Subject: Help with FTP Access

From: Paul Matthews <[email-masked]>
Date: Sun, 19 May 1996 18:32:04 -0400

I am in a pickle. I had anonymous and real FTP working okay. I then
tried to install tcp wrappers. Now, nobody can ftp to my Linux
box. Can anyone suggest a solution?

In inetd.conf I have the following:

ftp  stream  tcp  nowait  root  /usr/sbin/tcpd /usr/sbin/wu.ftpd  -l -a

Telnet works (but only if my in-telnetd can verify the IP address/host
name by reverse lookup.

Is there any way to disable reverse lookup?

Any suggestions would be appreciated. I have tried several things,
including the fine manual, but I haven't hit on a solution yet.

Paul Matthews
McLean, VA
e-mail: [email-masked]

---

From: Brian Harvell <[email-masked]>
Date: Sun, 19 May 1996 18:45:02 -0400 (EDT)

> including the fine manual, but I haven't hit on a solution yet.

When you compile tcpd turn off PARANOID= -DPARANOID in the Makefile.

This should disable hostname lookups altogether.

Here is the piece of the Makefile of importance.

Brian Harvell [email-masked] <a href="http://www.iNet.net/~harvell/">go</a>

####################################################
# Optional: dealing with host name/address conflicts
#
# By default, the software tries to protect against hosts that claim to
# have someone elses host name. This is relevant for network services
# whose authentication depends on host names, such as rsh and rlogin.
#
# With paranoid mode on, connections will be rejected when the host name
# does not match the host address. Connections will also be rejected when
# the host name is available but cannot be verified.
#
# Comment out the following definition if you want more control over such
# requests. When paranoid mode is off and a host name double check fails,
# the client can be matched with the PARANOID access control pattern.
#
# Paranoid mode implies hostname lookup. In order to disable hostname
# lookups altogether, see the next section.

PARANOID= -DPARANOID

########################################
# Optional: turning off hostname lookups
#
# By default, the software always attempts to look up the client
# hostname.  With selective hostname lookups, the client hostname
# lookup is postponed until the name is required by an access control
# rule or by a %letter expansion.
#
# In order to perform selective hostname lookups, disable paranoid
# mode (see previous section) and comment out the following definition.

HOSTNAME= -DALWAYS_HOSTNAME

#############################################
# Optional: Turning on host ADDRESS checking
#
# Optionally, the software tries to protect against hosts that pretend to
# have someone elses host address. This is relevant for network services
# whose authentication depends on host names, such as rsh and rlogin,
# because the network address is used to look up the remote host name.
#
# The protection is effective only when the offending host claims to have
# a network address that lies outside its own network.
#
# My site has been running rlogind and rshd daemons that implement this
# feature for more than 2 years, and without any ill effects.
#
# This feature cannot be used with SunOS 4.x because of a kernel bug in
# the implementation of the getsockopt() system call. Kernel panics have
# been observed for SunOS 4.1.[1-3]. Symptoms are "BAD TRAP" and "Data
# fault" while executing the tcp_ctloutput() kernel function.
#
# Reportedly, Sun patch 100804-03 or 101790 fixes this for SunOS 4.1.x.
#
# Uncomment the following macro definition if your getsockopt() is OK.
#
 KILL_OPT= -DKILL_IP_OPTIONS

## End configuration options
############################