Re: Locking a FTP user into a specific folder using stock FTP server on IBMi 7.1

I also have software named FTPTOOL that will allow you to lock down users
to folders, directories, libraries, FTP commands and do logging.

It will also allow you to set up "triggers" when certain operations take
place on the system.

https://www.bvstools.com/ftptool.html

On Thu, Apr 2, 2020 at 5:58 PM Jim Oberholtzer <
midrangel@xxxxxxxxxxxxxxxxx>
wrote:

All the below is true and they way to go, but requires a system admin to
set up in addition to a developer. The exits do not need to be
complicated and (since you have mainframe developers) can be done in

COBOL

as well. I can dig up some samples if needed.

The flip side is to consider one of several commercial products that
provide those controls.



On Thu, Apr 2, 2020 at 5:06 PM Nathan Andelin <nandelin@xxxxxxxxx>

wrote:

In addition to what Vern said, system administrators can *EXCLUDE

users

from IFS directories by using the WRKAUT command. The stock FTP client

and

all other programs would be subject to such restrictions. They could

also

set the HOMEDIR (Home directory) in the user profile, or set a user's
INLPGM (initial program to call upon successful login).


On Thu, Apr 2, 2020 at 3:56 PM Vernon Hamberg <

vhamberg@xxxxxxxxxxxxxxx>

wrote:

Hi Laurence

This kind of thing can be done but not with bare-bones FTP, which
doesn't have any of that capability.

This needs to use what are called exit points, there are security
products which can set this up easily, or you can write your own
program, which will be called at a certain point, an exit point, in

the

FTP process. This program needs to be registered to that exit point

in

the registry (not Windows registry) on IBM i. WRKREGINF can show you

all

the exit points.

I think you want the QIBM_QTMF_CLIENT_REQ exit point. Google for that
and you should find information and examples - of course, IBM's
documentation is the first thing to read, IMO.

HTH
Vern

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
Jim Oberholtzer
Chief Technical Architect
Agile Technology Architects
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com