Re: Ftp Security

[Patrick Botz <botz@xxxxxxxxxx>]

I wouldn't suggest trying to control this from the client side. It is just
too easy for a user or a hacker that gains access to a workstation to
install/use their own FTP client.

I would suggest configuring your IFS authority so that users are only
allowed to see, change their directory to, or access objects to which they
should be allowed. Then follow that up by using the Application Admin
function to prevent users from doing anything other than using the
"up/download" function of FTP.  This gives you the greatest amount of
protection for your data regardless of whether someone is using FTP or any
other interface to try to access the data.

Changing authorities may take some analysis, but it provides benefits way
beyond this particular problem.  Start by changing "/" to either "rx" or
"x" for public. Which one really depends on how you use resources in IFS.
Most folks don't store files in the "/" directory, but do allow the
directories in "/" to be listed by PUBLIC.   On *nix type systems "/" is
defaulted to "rx".  For directories under "/", the IBM directories should
also be set to "rx".  Your own user directories should be set to "x" or
"rx" for PUBLIC, at most, and depending on how widespread their use is,
maybe nothing for PUBLIC.

Very few directories require "w" authority for PUBLIC.  Those directories
are normally somewhere below the first level after "/".  PUBLIC only needs
"w" to directories into which they or programs that run under their ID will
create files and on files that they are allowed to create, change, or
delete.

So, using the pathname "/myco/somestuff/workfiles" for example, and an
application that needed to create some kind of "work files" in that
directory, but no user should be able to see or read any other user's work
files, the following would suffice:

set "/", "/myco", and "/myco/somestuff" to PUBLIC="x"    (allows
search/traversal through the directory to files and subdirectories that the
user is authorized to read, write, or traverse),

set  "../workfiles" directory to PUBLIC = "w"  (allows the creation of
files/subdirectories in that directory, the owner is allowed to read, write
files unless you take steps to change the default authority for the owner
(e.g. UMASK)

Note that in the POSIX world permissions are defined as three groups of
potentially "rwx" with the groups being "owner, group, other".  PUBLIC
corresponds to "other"

Patrick Botz
Senior Technical Staff Member
Rochester CTC, eServer Security Architecture & Consulting
iSeries Security Architect
(507) 253-0917, T/L 553-0917
email: botz@xxxxxxxxxx

For more information on CTC, visit our website at
http://www.ibm.com/eserver/services
http://www.ibm.com/servers/eserver/services



                                                                           
             "James H H                                                    
             Lampert"                                                      
             <jamesl@xxxxxxxxx                                          To 
             om>                       Midrange Systems Technical          
             Sent by:                  Discussion                          
             midrange-l-bounce         <midrange-l@xxxxxxxxxxxx>           
             s+botz=us.ibm.com                                          cc 
             @midrange.com                                                 
                                                                   Subject 
                                       Re: Ftp Security                    
             07/12/2005 12:15                                              
             PM                                                            
                                                                           
                                                                           
             Please respond to                                             
             Midrange Systems                                              
                 Technical                                                 
                Discussion                                                 
                                                                           
                                                                           




"Jimmy Green" wrote:
> How can I have a user ftp to a specific directory on the
> ifs and keep the user in that directory?

Well, you could put them on an FTP client that will limit
them to a specific directory. I think the one in our
ThinView product will do that.

You may also be able to do something with authorities.

--
JHHL
--