Subject: Re: Allowing Onlu ftp on an interface...

From: Navid Atoofi <[email-masked]>
Date: Tue, 28 Mar 1995 13:22:04 -0500

> Hi wu-ftpd users,
> 
> I am running wu-ftpd on a bastion dual homed host (SOLaris 2.4 IPC).
> Is there a way to specify services like ftp, telnet, smtp, dns etc.
> on a per (ethernet) port basis?  
> 
> In other words, on the external ethernet port I'd like to allow
> certain types of connections (ftp, smtp etc.)  but (for example) NEVER
> telnet.  Is there a way to configure a host to accept a service like
> telnet ONLY if the connection comes from the internal ethernet port?
> 
> I'll be configuring packet filtering on the routers surrounding the
> ftp server so this type packet should never reach the host in the
> first place.  But for added security I'd like the HOST to reject
> these packets as well.
> 
> Is there a package I could install that would do this for me?  Thanks.
> 
> --------------------------------------------------------------------------
> Tom Lojewski  -  ACUSON Corp  -  Mountain View, CA - ([email-masked])
> 
> 

tcp_wrapper is the one

try to get it from cert.org
---------------------------------------------------------------------------
Navid Atoofi               | The jungle is deep and dangerous. 
System Network Engineer    | You are entering the realm of 
[email-masked]            | black magic and deep wizardry, of 
---------------------------| voodoo programming and subtle obfuscation.
vollyball, ebola, ASIC, god| Monsters realm behind every tree, 
Startrek,MICE, Cooking,NSF | ready to pounce. Making it alone, well .... 
DOOM,guru,chaos, solaris   |            --Linux
---------------------------------------------------------------------------

---

From: [email-masked]
Date: Tue, 28 Mar 95 14:56:26 PST

I do that today within inetd.conf - just comment out the telnet line, then

kill -HUP <inetd_pid>

to tell inetd to reread the inetd.conf file.  This does not prevent telnet to SMTP port 25, 
say, but it won't connect a standard telnet to port 23.  I don't know of any way to prevent 
a telnet to port 25, as there is no way to know what client originates a connection; you may 
be able to hack sendmail to _detect_ it and reject it.

See the sendmail fix-kit at avian.org.  If anyone on the list is interested, there is also a 
fixkit for wu-ftpd.  FTP to avian.org:/src/fixkits/*.fix.  All of these are courtesy of 
[email-masked].

This is off the list subject (reads like a firewalls thread, actually), so we might better 
take this offline to go any further.

Michael Brennen

>Joseph Fornataro writes:
>> ftp.win.tue.nl:/pub/security contains version 7 of Wietse Venema's tcp wrapper
>> package.  You can configure what services to provide by hostname or ip address.
>
>But, can you guarantee the source address is valid?  What if someone
>has broken or spoofed my external router?  I'd like to use TCP Wrapper
>in conjunction with a lower level gate that just says, absolutely NO
>telnet to the external ethernet port.  Thanks for your reply.
>