Subject: problem with starting wu-ftp

From: Shlomit Afgin <[email-masked]>
Date: Tue, 25 Apr 1995 15:22:55 +0300 (WET)

When I'm tring to use wu-ftpd-2.4 on IRIX 5.2 I get :
ftp sgi-machine
ftp: connect: Connection refused
ftp>

Is there any place I can get more informations about wu-ftpd ?
Thanks,
	Shlomit.

---

From: Shlomit Afgin <[email-masked]>
Date: Wed, 26 Apr 1995 14:47:38 +0300 (WET)

> Is there any place I can get more informations about wu-ftpd ?

The above problem solved - I had to kill the inetd with -9 and not with -1.

I have another question, is there any way to check that user write a correct
email address when he write the the passwd of the anonymous account? otherwise 
he can write any garbage he want.

Thanks,
	Shlomit.

---

From: [email-masked] (Patrick Salsbury)
Date: Thu, 27 Apr 95 10:25:56 PDT

-I have another question, is there any way to check that user write a correct
-email address when he write the the passwd of the anonymous account? otherwise 
-he can write any garbage he want.
-
-Thanks,
-	Shlomit.
-
>From "The Ftpaccess Manpage" ("TFM") ;^)  :

				 (snip snip)
-------------------------------------------------------------------------------
     passwd-check <none|trivial|rfc822> (<enforce|warn>)
          Define the level and enforcement of  password  checking
          done by the server for anonymous ftp.

            none      no password checking performed.
            trivial   password must contain an '@'.
            rfc822     password  must  be  an  rfc822   compliant
          address.

            warn      warn the user, but allow them to log in.
            enforce   warn the user, and then log them out.
-------------------------------------------------------------------------------

Pat
-------------------------------------------------------------------------------
	  Patrick Salsbury 	              SCO/IXI/Visionware           
	Sys Admin/Webmaster                   330 Encinal Street
	Voice: 408-429-4529	             Santa Cruz, CA 95060
	 FAX: 408-427-5460	      X/UNIX/PC Integration Specialists
 Check out <A HREF="http://www.visionware.com/">The Visionware Homepage</A>

---

From: FV Admin mail <[email-masked]>
Date: Thu, 27 Apr 1995 13:38:14 +0100

>           done by the server for anonymous ftp.

This only checks the syntax. It doesn't check that the email address is 
valid.  I could log in as 

[email-masked]

and it would pass. The best it can reliably (heh) do is assure that 
foogle.com accepts SMTP connections.   --Darren

---

From: "Charles L. Hutson" <[email-masked]>
Date: Thu, 27 Apr 1995 13:42:16 -0400 (EDT)

Regarding the reference to the man page below.  My passwd-check entry
looks like this:

passwd-check rfc822 enforce

I would expect this to verify that the anonymous user's passwd
would be resolved and validated.  However, I can log in as 
anonymous with a passwd like [email-masked]
and still get in no problem.  I would have hoped that it would
have tried to contact "lasjdlfj.skdjflsjdlf.dskjflksf" and would
have determined that it was invalid.  

Charles L. Hutson
Piedmont Technology Group 
|
|-I have another question, is there any way to check that user write a correct
|-email address when he write the the passwd of the anonymous account? otherwise 
|-he can write any garbage he want.
|-
|-Thanks,
|-	Shlomit.
|-
|>From "The Ftpaccess Manpage" ("TFM") ;^)  :
|
|				 (snip snip)
|-------------------------------------------------------------------------------
|     passwd-check <none|trivial|rfc822> (<enforce|warn>)
|          Define the level and enforcement of  password  checking
|          done by the server for anonymous ftp.
|
|            none      no password checking performed.
|            trivial   password must contain an '@'.
|            rfc822     password  must  be  an  rfc822   compliant
|          address.
|
|            warn      warn the user, but allow them to log in.
|            enforce   warn the user, and then log them out.
|-------------------------------------------------------------------------------
|
|Pat
|-------------------------------------------------------------------------------
|	  Patrick Salsbury 	              SCO/IXI/Visionware           
|	Sys Admin/Webmaster                   330 Encinal Street
|	Voice: 408-429-4529	             Santa Cruz, CA 95060
|	 FAX: 408-427-5460	      X/UNIX/PC Integration Specialists
| Check out <A HREF="http://www.visionware.com/">The Visionware Homepage</A>
|

---

From: Navid Atoofi <[email-masked]>
Date: Thu, 27 Apr 1995 15:25:02 -0400 (EDT)

> >From "The Ftpaccess Manpage" ("TFM") ;^)  :

If you are as parnoid as me, I have solution.
Install tcp_wrapper for ftp ( on the parnoid mode) will block the bad 
hostnames. 
some shell to use SYSLOGS and backfinger and make sure that the ftp 
loggin is a life user on the destination machine, If it is not kill the ftp session, 
Somewhat possible to achive it in the setup of the tcp-warapper with 
extension language.
I was hoping that I be able to get some of the information about the 
validity of the user through smtp(port 25). But,I abondoned the whole project.

  +--------------------------+
  |Navid Atoofi           +--|--------------------------+
  |System Network Engineer|"none of these are my ideas" |
[email-masked]        |    "they made me say it"    |
| | (617) 873-5246        |        Blah, Blah           |
| +-----------------------|    Yes, No, Cool, Ugh       |\
|The jungle is deep and   +-----------------------------+ \
|dangerous. You are entering the realm of black magic     /
|and deep wizardry, of voodoo programming and subtle     /
|obfuscation. Monsters realm behind every tree, ready   /
|to pounce. Making it alone, well .                    /
+-----------------------------------------------------/

---

From: "Charles L. Hutson" <[email-masked]>
Date: Thu, 27 Apr 1995 15:54:47 -0400 (EDT)

Where would I get a tcp wrapper such as the one described below?

Charles L. Hutson
Piedmont Technology Group Inc.

|
|
|
|
|On Thu, 27 Apr 1995, Patrick Salsbury wrote:
|
|> -I have another question, is there any way to check that user write a correct
|> -email address when he write the the passwd of the anonymous account? otherwise 
|> -he can write any garbage he want.
|> -
|> -Thanks,
|> -	Shlomit.
|> -
|> >From "The Ftpaccess Manpage" ("TFM") ;^)  :
|> 
|> 				 (snip snip)
|> -------------------------------------------------------------------------------
|>      passwd-check <none|trivial|rfc822> (<enforce|warn>)
|>           Define the level and enforcement of  password  checking
|>           done by the server for anonymous ftp.
|> 
|>             none      no password checking performed.
|>             trivial   password must contain an '@'.
|>             rfc822     password  must  be  an  rfc822   compliant
|>           address.
|> 
|>             warn      warn the user, but allow them to log in.
|>             enforce   warn the user, and then log them out.
|> -------------------------------------------------------------------------------
|> 
|> Pat
|> -------------------------------------------------------------------------------
|> 	  Patrick Salsbury 	              SCO/IXI/Visionware           
|> 	Sys Admin/Webmaster                   330 Encinal Street
|> 	Voice: 408-429-4529	             Santa Cruz, CA 95060
|> 	 FAX: 408-427-5460	      X/UNIX/PC Integration Specialists
|>  Check out <A HREF="http://www.visionware.com/">The Visionware Homepage</A>
|> 
|
|
|
|
|If you are as parnoid as me, I have solution.
|Install tcp_wrapper for ftp ( on the parnoid mode) will block the bad 
|hostnames. 
|some shell to use SYSLOGS and backfinger and make sure that the ftp 
|loggin is a life user on the destination machine, If it is not kill the ftp session, 
|Somewhat possible to achive it in the setup of the tcp-warapper with 
|extension language.
|I was hoping that I be able to get some of the information about the 
|validity of the user through smtp(port 25). But,I abondoned the whole project.
|
|
|  +--------------------------+
|  |Navid Atoofi           +--|--------------------------+
|  |System Network Engineer|"none of these are my ideas" |
[email-masked]        |    "they made me say it"    |
|| | (617) 873-5246        |        Blah, Blah           |
|| +-----------------------|    Yes, No, Cool, Ugh       |\
||The jungle is deep and   +-----------------------------+ \
||dangerous. You are entering the realm of black magic     /
||and deep wizardry, of voodoo programming and subtle     /
||obfuscation. Monsters realm behind every tree, ready   /
||to pounce. Making it alone, well .                    /
|+-----------------------------------------------------/
|
|

---

From: [email-masked]
Date: Thu, 27 Apr 1995 16:48:09 -0400 (EDT)

ftp.tue.win.nl, in /pub/security 

					gary