UNIX for Dummies Questions & Answers

Folks;
I'm working on building ACL for our Solaris 10 box. I'm going to use LDAP for authentication.

We have a mounted drive on that server & users would like to be able to write to it.

We need to restrict the write access to that mounted drive on the box to be only through FTP, so if they want to add files/directories to that drive they have no choice but using FTP

Any help?

The only way I see to really do that is to have a separate ftp server that has only a few admin shell accounts. Then it can export a filesystem via NFS to other boxes in readonly mode. I know that a separate server wasn't what you were looking for, but the cost should be small. A retired pc from yesteryear could be reused with linux or bsd for little cost.

Thanks Perderabo;
Your solution makes sense, but i'm not sure if i understand this part & don't know why do we need to export a file system, and which one would be in a read only mode. could you please explain in more details this part:

" Then it can export a filesystem via NFS to other boxes in readonly mode."

Thanks
Katkota

You said "if they want to add files/directories to that drive they have no choice but using FTP". This sounds like they should be able to read via shell access. So you export it to another box for read access via shell accounts. If you mean ftp only, no shell accounts ever allowed for any purpose, that is easy. Make their login shell /bin/true. You probably then need to add /bin/true to /etc/shells so that ftp will work depending on what ftpd software you use. Accounts like this are ftp only. Do not add /bin/false to /etc/shells. Then you can change the shell to /bin/false to disable ftp access.

If you have some other requirement, express it more clearly.

Sorry if my requirement was not clear enough. so here's better explanation:

I have a group of users who needs to access their home directories that exist on a mounted drive called /new
so every one will have his home directory called "/new/user_name"

now they need to add files to their home directories but i don't want them to directly login to the UNIX box to add files, i want them to have only one way to add/write files to their home directories which is through FTP only

Are you trying to say they will have *no* login/shell access, only ftp?

Yes
only FTP.
BTW: How can i disable login shell access to every user in the group?