Subject: Host checking

From: [email-masked] (Paul Fincher (CACI))
Date: Thu, 23 May 1996 16:13:13 -0400

Another Question.....

    Can't wu-ftpd be set up so it checks the host doing the ftp can be checked 
in the DNS tables for validity? I need to secure my server so that if the host 
isn't in DNS it fails to open the ftp connection. Thanks :)
    
Paul
--------------------------------------------------------------------------
Paul Fincher   (Customer Support/Webmaster)
J-Mass Operational Support
[email-masked]

---

From: Michael Brennen <[email-masked]>
Date: Thu, 23 May 1996 16:01:29 -0500 (CDT)

> isn't in DNS it fails to open the ftp connection. Thanks :)

Use the PARANOID option in tcp_wrappers, which should already be
front-ending your FTP server.  If not, get it from ftp.win.tue.nl. 

   -- Michael

---

From: Andy Ellsworth <[email-masked]>
Date: Thu, 23 May 1996 16:14:38 -0500 (CDT)

> isn't in DNS it fails to open the ftp connection. Thanks :)

Correct me if I'm wrong, but I believe that's generally done via TCP 
wrappers, rather than by the ftp daemon itself.  You should need 
something in your hosts.deny like:

  ftpd: UNKNOWN

(At least, that's how I have it set up on our boxes around here.)

Andy Ellsworth             | "...The wind was not the beginning.  There are
[email-masked]         | neither beginnings nor endings to the turning of
Assistant Admin, wuarchive | the Wheel of Time.  But it was _a_ beginning..."
http://cec.wustl.edu/~are1 |          --The Wheel of Time saga, Robert Jordan

---

From: Shane Castle <[email-masked]>
Date: Thu, 23 May 1996 15:18:44 -0600 (MDT)

>>     Can't wu-ftpd be set up so it checks the host doing the ftp can
>>be checked in the DNS tables for validity? I need to secure my
>>server so that if the host isn't in DNS it fails to open the ftp
>>connection. Thanks :)

>front-ending your FTP server.  If not, get it from ftp.win.tue.nl. 

I invite your attention to the ftpaccess man page:

          deny <addrglob> <message_file>
               Always deny access to host(s) matching <addrglob>.
               <message_file> is displayed.  <addrglob> may be
               "!nameserved" to deny access to sites without a working
               nameserver.

I think this solves the problem without having to use tcpd as a front
end.  In fact, I can't think of any reason to front-end wu-ftpd with
tcpd, as all that tcpd does, wu-ftpd does, too.

Shane Castle             | "Perfection, then, is finally achieved, not
Boulder County Info Svcs | when there is nothing left to add, but when
Boulder CO USA           | there is nothing left to take away."
                         |                - Antoine de Saint-Exupery

---

From: Andy Ellsworth <[email-masked]>
Date: Thu, 23 May 1996 16:42:01 -0500 (CDT)

On Thu, 23 May 1996, Shane Castle wrote:

[...]

>     In fact, I can't think of any reason to front-end wu-ftpd with

True...but it's also convenient to have all of your tcp_wrapper-ish 
behavior dictated by a single set of configuration files (those being 
hosts.deny and hosts.allow), rather than having to deal with a different 
config file for each wrapper-ish daemon.

To each his own, I suppose.

---

From: "W. James Showalter" <[email-masked]>
Date: Thu, 23 May 1996 18:08:27 -0400 (EDT)

The "deny" option in the ftpaccess file does not work the way Paul asked. 
If set, wu-ftpd does not deny the command connection.  It refuses to allow
login if the source address does not have a registered DNS name.  I
believe only tcp_wrappers provides the desired service (i.e. to deny 
connections). 

At least, that is the way it works on my version (beta-11).

Jim