hi.

i want to make users for accessing a dedicated folder for themselves via ftp.
i think i've configured vsftpd correctly for that...

problem is when i create an account for vsftpd:
useradd NewName
passwd NewName


that user can login with ftp and only access his/her home dir from ftp, but they are able to login via SSH still and browse other folders which is BAD

also their home dir has files like .bash_logout and .bash_profile in their by default which i don't know is safe or even needed.

should i be worried?

It's been a while since I used built-in FTP, but couldn't you just set their shell to /bin/false and make sure /bin/false is in /etc/shells? I think they'll still be able to login via FTP, but not get a shell.

It's definitely a good idea to use a separate login for FTP access. FTP is an unencrypted protocol so you definitely don't want to use an account that also have email/ssh/sudo access etc. What you need to do is just like chort said, in the user manager (whatever that may be on your distribution) set the login shell to /bin/false or /sbin/nologin (again depending on your distribution). To limit SSH access modify your sshd_config file to include the "AllowUsers" parameter:
http://www.freebsd.org/doc/en_US.ISO...k/openssh.html

I'd add to the already good points / suggestions that you should not use this service to deliver any sensitive files.

Even after you've set up the users with a nologin "shell" and taken other precautions with sshd, keep in mind that authentication information gets sent clear text for anyone to grab.

If these are sensitive files, you'll want to look into either a) requiring SSL encryption for both authentication and data transfer (FTPS); or b) using something like scponly instead.

On top of all that, you can restrict access to vsftpd using either iptables or tcp_wrappers. (Not a standalone solution but it makes you harder to attack.)

thanks guys!
the AllowUsers line in the sshd_config file looks like it is doing the job!

now i can have a set of users for ftp and a different set for ssh