Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using AIX (6.1) FTPD, a user needs to log in and it should only reach 2 directories (read/write) in the system, ex.:




Besised the users home directory it shouldn't reach anything. These two directories are used by others too.

How can we do this? We cannot do it with normal ACL's, because in that case IMHO we need to remove the "other" permission from all the files that are not in the mentioned two paths.

I heard that we can do this with Extended ACL's. But how?

share|improve this question

I know this might not be the answer you are looking for, but ACL (Access Control List) is a very granular permission, assigned to every each file, not to users or directories. And as far as I know there is no such thing as extended ACL on AIX. There are base file permissions, as in Owner:rwx, Group:rwx and Others:rwx, which are common UNIX knowledge. Then come attributes, i.e. setuid, setgid and savetext, which are lesser known but for a seasoned unix admin, they should be quite obvious. And lastly come the extended attributes which are commonly referred as ACLs, assigned to every each file, one by one. These are (directly copied from IBM's definitions):

permit: Grants the user or group the specified access to the file

deny: Restricts the user or group from using the specified access to the file

specify: Precisely defines the file access for the user or group

For the exact usage of how these values can be set or removed, you need to see the man page for acledit on your AIX system.

After having said all of this, I don't believe this is what you need considering your special case with ftp jailing. If you are planning to have anonymous type ftp and don't want incoming parties to access above the home directory you set for this user(s), you need to see the document at IBM's website, guiding you step-by-step, how to enable anonymous ftp. Document can be found at: http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.security/doc/security/HT_security_anonymous_ftp.htm

If anonymous ftp is not your concern but you want to create a jailed ftp environment for a user who will log in with a preset username and password, then you should consider something like a proftpd, install and usage details of which, can be found at:


It is in French but I am sure you can use google translate to make it English if you absolutely want. proftpd is an rpm package installable on IBM P series servers running AIX. The document says AIX v5.2 but there shouldn't be much change for 5.3 and later versions.

I hope this gives you a starting point. But again, curious minds may wonder, in this day and age, where security is a critical concept, why one might want to use an insecure protocol like ftp instead of using something like scp. Just think about it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.