Disable ftp for user

V

ViAdCk

Verified User
Joined
Feb 14, 2005
Messages
250
Hello,

One of our clients wants to disable ftp access for his main user account and only allow access through additional ftp accounts created.
Does anyone know how this can be achieved? We run pure-ftp as the ftp server.

Thanks and regards!
 
Hello,

You might try and use .ftpaccess file.

I did search for a guide, but found little information. So you might try it yourself: https://www.google.com/search?q=ftpaccess

The guide I found states the file .ftpaccess does not work recursively - it should be tested and verified. I'm under an impression it works recursively at least for ProFTPd.

You will probably need to place it directly under /home/username/ i.e. /home/username/.ftpaccess and disable main FTP account there. And you will need to make the file inaccessible from secondary FTP accounts, otherwise they might overwrite it. I.e. secondary FTP account will need to be pointed one or several folders deeper in the disk structure from the user's homedir /home/username/.

Anyway test it on your end first, I don't guarantee that the directives will work for Pure-FTPd the same way as for ProFTPd.

- Restricting access to specific FTP users

You can prevent access to a directory for specific FTP users (e.g. restricted_user_1 and restricted_user_2) by adding the following code block to an .ftpaccess file in that directory:

Code: 
<Limit ALL>
DenyUser restricted_user_1,restricted_user_2
</Limit>

Note: Since .ftpaccess files do not work recursively, you will need to add a separate .ftpaccess file to all directories where you wish the custom FTP configuration to take effect. <-- TEST IT FIRST

- Allowing access only to specific FTP users

To grant access to a directory only for specific FTP users (e.g. allowed_user_1 and allowed_user_2), you should add the following code block to an .ftpaccess file in that directory:

Code: 
<Limit ALL>
AllowUser allowed_user_1,allowed_user_2
DenyAll
</Limit>

Note: Since .ftpaccess files do not work recursively, you will need to add a separate .ftpaccess file to all directories where you wish the custom FTP configuration to take effect. <-- TEST IT FIRST
 
ViAdCk said:
One of our clients wants to disable ftp access for his main user account
Click to expand...
I don't know the reason, but alternatively you could also just use some impossible strong password for that and just not give the password to anybody. Nobody can use it then.
 
Richard G said:
I don't know the reason, but alternatively you could also just use some impossible strong password for that and just not give the password to anybody. Nobody can use it then.
Click to expand...
But then the user can't access his directadmin either.

He just want to enable/disable ftp access for security reasons, this is a feature cpanel has for example.
 
ViAdCk said:
But then the user can't access his directadmin either.
Click to expand...
No. I don't know how this is done in Evo skin. But in Enhanced skin, you can change the FTP password and de-select the Directadmin password, just as admin and reseller can and then only the FTP password is changed.

I don't see an option to deselect Directadmin in Evo skin, either it's missing or I don't see it, I normally don't use Evo. Just because of these things.
 
ViAdCk said:
But then the user can't access his directadmin either.
Click to expand...

The Richard's solution can work for you too. You can create a random long password in DirectAdmin for an user, and never use it. Then create a KEY for the user in DirectAdmin with a desired password. A combination of username/KEY can be used for an authentication in DirectAdmin only, it can not be used for FTP, SSH, SMTP, POP, IMAP.
 
Richard G said:
How about what I just wrote, unselecting changing the DA password?
Click to expand...

In a certain moment one can end with "WTF, why my password does not work any longer?" And then they will reset the password (and directadmin will update it for all related services), that's why I personally don't like this approach.
 
I cant find differentiated pw change option in Evo, as it was earlier possible to set them different for DA and FTP. Badly. Neither as user in the profile settings, nor as admin, editing the user (on Tab Modify). I want this feature back though..
 
Just checked the Changelog and only can find in 1.25.1 which says:

Change main ftp account password with DA password. This will keep the 2 passwords in sync. Ability to change the ftp password independently will remain, so the user can still use a different ftp password if he/she wishes. If they want to do that and they change their DA pass, then they'll need to reset the ftp password to the different value.
Click to expand...

Ability to change independently will remain, it's not in Evo. Maybe @fln can explain why not, or maybe forgotten to put in there?
 
Hmm, maybe because its possible, to change the main ftp user pw in the ftp management? But then its still unclear to me, if there is a difference, if i set a new user pw, either in the user managment as admin, or as user in the profile edits, if this works just for DA, or for both, DA & FTP.
 
Richard G said:
No. I don't know how this is done in Evo skin. But in Enhanced skin, you can change the FTP password and de-select the Directadmin password, just as admin and reseller can and then only the FTP password is changed.

I don't see an option to deselect Directadmin in Evo skin, either it's missing or I don't see it, I normally don't use Evo. Just because of these things.
Click to expand...
Thanks for the info. Disabling the main ftp account, just as you can do with additional ftp accounts, would be the best option.

But at least being able to assign a different password to the main ftp account as the enhanced skin offers could be an alternative (a bit sloppy though).
 
You must log in or register to reply here.
Back
Top