Subject: Re: login problems from certain hosts

From: "Steve Newell" <[email-masked]>
Date: Thu, 18 Jul 1996 09:32:05 +0000

> On Wed, 17 Jul 1996, Steve Newell wrote:
> 
> > Looking in my /var/adm/syslog, I see the following:
> > 
> > Jul 17 16:04:10 linux wu.ftpd[844]:
>   warning: can't verify hostname:gethostbyname(oneseventeen246.metawire.com) failed 
> > Jul 17 16:04:10 linux wu.ftpd[844]:
>   refused connect from 204.80.117.246
> 
> This is a DNS mismatch for the site that failed.  Looks like you're
> running ftpd from behind tcp wrappers and wrappers is configured or
> compiled with PARANOID. 
> 
> Two nslookups are below.  The first does the reverse lookup on the IP
> address, then tries to verify that name with a forward lookup.  Oops --
> didn't match.  PARANOID will refuse a connect from such a site.
> 
> The answer is to fix the DNS, not remove PARANOID.
> 
> 
> /etc# nslookup 204.80.117.246
> Server:  ns1.fni.com
> Address:  204.181.104.1
> 
> Name:    oneseventeen246.metawire.com
> Address:  204.80.117.246
> 
> /etc# nslookup oneseventeen246.metawire.com
> Server:  ns1.fni.com
> Address:  204.181.104.1
> 
> *** ns1.fni.com can't find oneseventeen246..metawire.com: Non-existent 
> host/domain
> 
> 
>    -- Michael
> 
> 

I am not running from behind tcp wrappers, at least I didn't install 
it . 

I'm afraid you lost me when you suggested I fix DNS.  I have the same 
results from nslookup that you do.  Any further pointers?

Thanks,

Steve
/*************************************************/
/*                  Steve Newell                 */
/*                [email-masked]             */
/*                Roberts-Slade, Inc.            */
/*************************************************/

---

From: Michael Brennen <[email-masked]>
Date: Thu, 18 Jul 1996 09:57:00 -0500 (CDT)

> I am not running from behind tcp wrappers, at least I didn't install 

Look at the ftp line in your /etc/inetd.conf.  If it looks similar to the
line below (tcpd is the key) you are running ftp behind tcp wrappers. 

ftp stream  tcp nowait  root    /usr/sbin/tcpd  /usr/sbin/wu.ftpd -t300 -a

Do you have a /etc/host.allow and /etc/hosts.deny file?  These control
specific services for tcp wrappers.

The latest copy of tcp_wrappers (7.4) is at
<URL:ftp://ftp.win.tue.nl/pub/security/>.

> results from nslookup that you do.  Any further pointers?

The problem is on the *other* end.  They have to fix it, not you.

For DNS, get the O'Reilly book on "DNS and Bind" by Albitz/Liu.  See
http://www.ora.com/ for more info on the book.

   -- Michael

---

From: Shane Castle <[email-masked]>
Date: Thu, 18 Jul 1996 09:23:48 -0600 (MDT)

On Thu Jul 18 03:32:05 1996, Steve Newell wrote:

[Warning: deleted invalid attribution headers]

>I am not running from behind tcp wrappers, at least I didn't install 

Well, you certainly seem to be.  Is there a line like 'tcpd wu.ftpd' in
your inetd.conf?

>results from nslookup that you do.  Any further pointers?

Following is the result of 'dig any oneseventeen246.metawire.com':

; <<>> DiG 2.0 <<>> any oneseventeen246.metawire.com 
;; ->>HEADER<<- opcode: QUERY , status: NXDOMAIN, id: 6
;; flags: qr aa rd ra ; Ques: 1, Ans: 0, Auth: 1, Addit: 0
;; QUESTIONS: 
;;	oneseventeen246.metawire.com, type = ANY, class = IN

;; AUTHORITY RECORDS:
metawire.com.	86400	SOA	metawire.com.  hostmaster.metawire.com. (
			9607094	;serial
			86400	;refresh
			3600	;retry
			86400	;expire
			86400 )	;minim

;; Sent 1 pkts, answer found in time: 207 msec 
;; FROM: bcx01.boco.co.gov to SERVER: default -- 161.98.128.4
;; WHEN: Thu Jul 18 09:12:06 1996
;; MSG SIZE  sent: 46  rcvd: 105

You should contact [email-masked] and get him to fix his DNS
files.  I'll withhold any comments about his competency.  What he needs
to to is add an "A" record for oneseventeen246.metawire.com.

BTW, I did a 'dig @metawire.metawire.com axfr metawire.com' and got a
HUGE number of lines back (3900, in fact).  Looks like he has no
definitions for anyone in the 204.80.117.0 subnet at all.

Shane Castle             | "Perfection, then, is finally achieved, not
Boulder County Info Svcs | when there is nothing left to add, but when
Boulder CO USA           | there is nothing left to take away."
                         |                - Antoine de Saint-Exupery