Wednesday, January 1, 2014

FTP user with restriction to home directory(CHROOT USER)

FTP user with restriction to home directory(CHROOT USER)

 ftpconfig -d /home/ftp/ftp972 this updates the existing directory with the info needed to make the account restricted.After this you can see some extra directories in /export/home/ali e.g bin, dev,lib e.t.c

[ Non Global ] useradd -g 125 -d /home/ftp/ftp972 -s /bin/false -m ftp972
[ Non Global ] passwd ftp972
ftpconfig -d /home/ftp/ftp972 ß This command if given on the Non Global zone on which user is created will give an error. Refer below.If global zone is not present we can directly use this on nonglobal zone with ftpconfig -d /home/ftp/ftp972
Till this point, user is created with below HOME DIRECTORY contents.

/home/ftp/ftp972:
ls -lart
total 18
drwxr-xr-x 123 bsp      bsp          127 Oct 23 11:12 ..
-rw-r--r--   1 ftp972   bsp          144 Oct 23 11:12 .profile
-rw-r--r--   1 ftp972   bsp          157 Oct 23 11:12 local.login
-rw-r--r--   1 ftp972   bsp          174 Oct 23 11:12 local.profile
drwxr-xr-x   2 ftp972   bsp            6 Oct 23 11:12 .
-rw-r--r--   1 ftp972   bsp          136 Oct 23 11:12 local.cshrc
ftpconfig -d /home/ftp/ftp972
Updating directory /home/ftp/ftp972
ftpconfig: Error: Creation of devices in /home/ftp/ftp972/dev failed

Hence, execute the above command from Global zone, giving the absolute path of the HOME DIRECTORY of the newly created user (ftp972).

[ Global ] ftpconfig -d /use/hms01/zoneroot/root/baan/ftp/ftp972
Updating directory /use/hms01/zoneroot/root/baan/ftp/ftp972
Once this command is executed, HOME DIRECTORY content for user gets updated as can be seen below.
/home/ftp/ftp972:
ls -lart
total 27
drwxr-xr-x 123 bsp      bsp          127 Oct 23 11:12 ..
-rw-r--r--   1 ftp972   bsp          144 Oct 23 11:12 .profile
-rw-r--r--   1 ftp972   bsp          157 Oct 23 11:12 local.login
-rw-r--r--   1 ftp972   bsp          174 Oct 23 11:12 local.profile
-rw-r--r--   1 ftp972   bsp          136 Oct 23 11:12 local.cshrc
d--x--x--x   2 root     sys            7 Oct 23 11:14 dev
d--x--x--x   5 root     sys            9 Oct 23 11:14 etc
lrwxrwxrwx   1 root     bin            9 Oct 23 11:14 bin -> ./usr/bin
d--x--x--x   3 root     bin           24 Oct 23 11:14 lib
d--x--x--x   3 root     sys            3 Oct 23 11:14 platform
d--x--x--x   6 root     sys            6 Oct 23 11:14 usr
drwxr-xr-x   2 root     sys            2 Oct 23 11:14 pub
drwxr-xr-x   8 ftp972   bsp           13 Oct 23 11:14 .

FTP login works as below.

[hms01:]${PWD}
# ftp localhost
Connected to localhost.
220-****************************************************************************
220-* This system is for the use of authorized users only. Individuals using   *
220-* this computer system without authority, or in excess of their authority, *
220-* are subject to having all of their activities on this system monitored   *
220-* and recorded by system personnel.                                        *
220-****************************************************************************
220-
220 hms01bnp FTP server ready.
Name (localhost:root): ftp972
331 Password required for ftp972.
Password:
230 User ftp972 logged in.  Access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pwd
257 "/" is current directory.
ftp> cd /etc
250 CWD command successful.
ftp> pwd
257 "/etc" is current directory.
ftp> ls
200 PORT command successful.
550 Bad directory components
ftp> cd
(remote-directory) cd -
550 cd: No such file or directory.
ftp> cd !
550 !: No such file or directory.
ftp> cd ~
250 CWD command successful.
ftp> pwd
257 "/" is current directory.
ftp> ls
200 PORT command successful.
150 Opening ASCII mode data connection for file list.
bin
dev
etc
lib
local.cshrc
local.login
local.profile
platform
pub
usr
226 Transfer complete.
81 bytes received in 0.00036 seconds (222.26 Kbytes/s)
ftp> bye
221-You have transferred 0 bytes in 0 files.
221-Total traffic for this session was 1403 bytes in 1 transfers.
221-Thank you for using the FTP service on hms01bnp.
221 Goodbye.
[hms01bnp:]${PWD}
 

No comments:

Post a Comment