Subject: limiting IP addresses on guest accounts

From: "Roger A. Hanke" <[email-masked]>
Date: Wed, 29 May 1996 14:42:07 -0400

Hello WUFTPD'ers,
 I am running the wu-2.4(1) version on Solaris 2.4 (SunOS 5.4) and thought 
I had everything setup correctly to limit my guest accounts to only be able 
to have access to the server if they were coming in on certain subnets. I 
remember only to well how hard it was setting up the server because 
everytime I tested from a different client machine it would fail until I 
added that IP subnet to my ftpaccess guest class line.

 All of a sudden with my current testing I noticed I could logon to the ftp 
server using regular unix accounts that are not even defined in my 
ftpaccess file. For the guest accounts in my ftpaccess file I could logon 
on from any IP address, it didnt seem to matter what IP addresses I put on 
my guest class line. The only changes I have been making in this area were 
adding additional IP subnets to the guest class line.

 I did run the ckconfig just to make sure my executable version was still 
finding my ftpaccess file and it reported OK. The following line is from my 
/etc/group file: WUFTPDguests::700:ew3srvr,billing. The upload commands do 
work correctly in the ftpaccess file when you are uploading to those 
directories. Now all of a sudden though, people can logon and transfer 
files from all over the machine. So any input would be appreciated.
	Thanx,
	Roger Hanke
-------------------------------------------------------------------
 Roger A. Hanke         AT&T Easy World Wide Web Service
 (908)949-4091          [email-masked] or
 FAX (908)949-7171              [email-masked]
 HO 6C-111              http://lynxhub.ho.att.com/~rah/	
-------------------------------------------------------------------

 #	ftpaccess 1.3 of 29 May 1996
#	@(#)ftpaccess	1.3
# WUFTPD ftpaccess 
file
# Must be customized for each server normally
# IP addresses allowed 
and transport file system name

# TMP entries
#log commands real guest 
anonymous

# Commands used to keep interactive users informed
banner 
/opt/wuftpd/etc/banner
message /opt/wuftpd/etc/msg.logon login

# 
guestgroup entry must be in /etc/group, must contain guest class 
ids
guestgroup WUFTPDguests
#class ew3srvr guest 135.173.112.* 
135.173.114.*
class ew3srvr guest 192.168.1.* 199.118.204.* 135.16.147.* 
135.16.115.*
class billing guest 192.168.1.* 199.118.204.* 135.16.147.* 
135.16.115.*

# just for support personnel interactive field 
transfers
#class EasyWWW real 135.173.112.* 135.173.114.*
class EasyWWW 
real 135.16.147.* 135.16.115.*

# reduce number of allowed login attempts 
from default of 5
loginfails 1

# log every inbound and outbound file 
transfer from guest class accounts
log transfers guest inbound,outbound

# 
disallow compression and file manipulation commands for guest 
classes
compress no guest
tar no guest
chmod no guest
delete no 
guest
rename no guest
umask no guest

# need to allow overwrite 
capabilities
overwrite yes guest

# only allow uploads to inbound 
subdirectory tree
upload /w01transport/wuftpd/ew3srvr * no
upload /w01tr  
ansport/wuftpd/ew3srvr /inbound yes ew3srvr EasyWWW 0770 dirs
upload 
/w01transport/wuftpd/ew3srvr /inbound/* yes ew3srvr EasyWWW 0770 
dirs
upload /w01transport/wuftpd/billing * no
upload 
/w01transport/wuftpd/billing /inbound yes billing EasyWWW 0770 dirs
upload 
/w01transport/wuftpd/billing /inbound/* yes billing EasyWWW 0770 dirs