Subject: Re: oh, this one too

From: Perry Wagle <[email-masked]>
Date: Mon, 23 Jan 1995 15:46:26 -0500

> Is there a way to 'force' a proper user name for anon FTP?
> I wanna track access. 

I use tcp-wrapper to do and log the ident protocol on ftp.  Ident can be
falsified, but FTP isn't going to do any better in figuring out who you
really are.  This way I have one utility doing all the ident stuff.  I am
also anticipating using xinetd instead of tcp-wrapper soon, so keeping it
modularized may be useful.

Some of the people trying to break back into my systems even run wuftpd
and/or identd themselves on their home (386 / Linux?) systems, and may even
be reading this if their internet access hasn't been completely removed by
now.  Hi there, wanna be one of The Good Guys now?

Also, I've found that FTP servers that tried to figure out who I really was
aren't correct.  The problems I recall off-hand are related to the fact that
they ask for my email address.  So maybe MX records need to be considered...
Blah, blah, blah, yuck... 

I figure that anything that can figure out who I am shouldn't require me to
type it in just as a torture test of some sort.

Section 5.4.4 of "Managing Internet Information Services" Cricket Liu, et
al. O'Reilly & Associates, 1994.  Describes the use of restricted guest
accounts (chroot like anonymous, but passworded).

> Also, are there any tools that summarize the xferlog?

Section 6.4 of the same book talks about the xferstats that comes with wuftpd
now in the util subdirectory (found mine, which I got two weeks ago or so).
That help?

-- Perry Wagle, Indiana University Institute for Scientific Computation
   [email-masked]

---

From: Forrest Aldrich <[email-masked]>
Date: Mon, 23 Jan 1995 16:51:36 -0500 (EST)

| I use tcp-wrapper to do and log the ident protocol on ftp.  Ident can be
| falsified, but FTP isn't going to do any better in figuring out who you
| really are.  This way I have one utility doing all the ident stuff.  I am
| also anticipating using xinetd instead of tcp-wrapper soon, so keeping it
| modularized may be useful.
[ ... ]

	I just grabbed the latest tcp_wrappers, version 7.1.  I've been using
	it for a while, but not with pidentd/ident protocol yet.  I figure,
	even though the IDENT protocal can be faked, you're better off with
	a larger paper trail than not (er... binary trail?).  Anyhow, I've
	never heard of xinetd, but if you're considering replacing the tcp_wraps
	with this, I would be interested in taking a look at it... does it
	provide similar functionality, etc?

| Some of the people trying to break back into my systems even run wuftpd
| and/or identd themselves on their home (386 / Linux?) systems, and may even
| be reading this if their internet access hasn't been completely removed by
| now.  Hi there, wanna be one of The Good Guys now?
[ ... ]

	Hehehe... good one.  The problem with that is if they're doing this,
	they've likely hacked the code (and perhaps their server code) to
	report false info.  Who knows... it keeps us on our toes, none-the-less.

	Thanks,

	Forrest

---

From: [email-masked] (Brian D. Schieber)
Date: Tue, 24 Jan 1995 08:06:28 -0500 (EST)

> -- Perry Wagle, Indiana University Institute for Scientific Computation

Thanks,
--Brian

| Brian D. Schieber 
| SeaDAS/SeaWiFS Projects 
| Laboratory for Hydrospheric Processes 
| NASA/Goddard Space Flight Center 
| Code 971/GSC, Greenbelt, MD 20771
| [email-masked] 
| http://shark.gsfc.nasa.gov/~schieb/home_page.html/