Subject: Re: limit anonymous ftp

From: Quentin Fennessy <[email-masked]>
Date: Tue, 09 May 1995 12:45:24 -0500

Wu-ftpd cannot enforce that the anonymous email-like password
match that of the person connecting to wu-ftpd.

I believe this is a silly thing to worry about.  This is all about
_anonymous_ ftp.  Anonymous, as in, I don't know who and I really
don't care who is using this server.  Best bet is to let anyone
use whatever string they care to.  

Quentin

PS You can still check the logs for an originating IP address.

---

From: [email-masked] (Bob Haar)
Date: Wed, 10 May 1995 09:18:17 -0400

Well, we now have two contradictory answers from people who both
sound sure of the answer. Which is correct?

>  --><...>
>  -->> Set "passwd-check rfc822 enforce" in your ftpaccess file. See the
>  -->> ftpaccess(5) man page for details.
>  -->>
>  -->
>  -->My question is can wu-ftpd actually enforce that the anonymous passwd
>  -->match the originating account and host ?
>  -->

> From: Quentin Fennessy <[email-masked]>
> 

Well, we do worry about it. We want to make information available
to anyone in the company without having to set up login ids for
them, but keep accurate access logs and prevent access from outside.

We already enforce DNS machine identification and restrict access
to compnay sites, but our security policies require logging the
person, not the machine. Can we at least force users to give
a valid e-mail address?

> From: "Kerr, James A." <[email-masked]>
> 
> 
> Yes it can.  IF your question wasn't already answered let me know and I will 
> Email you instructions.
> Jim
>  ----------

---

From: "The best things in life ... are fantasy." <[email-masked]>
Date: Wed, 10 May 1995 10:26:06 -0400 (EDT)

Excuse me, but how can it enforce that match? All it enforces is that it
obey a certain syntax. It can be totally bogus otherwise. Or am I missing
something?

PCVS

---

From: "The best things in life ... are fantasy." <[email-masked]>
Date: Wed, 10 May 1995 13:33:22 -0400 (EDT)

Hi Minna,

To be honest I am not that well versed in the ins and outs of
system administration, but perhaps you might try to `touch' 
the file thus creating it in advance. Maybe someone more
knowledgeble could jump in here?

Thanks, and good luck.
PCVS

---

From: [email-masked] (Dave Wolfe)
Date: Wed, 10 May 1995 13:38:27 -0500 (CDT)

[ Troy Morrison writes: ]
> On Wed, 10 May 1995, Dave Wolfe wrote:
> 
> > [ Minna Moore writes: ]
> > > I did that, but still have the same problem.
> > > I got the following message in /var/adm/message file. Does it 
> > > related to the above problem? 
> > >   "ftpd[4303]: open of pid file failed: No such file or diretory"
> > 
> > This sounds like your syslog works like my SVR4 syslog: the syslog
> > library function reads a file, /etc/syslog.pid, to get the pid of
> 
> Uh... you mean this isn't the non-existance of the /var directory where 
> wu-ftp logs it's running pids?  That was why I was getting that 
> message... besides, how can wu-ftpd not be able to get the syslog pid if 
> it's logging the error to the syslog?

Oops! You're right, I was mis-remembering how I tracked this down (I
read the log message from truss output, not from any log file). If I'd
have read more carefully, it's obvious that the message was from ftpd
and not the syslog function. Sorry for the noise; please disregard my
earlier response.

-- 
 Dave Wolfe    *Not a spokesman for Motorola*  (512) 891-3246
 Motorola MMTG  6501 Wm. Cannon Dr. W. OE112  Austin  TX  78735-8598