Linux

Ask something
Discussion Locked

Solaris restricted shell and ftp

0 helpful
8 replies

by remi.trudel

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We configured an account using a restricted shell ('/usr/lib/rsh').

The ".profile" restricts the user only to lp command (PATH points to '/usr/local/rbin' where only lp is defined)

We would also need this user to ftp files from his/her desktop.

Can we? If yes, how?

Thanks

8 replies

by ghislain.levesque

Salut...

The actions of rsh are identical to those of sh , except that the following are disallowed:

changing directory (see cd(1) ),

setting the value of $ PATH ,

pecifying path or command names containing / ,

redirecting output ( > and >> ).

The restrictions above are enforced after .profile is interpreted.

A restricted shell can be invoked in one of the following ways:

1.rsh is the file name part of thelast entry in the /etc/passwd file (see passwd(4) );

2.the environment variable SHELL exists and rsh is the file name part of its value; the environment variable SHELL needs to be set
in the .login file;

3.the shell is invoked and rsh is the file name part of argument 0;

4.the shell is invoke with the -r option.

When a command to be executed is found to be a shell procedure, rsh invokes sh to execute it. Thus, it is possible to provide to the
end-user shell procedures that have access to the full power of the standard shell, while imposing a limited menu of commands; this
scheme assumes that the end-user does not have write and execute permissions in the same directory.

The net effect of these rules is that the writer of the .profile (see profile(4) ) has complete control over user actions by performing gu
aranteed setup actions and leaving the user in an appropriate directory (probably not the login directory).

The system administrator often sets up a directory of commands (that is, /usr/rbin ) that can be safely invoked by a restricted shell.
Some systems also provide a restricted editor, red .

Need more info on how to do it... you know where to find me.

Ciao

by james_randy

The first answer looks good to me. If that doesn't work, try something else. Hope this helps.

by william shipway

Sounds like you are just using this to allow access to a printer on the unix host. Instead of manual FTP and using lp, you might want to try setting up access direct to the unix printer from the workstation, perhaps using lpadmin or a third party product - just do a web search for them.

HTH
William

This discussion is closed to new replies.