Subject: Re: WU-ftpd Un-official Patches

From: [email-masked] (Rob Hewlett)
Date: Fri, 21 Jul 1995 13:41:39 +0100

TCP wrappers and a bunch of other nice security/functionality stuff can be
found at http://ciac.llnl.gov/ciac/ToolsUnixNetSec.html 

>Okay -- everyone knows that having one machine that can respond
>differently to URLs like http://alpha.com/ and http://bravo.com/ is a
>good thing, and that it can't just be done with DNS CNAMEs.
>
>The quoted message below is from the Washington University FTP Daemon
>mailing list, wu-ftpd.  It seems to indicate that you can make this
>happen with TCP-Wrapper.  Previously, I'd gotten a URL from Prentiss,
><http://www.thesphere.com/%7Edlp/TwoServers/>, that documented another
>approach.
>
>What would be the difference between having destination-address
>sensitive HTTP, FTP (or, hmmmm... in.telnetd...) daemons using
>TCP-Wrapper and using one of the methods (interface aliasing with
>ifconfig, or defining numerous routing PPP interfaces) described at URL
><http://www.thesphere.com/%7Edlp/TwoServers/>?
>
>Am I missing something here?  It seems like TCP Wrapper is the better
>solution, 'cause you get to install more security on your machine as
>well.  Wait -- maybe I am missing something.  TCP Wrapper can't possibly
>make your machine respond to additional IP addresses, right?  You've
>still got to do the http://www.thesphere.com/%7Edlp/TwoServers/ thing to
>make the IP address work on a given interface, but once that address
>works, then, I guess, your choice is to either use patched daemons (or
>daemons that are smart enough to be used with virtual interfaces) or use
>TCP Wrapper to mediate the access.
>
>Do I appear to have a moderately clear understanding of this issue? Any
>obvious lack of clue?
>
>cheers,
>-KwM-
>
>oh -- btw, Cathy.  My condolences on becoming sole support of the world.
>
>[...]
>>From [email-masked] Fri Jul 21 11:12:04 1995
>>Date: Fri, 21 Jul 1995 12:09:49 +0100
>>From: [email-masked] (Rob Hewlett)
>>To: [email-masked]
>>Subject: Re: WU-ftpd Un-official Patches
>>
>>>I'm seriously interested in having a system which responds differently
>>>depending upon which network interface is used to get into the system.
>>>For example, when ftping to 1.2.3.4, you would appear to reach a host
>>>called "xxx.com", while going to 1.2.4.5 you get "yyy.gov".  I remember
>>>seeing discussion of this fairly recently.
>>
>>I've just set that exact process up with a program called TCP Wrappers.  It
>>allows you to look for origin or destination addresses and act upon them.
>>It basically sits between inetd and whatever daemon program you will be
>>running (it works for telnet and WWW too).  Basically, you have to compile
>>different
>>wu-ftpd if you would like to change the options for each system (for example, 
>>I changed several directories, and changed the chroot() command for each
>>instance of the program I am running).  Then I configured TCP Wrappers to
>>run different daemons depending upon the address of the ftp request(there
>>was also and ifconfig in there somewhere to set up an alias for the machine).
>>
>>Hope that was what you were looking for.
>>
>>-Rob
>
>