Subject: real unix users and wu_ftpd

From: "Thunem, Tom" <[email-masked]>
Date: Tue, 12 Jan 1999 10:06:52 -0700

i recently put up an ftp server using 2.4.2 BETA-17.  i was successful in
setting guest users and the anonymous user.  i have also set it up to allow
real users to connect to the server.  to allow the real users ftp access, i
merely added /usr/bin/sh to the /etc/shells file.  i am just curious as to
whether or not i need to do anything further to better secure things as i am
allowing /usr/bin/sh access.

hope this makes sense.

Tom Thunem
AVNET, Inc.

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 12 Jan 1999 12:28:53 -0500 (EST)

On Tue, 12 Jan 1999, Thunem, Tom wrote:

> i recently put up an ftp server using 2.4.2 BETA-17.  i was successful
> in setting guest users and the anonymous user.  i have also set it up
> to allow real users to connect to the server.  to allow the real users
> ftp access, i merely added /usr/bin/sh to the /etc/shells file.  i am
> just curious as to whether or not i need to do anything further to
> better secure things as i am allowing /usr/bin/sh access.

I would recommend NOT allowing 'real' users; make all the real users
guests.

If you cannot do that, use upload and noretrieve to keep them out of
things you don't want them getting into.  You might want to take a look at
VR12, it makes that job a lot easier.

If you do not want the real users being able to use telnet/local-shell,
use a fake shell (/bin/false is good for that) and add _that_ to
/etc/shells.

If all your real real users are from local machines, use /etc/ftphosts to
limit them to those machines.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195