Sponsored Content
Full Discussion: restricting access...
Special Forums Cybersecurity restricting access... Post 2371 by Neo on Wednesday 9th of May 2001 01:21:21 PM
Old 05-09-2001
Can you post your login scripts that call the chroot command and the login command you are using in the /etc/passwd file?

Let's work this openly with all files/details so those who follow will benefit from the trail blazed in this thread. Thanks!
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Restricting access

I need to create a user that only has access to 1 directory (e.g. /vol/mita/test). The user needs to be able to rsh into that directory to run a script. The user should not be able to navigate to any other directories above /vol/mita/test. Any help would be appreciated! (4 Replies)
Discussion started by: ngagne
4 Replies

2. UNIX for Dummies Questions & Answers

Restricting access to a machine by IP Address

I have a need to allow only certain IP addresses to access a machine running solaris 9. I am not sure how this can be accomplished. Thanks in advance for your help. Patch (2 Replies)
Discussion started by: patch
2 Replies

3. Solaris

restricting access

Hi All, I'm on Solaris 8, I need to provide Read-only access to a user to 2 directories only. Using rsh (restricted shell) as the user's login shell, I can restrict the user's access to a certain directory only, but how can I set in such a way that the user can access only the 2 directories... (4 Replies)
Discussion started by: max_min
4 Replies

4. UNIX for Advanced & Expert Users

restricting root access

I'm the admin in a shop in which my developers have and use the root account, all UNIX newbies. I've been unable to convince management myself that this is an unacceptable practice. I've looked in a couple books I have and can't find any chapters, discussions, etc that make the argument that... (2 Replies)
Discussion started by: keith.m
2 Replies

5. Solaris

restricting access to a server

We want to secure access to a server by restricting the number of users who can login to it. Our users are NIS users. Only few of them can telnet/ssh this server. Do you have any idea on how to implement that? thanks. (1 Reply)
Discussion started by: melanie_pfefer
1 Replies

6. UNIX for Advanced & Expert Users

Restricting access to code

Hi All, I am facing a problem, regarding code security on a server. We have configured a server which contains our code (ear present in jboss/server/xyz/deploy) in it, and need to bind the code to the server itself so that no one can take the code out of the. the problem is that the password of... (3 Replies)
Discussion started by: akshay61286
3 Replies

7. Solaris

Restricting FTP access for a particular directory

Dear All, I have created a user called "x" who is allowed only to FTP and it is working fine. Here my problem is, I want to give access to a particular directory say for eg:- /dump/test directory. I don't find any option in the useradd command to restrict access to this particular directory only... (1 Reply)
Discussion started by: Vijayakumarpc
1 Replies

8. Solaris

Restricting CPU Core Access

Hi all. I've had a quick look around but cant see anything exactly matching my requirements. I have a new T2000 running S10. Im looking to restrict the no. cores that a S10 non-global zone can use to 1 only. The box is single CPU but 8core. I want to do this to save on some software... (4 Replies)
Discussion started by: boneyard
4 Replies

9. UNIX for Dummies Questions & Answers

Restricting SFTP access

Hello, I am using MySecureShell to chroot all sftp accesses. The problem that I have is that my boss does not want root to be able to use sftp. Root should still be able to ssh. Any ideas? (2 Replies)
Discussion started by: mojoman
2 Replies

10. Solaris

Restricting commands & access

Dear all, I am administering a DC environment of over 100+ Solaris servers used by various teams including Databases. Every user created on the node belonging to databases is assigned group staff(10) . I want that all users belonging to staff should NOT be able to execute certain system... (6 Replies)
Discussion started by: Junaid Subhani
6 Replies
tftpd(1M)																 tftpd(1M)

NAME
tftpd - trivial file transfer protocol server SYNOPSIS
retran-seconds] total-seconds] port] port] [path ...] DESCRIPTION
is a server that supports the Internet Trivial File Transfer Protocol (RFC783). The TFTP server operates at the port indicated in the ser- vice description (see services(4)). The server is normally started by using the file (see inetd(1M) and inetd.conf(4)). Options supports the following options: This option writes the debugging information into the syslog file. This option specifies the per-packet retransmission timeout, in seconds. The default value is 5 seconds. This option disables the client side options: and individually. By default, these options are enabled. For example, to disable timeout negotiation between a client and the server, start the server with the following command: This option enables to work in the Service Guard environment. This option is required for some clients. These clients reject the reply received from a different IP address than the one requested when the server's interface is configured with an alias IP address. This option specifies the total retransmission timeout, in seconds. The default value is 25 seconds. This option specifies the lower limit of the port range for data transfer. This option specifies the upper limit of the port range for data transfer. NOTE: The tunables should be considered before defining the If the option is defined without using the option, the upper limit is set to 65535. If the option is defined without using the option, the lower limit is set to 1024. The path parameter has the following effects: o operates in either of two modes or their combination. The first mode requires a defined home directory for the pseudo-user and looks for files relative to that path. The second mode requires one or more paths be specified on the command line, and allows access only to files whose paths match or begin with one of the command line specifications. The first mode is backward-compatible with previous releases of HP-UX and supports somewhat tighter security. The second mode is compatible with other vendors' implementations of and allows greater flexibility in accessing files. o If no path is specified on the command line, requires an entry in the database (see passwd(4)) for an account (pseudo-user) named The password field should be the group membership should be and the login shell should be For example (assuming the guest group ID is 101): uses a call to to change its root directory to be the same as the home directory of the pseudo-user This restricts access by clients to only those files found below the home directory (see chroot(2)). Furthermore, clients can only read files in that directory if they are readable by the pseudo-user and clients can only write files in that directory if they exist and are writable by the pseudo- user o If any path is specified on the command line, does not require that a pseudo-user named exist in The specified paths control access to files by clients. Each path is treated as being relative to (not the home directory), and can be either a directory or a file. disallows a client access to any file that does not match entirely or in its initial components one of the restriction paths. It also disallows access to any file path containing However, an accessed file can be a symbolic link that points outside the set of restricted paths. o If any path is specified on the command line and the home directory is defined and is not first looks for a file relative to (under) the home directory. If the file is not found there, then looks for the file relative to with path restrictions applied. Thus if two files with the same name can be found in both locations, accesses the one under home directory. Note that allows continuation of command lines in by ending continued lines with a backlash. Defining the pseudo-user is strongly recommended even when paths are specified, because client access is further restricted to files that can be read and/or written by this pseudo-user. It is safe to set the pseudo-user's home directory to in this case. DIAGNOSTICS
The following diagnostics are logged to the facility at the log level (see syslogd(1M)). The pseudo-user was not found in the password database and was invoked without any path arguments. Add or correct the entry for the pseudo-user in the password database Or, add an access list (path arguments) to the argu- ments in the configuration file Reconfigure with the command An invalid option was specified in the arguments in the configuration file Remove or correct the option. Restart with the command The value given for the option was not a number or was a negative number. Correct the value given for the option. Reconfigure with the command The value given for the option was not a number or was a negative number. Correct the value given for the option. Reconfigure with the command The named system call failed. See the corresponding manual entry for a description of the system call. The reason for the failure is explained in the error message appended to the system call. WARNINGS
When invoked with no path arguments, cannot follow symbolic links that refer to paths outside of the home directory of the pseudo-user because it performs a AUTHOR
was developed by the University of California, Berkeley, and Hewlett-Packard. SEE ALSO
tftp(1), inetd(1M), syslogd(1M), chroot(2), inetd.conf(4), passwd(4). STANDARDS CONFORMANCE
RFC783, RFC2347, RFC2348, RFC2349. tftpd(1M)
All times are GMT -4. The time now is 12:49 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy