, 26 Oct 1994 06:00:09 -0400
> From:          [email-masked] (Judith Pellerin)
> Subject:       [588] Re: [585] User Logins
> To:            [email-masked]
> Reply-to:      [email-masked]

> On Oct 26, 10:04am, Richard Wykes wrote:
> > Subject: [585] User Logins
> >
> > How can I set a seperate user logins other than anonymous but not let
> > them be able to login via telnet ?
> >
> >
> > Richard Wykes
> >
> > Site Supervisor
> > Computer Services
> > University College of Ripon & York St John
> > Ripon, North Yorkshire, England
> >-- End of excerpt from Richard Wykes
> 
> Richard -
> 
> We use a 'secure' FTP setup that sounds like what you want. The passwd file
> setup looks like this:
> 
> jdoe:xxxxxxxx:1115:9999:JohnDoe,,,,,,,:/usr/spool/ftp/./:/bin/false
> 
> This dumps John off in the ftp area when he comes in under ftp (you could have
> him go directly to a specific subdir by adding the path as his home dir) and it
> won't allow him to telnet in (no shell).
> 
> You must put the /bin/false entry in /etc/shells..
> 
> Also, make sure you define 9999 in /etc/group (i.e. staff::9999) and enter that
> group name as guest group in your ftpaccess file (guestgroup staff).
> 
> This is great for new users who don't need to wander around the machine, and
> pretty secure because you can require a userid and password and restrict group
> access...the downside I've found is that since the users have no shell, they
> can't change their own passwords (and you can't force that as a matter of
> security), and they can't delete aging or unused files. Overall, that's been a
> small price to pay, since it simplifies our requirement for a secure FTP site
> for *very* novice users.
> 
> I hope I haven't forgotten anything...hope this helps...
> 
> judy
> 
> UNIX Systems Manager
> Office of Space Access and Technology
> NASA
> email: [email-masked]
> 
> 

I've done all that and it seems to stop telnet and lets them in for 
FTP but they can see all of the directory tree and I only want them 
to be able to see down the structure from where they are put after 
login.