Subject: FTPD and remote REAL user logins

From: Jim Hribnak <[email-masked]>
Date: Wed, 14 May 1997 13:03:51 -0600

I am the sysadmin for our ISP and one of our Web developers wants to allow
REAL user logins from ANYWHERE in the world to login to their account on
our server t update their WWW pages.

Is there any security issues with this?  Is there a better way to allow
someone from Japan to connect to us and stransfer their pages? (I dont
wanna use Front Page, but if we have to then we have to)

Please write back with some ideas..

Thanks inadvance..

Jim

---
Jim Hribnak                   
Manager Communication Services, Nucleus Inc 
Calgary       403-541-9400  240 Lines
Edmonton  403-413-1600    30 Lines 
Voice           403-209-0000            
Internet abuse: [email-masked]
[email-masked]
Sick of UCE, JunkEmail? check out www.abuse.net

---

From: James Sneeringer <[email-masked]>
Date: Wed, 14 May 1997 15:11:53 -0500 (CDT)

On Wed, 14 May 1997, Jim Hribnak wrote:
| Is there any security issues with this?  Is there a better way to allow
| someone from Japan to connect to us and stransfer their pages?

ssh.  You can either redirect an ftp connection across it, or use scp.  Of
course, non-Unix support may be a problem.

http://www.cs.hut.fi/ssh/ for more information.

-James

--
|\ James Sneeringer, System Administrator
| \ Oberlander Communications Systems, Inc.
|__\ [email-masked] :: 309/688-4766 :: 800/747-4768

---

From: Shane Castle <[email-masked]>
Date: Wed, 14 May 1997 15:39:56 -0600 (MDT)

>wanna use Front Page, but if we have to then we have to)

One thing that could work is to set up your webpages hierarchy the same
way you would the anonymous FTP tree, then set up guestgroup users that
use as their home directories the appropriate levels in the webpages
tree.  Permissions should allow them to modify their own webpages but
nobody else's and they can't cd outside the chrooted webpage
hierarchy.  This would prevent the exposure from real-user FTP logins.
You could even set this up so that the user would be able to use FTP
only and couldn't log in via telnet, or you could allow telnets if you
want - but if you allow them to telnet in then there is no logical
reason to disallow real-user FTP.

Shane Castle             | "Perfection, then, is finally achieved, not
Boulder County Info Svcs | when there is nothing left to add, but when
Boulder CO USA           | there is nothing left to take away."
                         |                - Antoine de Saint-Exupery