Subject: wu-ftp-2.4 and telnet

From: LES MAYEDA TECH SUPPORT/ISS X6656 <[email-masked]>
Date: Tue, 12 Mar 1996 10:20:33 -0700 (PDT)

Hello,

I have configured wu-ftp 2.4 and everything works fine
except that ftp users can telnet into the server and look around.

How do I restrict or prevent ftp users (belonging to the
guestgroup) from telneting into the server and looking around?
Should there be some shell script in the dummy shell that
prevents them from logging in using telnet?  

I have tried using the restricted shell /etc/Rsh but I noticed
that I could change shells and get around this.  

login: ftp1

Password:
Last login: Wed Feb 28 09:31:00 from KWS3301C.CSMC.ED
Digital UNIX V3.2C  (Rev. 148); Fri Sep 15 15:01:37 PDT 1995 
Digital UNIX V3.2C Worksystem Software (Rev. 148)
$ cd ..
cd: restricted
$ ksh
$ cd ..
$ ls -al
total 56
drwxr-xr-x   7 root     system      8192 Feb 27 13:29 .
drwxr-xr-x  14 root     system      8192 Mar 10 08:11 ..
dr-xr-xr-x   5 root     ftp         8192 Feb  1 13:48 ftp
dr-xr-xr-x   5 root     ftp         8192 Feb 27 16:11 ftp1
dr-xr-xr-x   5 root     ftp         8192 Feb 27 16:14 ftp2
dr-xr-xr-x   5 root     ftp         8192 Feb 27 14:06 ftp3
dr-xr-xr-x   5 root     ftp         8192 Feb 28 09:40 ftp4

I have changed the ftp login shell back to a dummy shell.

ftp1:x1x/U/RNMo34k:405:400:ftp1:/usr/local/home/ftp1:/bin/ftponly
ftp2
...

They belong to the same group in etc/group:

ftp:*:400:ftp,ftp1,ftp2,ftp3,ftp4

And this group if defined in the guestgroup table in /ftpaccess;

# specify which group of users will be treated as "guests".
guestgroup ftp

Thanks in advance.

les mayeda
Cedars-Sinai Medical Center
[email-masked]

---

From: "Mike Ellwood, CCLRC, Rutherford Appleton Laboratory, GB" <[email-masked]>
Date: Wed, 13 Mar 1996 12:49:55 +0000 (GMT)

> prevents them from logging in using telnet?  
(Not applicable in your case I think, but in AIX systems, one
 can set the username to be "telnet=no" via the chuser command.
 (also "login=no, rlogin=no, su=no").

It's obviously also a good idea to take the precautions already
mentioned by others, just in case there are any loopholes in the "telnet=no"
etc. mechanisms in AIX.

[email-masked]