UNIX for Dummies Questions & Answers

Hello,

I have a problem with my FTP users.

I have create the ftp user on my AIX server, I set the default shell /bin/false or /usr/bin/false.
Its enough that the user can logon via FTP.

But when I try the user for example via ssh, the shell session is not killed, the session is defunct .
I want to check that the user cannot logon via ssh
ww25b1 2043906 5988416 0 11:35:39 - 0:00 sshd: ww25b1@pts/1
ww25b1 4964600 2043906 1 0:00 <defunct>

I try to check what is the problem, but logs there aren't logged this faliure.

If you don't give the user a shell, the ftp login for that user will not work. At least not on a AIX 5.3 or Debian Lenny box.

If you want to enable login via ftp and deny it for ssh/scp/sftp, let him have his shell, but add in /etc/ssh/sshd_config something like:

Code:

..
DenyUsers youruser

Restart sshd to enable this:

Code:

stopsrc -s sshd
startsrc -s sshd

My problem is, if I set "false" shell to my user, that is working with FTP, but If a user has false shell, when the user try to logon for example via SSH, the SSH connection should be kill/close, but the SSH session is will be "defunct".

FTP connection works as well, but what about the SSH?

And this defunct processes cannot kill with kill-9 command, just if I kill the defunct parent sshd process.

Yes, I think I understood but I can't reproduce your problem. When I don't give a shell to a user, there will be no login possible via ftp on any try.

Why not try the way I described? So users will be able to ftp, still have a shell assigned and can't really do anything with the shell because they are kept outside due to the sshd configuration. So no ssh, sftp or scp for them. You should make sure you turn rsh and telnet off too of course.
Is this solution not to your liking?

Yes, that is a good solution, but I cannot change this process.
I just try to understand/investigate the problem, because my another servers this solution is works, but I didn't find differencies between the servers.
And I didn't found anything in the log files.
Just only this server do this