Re: Locking a FTP user into a specific folder using stock FTP server on IBMi 7.1

[Laurence Chiu <lchiu7@xxxxxxxxx>]

Hi

Thanks to all that responded. This solution seems to be the easiest to
implement since it does not require installing any software. We want the
FTP account to only have FTP access, no Telnet and being able to lock them
into the FTP folder and not issue commands apart from GET would solve the
problem I think. I will broach the subject with the IBMi people.

On Fri, Apr 3, 2020 at 11:32 AM Don Brown via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

> Hi Laurence,
>
> I actually posted the below solution last week to a similar question I had
> posed to the group.
>
> IBMi provides a graphical interface to set exit point controls for FTP
> actions.  It is much easier than writing your own exit point processing it
> you can achieve the desired results using this interface - if not then you
> may have to write the exit program!
>
> Set the required directory as the home directory on the user's user
> profile
>
> CHGUSRPRF <user-profile> HOMEDIR('<required-path')
>
> In IBM Navigator for i you can set Allow access or Deny access for the FTP
>
> Operation ...
>
> Navigation ==> Security ==> Application Administration
>
> Select Host Applications from the left menu
>
> Expand TCP/IP Utilities for iSeries
>
> Expand File Transfer Protocol
>
> Expand Specific Operations
>
> You now have a selection of operations that you can specify
> customisation's for
>   (Change directory, CL Commands, Clear Command Channel, Create
>    Directory/Library, Delete Directory/Library, Delete Files, List Files,
>    Receive Files, Rename Files, Send Files)
>
> Select the required operation and Click Customise (Customize for
> Americans!)
>
> You can now specify a list of Users/Groups/Users not in Group to either
> Allow access or Deny Access
>
> So to test I added my test user to the Access Denied operation for Send
> Files. (Sending files from IBMi to Client)
>
> I was then able to ftp the file with a put successfully but trying to do a
>
> get on that file failed with a not authorised error.
>
> So I am going to create a group profile, add the 200 users to that group
> and then assign the group as Access Denied to the  operations we want to
> restrict.
>
> I think this is going to work very nicely.
>
> Here is a ftp log after I restricted a user to ONLY being allowed to PUT
> files ...
>
> From a command prompt on my laptop I started an ftp session and logged on
> as FTP_TEST
>
> Here is a log from that session;
>
>
> List directory - Rejected
> ftp> dir
> 200 PORT subcommand request successful.
> 550 Request rejected.
>
> Put a file - Successful
> ftp> put c:\temp\Ping.txt /<path>/ping.txt
> 200 PORT subcommand request successful.
> 150 Sending file to /<path>/ping.txt
> 226 File transfer completed successfully.
> ftp: 1176 bytes sent in 0.23Seconds 5.03Kbytes/sec.
>
> Delete a file - Rejected
> ftp> del ping.txt
> 550 Request rejected.
>
> Rename a file - Rejected
> ftp> ren ping.txt ping12.txt
> 550 Request rejected.
>
> Get a file - Rejected
> ftp> get ping.txt c:\temp\ping.txt
> 200 PORT subcommand request successful.
> 550 Request rejected.
>
> Create a directory - Rejected
> ftp> mkdir TEST
> 550 Request rejected.
>
> Cheers
>
>
>
> Don Brown
>
>
>
>
>
> From:   "Laurence Chiu" <lchiu7@xxxxxxxxx>
> To:     "Midrange Systems Technical Discussion"
> <midrange-l@xxxxxxxxxxxxxxxxxx>
> Date:   03/04/2020 07:00 AM
> Subject:        Locking a FTP user into a specific folder using stock FTP
> server on IBMi 7.1
> Sent by:        "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
>
>
>
> This might seem a simple question but I am not  IBMi person and I am just
> getting involved in a major IBMi project. One question arose was, using
> the
> stock FTP server in IBMi, can an account be set to be placed in a certain
> folder on logon and not be able to go a folder up?
>
> It was posed by our security team who are concerned about FTP security and
> the fact that we are using FTP (albiet only within the corporate network)
> and so passwords go through in clear text. At this point in time there is
> no possibility of moving to SFTP
>
> Thanks
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com
>
> ______________________________________________________________________
> This email has been scanned by the Symantec Email Security.cloud service.
> ______________________________________________________________________
>
>
>
>
>
> ______________________________________________________________________
> This email has been scanned for computer viruses. Although MSD has taken
> reasonable precautions to ensure no viruses are present in this email, MSD
> cannot accept responsibility for any loss or damage arising from the use of
> this email or attachments.
> ______________________________________________________________________
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com