Subject: Re: Allowing Onlu ftp on an interface...

From: [email-masked] (Joseph Fornataro)
Date: Tue, 28 Mar 1995 11:28:42 +0800

> Hi wu-ftpd users,
> 
> I am running wu-ftpd on a bastion dual homed host (SOLaris 2.4 IPC).
> Is there a way to specify services like ftp, telnet, smtp, dns etc.
> on a per (ethernet) port basis?  

ftp.win.tue.nl:/pub/security contains version 7 of Wietse Venema's tcp wrapper
package.  You can configure what services to provide by hostname or ip address.
Full documentation is available, and it's free.

...joe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Joseph Fornataro                              [email-masked]
Technical Support Specialist                  (714) 821-2163
CalComp, Inc.                                 (714) 821-2374 FAX

---

From: [email-masked] (Tom Lojewski)
Date: Tue, 28 Mar 1995 12:05:31 -0800 (PST)

> package.  You can configure what services to provide by hostname or ip address.

But, can you guarantee the source address is valid?  What if someone
has broken or spoofed my external router?  I'd like to use TCP Wrapper
in conjunction with a lower level gate that just says, absolutely NO
telnet to the external ethernet port.  Thanks for your reply.

--------------------------------------------------------------------------
Tom Lojewski  -  ACUSON Corp  -  Mountain View, CA - ([email-masked])

---

From: Bill Pemberton <[email-masked]>
Date: Tue, 28 Mar 1995 15:46:52 -0500 (EST)

> telnet to the external ethernet port.  Thanks for your reply.

You can turn off all telnetd stuff with the tcp wrappers.

On my machine, I've got it so that there is only local access to telnetd,
rlogind, etc, but I allow worldwide access to ftpd and httpd (yes, I know
there is still the possiblity of spoofing, but our routers should cut off
any outside stuff).

-- 
Bill Pemberton                           [email-masked]
ITC/Unix Systems                         [email-masked]
University of Virginia                   uunet!virginia!wfp5p