40.8. Limiting Who Can Log In

ProFTPD does not allow every UNIX user to log in, even if they have valid usernames and passwords. The separate /etc/ftpusers file lists users who are not allowed to authenticate, which typically include system accounts such as bin, daemon, and uucp. In addition, there is a separate configuration option that controls whether the root user is allowed to log in or not. By default it is not, because passwords sent by the FTP protocol are not encrypted, so allowing root to authenticate could be a major security risk.

ProFTPD also prevents users without a valid shell from logging in by default. A valid shell is one listed in the /etc/shells file. This feature can be useful for preventing a large group of users from logging in, such as those who should only be able to connect to a POP3 server to download their email. It can be turned off, however, if necessary.

To edit the list of denied users and other login restrictions, follow these steps:

1.
On the module's main page, click on the Denied FTP Users icon. In the form that appears is a text box listing all blocked UNIX users. Edit it to add or remove any that should or should not be allowed to log in, and hit the Save button.

2.
To allow the root user to connect, click on the Authentication icon and change the Allow login by root? field to Yes.

3.
To allow users with unlisted shells to log in, change the Only allow login by users with valid shell? field to Yes as well.

4.
Hit the Save button to return to the main page, then click Apply Changes to make the new restrictions active.

The options for allowing the root user and users with invalid shells to log in can also be set on a per-virtual server basis as well, under the Authentication icon on the virtual server options page. It is not generally useful from a security point of view, however, to allow clients of just a single server to log in, as users can choose any server to connect to.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.222.117.157