Subject: [312] Trying to set up name filtering w/ wu-ftpd

From: "William C. Shutters" <[email-masked]>
Date: Mon, 08 Aug 1994 11:01:58 -0500 (CDT)

ObDisclaimer:  I am new to this mailing list, so I wish to apologize
in advance if this topic has been covered before.  Also, I have read
most of the wu-ftpd man pages, but I haven't grubbed through the
code much yet.

I am currently attempting to learn how to properly configure the
wu-ftpd to allow or deny access based on fully-qualified domain
name.  Here is my particular situation.  Maybe you will have some
pointers for me?  :-)

I need to restrict access to an ftp server so that only *.mil can
gain anonymous access.  (Yes, I know how easy it is to spoof FQDNs.
We aren't protecting any sensitive information.  Now hush.)  We are
currently using tcp-wrappers, which does a marvelous job of denying
access when appropriate.  The down side, however, is that those users
who are denied access are denied because their DNS servers do not
have the reverse-DNS lookup tables filled in.  Because tcp-wrappers
(AFAIK) can't send out informational messages like wu-ftpd can, we
get all kinds of calls from users who think there is a problem at OUR
end :-(.

So we would like to remove the tcp-wrapper and allow the wu-ftpd to
perform the filtering function.  I have seen multiple ways to do
this, and I am not sure which one is the CORRECT way to go.

1.  It appears that I could use the <class>, <limit>, and
<deny !nameserved> keywords in the ftpaccess file to define a class
"nonmil" that is limited to zero users at all times.
Questions:	Is a limit of zero correct/sensible?
		Will a zero limit be interpreted as no access by
		  the wu-ftpd?
		Is this the way to go?

2.  It also appears that I could use the ftphosts file to allow/deny
access.  This appears to be quite flexible, but how reliable is it?
Is it any more or less reliable than number 1 above?  Is THIS the
way to go?

Are there any other ways to get the job done that I am missing?

Thank you in advance for your help,

Chris Shutters
[email-masked]