To prevent block FTP access by anonymous users Solaris 10

To prevent access by anonymous users, add the entry

"defaultserver private" to /etc/ftpd/ftpaccess:

Adding guestserver to the ftpaccess file:

# echo "guestserver" >> /etc/ftpd/ftpaccess

# cat /etc/ftpd/ftpaccess
# ident "@(#)ftpaccess  1.2     03/05/14 SMI"
#
# FTP server configuration file, see ftpaccess(4).
#

class   anonusers       anonymous       *
class   guestusers      guest   *
class   realusers       real    *

loginfails      3
passwd-check    trivial         warn
private         no
shutdown        /etc/ftpd/shutdown.msg
# email         user@hostname
# guestuser     username
# rhostlookup   no

#To prevent access by anonymous users#
defaultserver private
.
.
.
.
guestserver
.
.

Next restart the FTP service :

Veryfy the status now -> blocked FTP access for anonymous user :

C:\Users\U Computers>ftp 172.16.0.1
Connected to 172.16.0.1.
220-_________________________________
220-
220-    welcome to SLT HQ server!
220-     Authorised access only!
220-
220-**********************************
220-
220-
220 NTU-HQ-EMS FTP server ready.
User (172.16.0.1:(none)): anonymous
530 Guest login not allowed on this machine.
Connection closed by remote host.

How to ensure that anonymous FTP has been disabled on a Solaris 10 system

Read More

Create ftp access only user in Solaris 10 with user restrictions(access rights)

We are going to create user who can access toserver via ftp with following access rights:

Access to server via:

Telnet/ssh/other: No

FTP:Yes

                Read file: only user home directory.

                For that you can give whatever the location you need to give access to user

                Eg:/var/apache2/http/ftp/

                Then user can access only to that folder

            

            Chmod                 NotAllowe

Delete                  NotAllowe

Overwrite            NotAllowe

Rename               NotAllowe

Unmask               NotAllowe

Upload                NotAllowe

               

Verify ftp service is running in the server:

# svcs -a |grep -i ftp

online         12:17:58 svc:/network/ftp:default

Create new user for access server only for FTP

#useradd -g other -d /export/home/sltftp -m -s/bin/ftponly -c "ftp only user account for ftp backup" sltftp

other : This is the group that by default will own any files or processes created by this user. If this user attempts to access a file and the group of that file is the user's primary group then the group permissions for that file will apply (unless the user is the owner of the file).(not necessary)

/export/home/sltftp : A user's home directory typically contains all the files owned by that user. When a user logs in, he will be placed in his home directory and scripts like .cshrc or .profile will be run.

/bin/ftponly : When a user logs in via telnet or at the console, or opens an xterm window in X the users shell program will be run to interpret commands entered. If a user does not have a valid shell program or has one that does nothing (like /bin/false), then that user will not be able to login. This can be useful when creating users who can only read and send email.

"ftp only user account for ftp backup" : The real human-readable name of this user.

sltftp : The login name of this user. This must be unique.

Enter a password for newly created user :( otherwise its remaining blank)

# passwd sltftp

New Password:

Re-enter new Password:

passwd: password successfully changed for sltftp

Verify user creation:

# cat /etc/passwd

root:x:0:0:Super-User:/:/sbin/sh

daemon:x:1:1::/:

bin:x:2:2::/usr/bin:

sys:x:3:3::/:

adm:x:4:4:Admin:/var/adm:

.

.

sltftp:x:1000:10: ftp only user account for ftp backup: /export/home/sltftp:/bin/ftponly

1000: The user ID or UID is what the system really uses to enforce permissions on files and processes. If two users have the same UID, they will be able to access each other’s files - so every user should have a unique UID.

Create file /etc/shells ( by default this file not found in system)

# cat /etc/shells

/etc/shells: No such file or directory

Add this line : /bin/ftponly

# vi /etc/shells

/bin/bash

/bin/csh

/bin/gnome-autogen.sh

/bin/hash

/bin/jsh

/bin/ksh

/bin/pfcsh

/bin/pfksh

/bin/pfsh

/bin/remsh

/bin/rksh

/bin/rsh

/bin/sh

/bin/ssh

/bin/tcsh

/bin/zsh

/bin/ftponly

And save it Ece->:wq!

Try to telnet using this user and check the accessibility

login: sltftp

Password:

Last login: Wed Jun 26 12

No shell

Connection to host lost.

You can also create /bin/ftponly file and give some echo command with what you want to display when user try to login

      Eg:#touch /bin/ftponly>> echo “This account only allows FTP Access!”

After that when users try to login via telnet its shows like this:

login: sltftp

Password:

Last login: Wed Jun 26 12

This account only allows FTP Access!

Connection to host lost.

Limiting access rights for ftp user by editing ftpaccess file locate in /etc/ftpd/

#vi ftpaccess 

# ident "@(#)ftpaccess  1.2     03/05/14 SMI"

#

# FTP server configuration file, see ftpaccess(4).

#

class   realusers       real    *

class   guestusers      guest   *

class   anonusers       anonymous       *

loginfails      3

passwd-check    trivial         warn

private         no

shutdown        /etc/ftpd/shutdown.msg

# email         user@hostname

# guestuser     username

# rhostlookup   no

keepalive       yes

recvbuf         65536           real,guest,anonymous

sendbuf         65536           real,guest,anonymous

# flush-wait    no              anonymous

# passive       ports           0.0.0.0/0       32768   65535

# timeout       data            600

# timeout       idle            300

banner          /etc/ftpd/banner.msg

greeting        brief

message         /etc/ftpd/welcome.msg   login

message         .message                cwd=*

readme          README*                 login

readme          README*                 cwd=*

# quota-info    *

chmod   no      anonymous,guest

delete  no      anonymous,guest

overwrite       no      anonymous,guest

rename  no      anonymous,guest

umask   no      anonymous,guest

compress        yes             realusers guestusers anonusers

tar             yes             realusers guestusers anonusers

path-filter     anonymous,guest /etc/ftpd/filename.msg  ^[[:alnum:]._-]*$       ^[.-]

noretrieve      relative        class=anonusers         /

allow-retrieve  relative        class=anonusers         /pub

upload          class=guestusers    *    *         no  nodirs

upload          class=anonusers    *    *         no  nodirs

# upload        class=anonusers    *    /incoming yes ftpadm ftpadm 0440 nodirs

# log           commands        real,guest,anonymous

# log           security        real,guest,anonymous

# log           transfers       real,guest,anonymous    inbound,outbound

# xferlog       format  %T %Xt %R %Xn %XP %Xy %Xf %Xd %Xm %U ftp %Xa %u %Xc %Xs %Xr

# limit-time    anonymous       30

# limit         anonusers       10      Wk0730-1800       /etc/ftpd/toomany.msg

# limit         anonusers       50      SaSu|Any1800-0730 /etc/ftpd/toomany.msg

guestuser      sltftp ftptest

log     commands        anonymous,guest

Save the changers Ece->:wq!

We create this user under guest list:

Define sltftp user as guest:

guestuser       sltftp ftptest

create a class for guest user:

The WU FTP server allows you to classify users based on the address they login from and their user type. The three user types are :

Unix - Normal users on your system.

Guest - Unix users who have been classified as guests.

Anonymous - Logins by the anonymous or ftp user, if allowed on your system.

The top section of this page allows you to define named classes, based on user types and source addresses. Every login is classified into the first matching class, so classes should be ordered from the most to least specific. The matching addresses for each class can be full or partial IP addresses, IP networks/netmasks, hostnames, host wildcards (like *.foo.com) or the absolute paths to files containing additional addresses. Any type of address can be preceded with a ! to negate it.

class   guestusers      guest   *

Limiting access rights for guest user:(this will effect to all guest users)

chmod   no      anonymous,guest

delete  no      anonymous,guest

overwrite       no      anonymous,guest

rename  no      anonymous,guest

umask   no      anonymous,guest

Put some logging banner to display when logging:

message        /etc/ftpd/welcome.msg   login

#vi /etc/ftpd/welcome.msg  

***************************

Welcome to ftp Sever

Authorized access only!

***************************

Save it:Ece->:wq!

No need to restart the ftp server for effect the changes

To restart ftp process :

#svcadm restart  svc:/network/ftp:default

Done! J

Now check ftp user

C:\Windows\system32\ftp 172.16.0.3

Connected to 172.16.0.3.

220 NTU-DR-EMS FTP server ready.

User (172.16.0.3:(none)): sltftp

331 Password required for sltftp.

Password:

230 User sltftp logged in.  Access restrictions apply.

Try to upload some files:

ftp> mput

Local files C:\Users\Daraka\Desktop\test.txt

mput C:\Users\Daraka\Desktop\test.txt?

200 PORT command successful.

553 test.txt: Permission denied on server. (Upload)

You can only able to download from the server 

Read More

Essential ftp Commands

Essential ftp Commands

Essential ftp Commands

Command Description ftp Accesses the ftp command interpreter. ftp remote-system Establishes an ftp connection to a remote system. open Logs in to the remote system from the command interpreter. close Logs out of the remote system and returns to the command interpreter. bye Quits the ftp command interpreter. help Lists all ftp commands or, if a command name is supplied, briefly describes what the command does. reset Re-synchronizes the command-reply sequencing with the remote ftp server. ls Lists the contents of the remote working directory. pwd Displays the name of the remote working directory. cd Changes the remote working directory. lcd Changes the local working directory. mkdir Creates a directory on the remote system. rmdir Deletes a directory on the remote system. get, mget Copies a file (or multiple files) from the remote working directory to the local working directory. put, mput Copies a file (or multiple files) from the local working directory to the remote working directory. delete, mdelete Deletes a file (or multiple files) from the remote working directory.

How to Open an ftp Connection to a Remote System

1.     Ensure that you have ftp authentication.

You must have ftp authentication.

bash-3.2# vi /etc/ftpd/ftpusers

Comment or remove required user to connect through ftp...

Eg:

#

#  List of users denied access to the FTP server, see ftpusers(4).

#

#root

daemon

bin

sys

adm

lp

uucp

nuucp

smmsp

#

2.     Open a connection to a remote system by using the ftp command.

#ftp remote-system

Eg:#ftp 172.16.0.1

     If the connection succeeds, a confirmation message and prompt are displayed.

3.     Type your user name.

Name (remote-system:user-name): user-name

4.     If prompted, type your password.

331 Password required for user-name:

Password: password

(If the system giving access to anonymous ftp account, then it’s prompt for an email address for the password. If the ftp interface accepts your password, it displays a confirmation message and the (ftp>) prompt.)

Example: Opening an ftp Connection to a Remote System

This ftp session was established by the user slt on the remote system NTU-DR-GLOBAL:

# ftp 172.16.0.4

Connected to 172.16.0.4.

220 NTU-DR-GLOBAL FTP server ready.

Name (172.16.0.4:slt): slt

331 Password required for slt.

Password:

230 User slt logged in.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp>

How to Close an ftp Connection

Close an ftp connection to a remote system by using the bye command (or you can use “!” symbol).

ftp> bye

221-You have transferred 0 bytes in 0 files.

221-Total traffic for this session was 255 bytes in 0 transfers.

221-Thank you for using the FTP service on NTU-DR-GLOBAL.

221 Goodbye.

.

How to Copy Files from a Remote System (ftp)

1.     Change to a directory on the local system where you want the files from the remote system to be copied.

 #cd target-directory

2.     Establish an ftp connection.

. #ftp remote-system

3.     Change to the source directory.

# cd source-directory

If your system is using the automounter, the home directory of the remote system's user appears parallel to yours, under /home.

4.     Ensure that you have read permission for the source files.

# ls -l

5.     Set the transfer type to binary.

You must use binary mode when transmitting all file other than ASCII files.

ftp> binary

or

ftp> bin

(Binary mode transmits all 8 bits/byte and it’s provide less error ftp transition)

6.     To copy a single file, use the get command.

ftp> get filename

7.     To copy multiple files at once, use the mget command.

#mget filename [filename ...]

You can supply a series of individual file names and you can use wildcard characters. The mget command copies each file individually, asking you for confirmation each time.

8.     Close the ftp connections.

ftp> bye

Example : Copying Files From a Remote System (ftp)

In this example, the user SLT opens an ftp connection to the system SLT_DR, and uses the get command to copy a single file from the /tmp directory.

# cd $HOME

ftp SLT_DR

Connected to SLT_DR.

220 SLT_DR FTP server (SunOS 5.8) ready.

Name (SLT_DR:SLT): SLT

331 Password required for SLT.

Password: xxx

230 User SLT logged in.

ftp> cd /tmp

250 CWD command successful.

ftp> binary

ftp> ls

200 PORT command successful.

150 BINARY data connection for /bin/ls (172.16.0.1,34344)

(0 bytes).

file_a

files

ps_data

226 BINARY Transfer complete.

53 bytes received in 0.022 seconds (2.39 Kbytes/s)

ftp> get file_a

200 PORT command successful.

150 BINARY data connection for file_a (172.16.0.1,34331)

(0 bytes).

221 Goodbye.

In this example, the same user SLT uses the mget command to copy a set of files from the /tmp directory to his home directory. Note that SLT can accept or reject individual files in the set.

$ ftp> cd /tmp

250 CWD command successful.

ftp> ls files

200 PORT command successful.

150 ASCII data connection for /bin/ls (172.16.0.1,34345)

(0 bytes).

fileb

filec

filed

remote: files

21 bytes received in 0.015 seconds (1.36 Kbytes/s)

ftp> cd files

250 CWD command successful.

ftp> binary

ftp> mget file*

mget fileb? y

200 PORT command successful.

150 BINARY data connection for fileb (172.16.0.1,34347)

(0 bytes).

226 BINARY Transfer complete.

mget filec? y

200 PORT command successful.

150 ASCII data connection for filec (172.16.0.1,34348)

(0 bytes).

226 BINARY Transfer complete.

mget filed? y

200 PORT command successful.

150 ASCII data connection for filed (172.16.0.1,34351)

(0 bytes).

226 BINARY Transfer complete.200 PORT command successful.

ftp> bye

221 Goodbye.

How to Copy Files to a Remote System (ftp)

1.     Change to the source directory on the local system.

The directory from which you type the ftp command is the local working directory.

2.     Establish an ftp connection.

#ftp remote-system

3.     Change to the target directory.

ftp> cd target-directory

Remember, if your system is using the automounter, the home directory of the remote system's user appears parallel to yours, under /home.

4.     Ensure that you have write permission to the target directory.

ftp> ls -l target-directory

5.     Set the transfer type to binary.

ftp> binary

6.     To copy a single file, use the put command.

ftp> put filename

7.     To copy multiple files at once, use the mput command.

ftp> mput filename [filename ...]

You can supply a series of individual file names and you can use wildcard characters. The mput command copies each file individually, asking you for confirmation each time.

8.     To close the ftp connection, type bye.

ftp> bye

Example : Copying Files to a Remote System (ftp)

In this example, the user SLT opens an ftp connection to the system SLT_DR, and uses put command to copy a file from their system to the /tmp directory on system SLT_DR.

$ cd /tmp

ftp SLT_DR

Connected to SLT_DR.

220 SLT_DR FTP server (SunOS 5.8) ready.

Name (SLT_DR:SLT): SLT

331 Password required for SLT.

Password: xxx

230 User SLT logged in.

ftp> cd /tmp

250 CWD command successful.

ftp> binary

ftp> put filef

200 PORT command successful.

150 BINARY data connection for filef (172.16.0.1,34356).

226 Transfer complete.

ftp> ls

200 PORT command successful.

150 BINARY data connection for /bin/ls (172.16.0.1,34357) (0 bytes).

file_a

filef

files

ps_data

226 BINARY Transfer complete.

60 bytes received in 0.058 seconds (1.01 Kbytes/s)

ftp> bye

221 Goodbye.

In this example, the same user SLT uses the mput command to copy a set of files from their home directory to SLT_DR's /tmp directory. Note that SLT can accept or reject individual files in the set.

$ cd $HOME/testdir

$ ls

test1   test2   test3

$ ftp SLT_DR

Connected to SLT_DR.

220 SLT_DR FTP server (SunOS 5.8) ready.

Name (SLT_DR:SLT): SLT

331 Password required for SLT.

Password: xxx

230 User SLT logged in.

ftp> cd /tmp

250 CWD command successful.

ftp> binary

ftp> mput test*

mput test1? y

200 PORT command successful.

150 BINARY data connection for test1 (172.16.0.1,34365).

226 Transfer complete.

mput test2? y

200 PORT command successful.

150 BINARY data connection for test2 (172.16.0.1,34366).

226 Transfer complete.

mput test3? y

200 PORT command successful.

150 BINARY data connection for filef (172.16.0.1,34356).

226 Transfer complete.

ftp> bye

221 Goodbye.

Reference: System Administration Guide: Network Services     Oracle Solaris 10 8/11 Information Library

Read More