Subject: deny question

From: "Oscar J. Bolivar G." <[email-masked]>
Date: Thu, 22 Aug 1996 15:18:27 -0500 (EST)

Hello:

I have an DEC Alpha Machine running wu-2.4.

How I can to configure this software in order to deny the ftp access
to some accounts that are defined in the system???

P.E. The account xxx (is in the /etc/passwd file) can get the mail
(remotly, using POP) but can not use ftp (with the xxx account) to the machine.
The user can use the anonymous ftp only.

Thanks in advance for your help.

Oscar J., Bolivar G.
STA - Colombia.

E-mail:  [email-masked]

P.D. Sorry but my english is very bad

---

From: Bob DeBula <[email-masked]>
Date: Fri, 23 Aug 1996 08:17:21 -0400 (EDT)

> The user can use the anonymous ftp only.

Well, if you also don't want them to be able to login to the system
and only access via POP, you'll probably want to make their shell
in "/etc/passwd" something like "/bin/false", which *shouldn't*, 
per my recollection, impact their ability to connect via the POP
protocol (port 109 or 110 usually). As far as not allowing them to FTP
other than as anonymous, from the WU ftpd man page (see rule two):

---------------------------------------------------------------------
       Ftpd authenticates users according to four rules.
 
       1)     The user name must be in the  password  data  base,
              /etc/passwd,  or  whatever  is  appropriate for the
              operating system, and  the  password  must  not  be
              null.   In this case a password must be provided by
              the client before any file operations may  be  per-
              formed.
 
       2)     The   user   name  must  not  appear  in  the  file
              /etc/ftpusers.
 
       3)     The user must have a  standard  shell  returned  by
              getusershell(3).
 
       4)     If  the  user  name is ``anonymous'' or ``ftp'', an
              anonymous ftp account must be present in the  pass-
              word file (user ``ftp'').  In this case the user is
              allowed to log in by specifying  any  password  (by
              convention  this  is  given  as  the  client host's
              name).
---------------------------------------------------------------------

So, you'll want to add the users who aren't to be allowed FTP priviledges
to "/etc/ftpusers". Many folks add accounts like "root", "uucp",  and a
variety of other system administration accounts to that file as well.
You'll also need to add "/bin/false" to "/etc/shells" (or create it if it
doesn't exist). My "/etc/shells" (on an Alpha running Digital Unix 3.2D)
looks like:

-------------------------------------
/usr/bin/sh
/usr/bin/csh
/usr/bin/ksh
/bin/sh
/bin/csh
/bin/ksh
/usr/local/bin/tcsh
/bin/false
-------------------------------------

I hope this helps to answer your question,