Subject: Disallowing no-reverse DNS sites

From: [email-masked]
Date: Tue, 6 Aug 1996 17:49:41 -0400

Hi,

I would like to find out how to disallow logins from sites which don't
have reverse DNS setup.

Thanks much

Lennard

---

From: Paul Matthews <[email-masked]>
Date: Tue, 6 Aug 1996 18:08:04 -0400 (EDT)

> I would like to find out how to disallow logins from sites which don't
 
Lennard,

Recompile using PARANOID option.

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Wed, 7 Aug 1996 09:04:24 +0200 (MET DST)

>From the ftpaccess man page :

       deny <addrglob> <message_file>
            Always deny access to  host(s)  matching  <addrglob>.
            <message_file>   is  displayed.   <addrglob>  may  be
            "!nameserved" to deny access to sites without a work-
            ing nameserver.

                                            Grtx KH

-- 
  Koos van den Hout,     Internetter, Unix freak, ISFJ and BBS SysOp at large
  [email-masked] (Home)        BBS Koos z'n Doos (+31-30-6036637 28k8)
  [email-masked] (Work)  <-- finger -l for PGPkey    (+31-30-6056619 14k4)
  http://www.hvu.nl/~koos (WWW)    Looking for a license plate with "RFC 822"
  Quando Omni Flunkis Moritati (If all else fails - play dead)     KH106-RIPE

---

From: Ric Anderson <[email-masked]>
Date: Wed, 7 Aug 1996 07:32:17 -0700 (MST)

Try putting this line in ftpaccess:
	deny !nameserved /path/to/message
where "/path/to/message" is file telling the unlucky person why
service is being denied.

Ric (<[email-masked]> "Ric Anderson", using RTD's public internet access)

---

From: Carlos Lazcano-Vega <[email-masked]>
Date: Wed, 7 Aug 1996 10:00:47 -0500 ()

>             "!nameserved" to deny access to sites without a work-

Wouldn't it also deny access to the computers that don't have an entry
on the DNS?

---
Carlos Lazcano-Vega                 Voice: (52-8) 358-2000 x4084
Internet Services Manager           Fax: (52-8) 328-4129
ITESM / Technological Computing     Email: [email-masked]
Av. Eugenio Garza Sada 2501 Sur     http://homepages.mty.itesm.mx/~clazcano/
Sucursal de Correos "J"
Monterrey, N.L, Mexico. CP 64849    Heroes get remembered; legends never died

            *** All my opinions are not really opinions ***

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Wed, 7 Aug 1996 17:04:59 +0200 (MET DST)

> Wouldn't it also deny access to the computers that don't have an entry

Yes. It's a policy question whether you accept that or not.

                                                Grtx KH

---

From: Shane Castle <[email-masked]>
Date: Wed, 7 Aug 1996 09:22:43 -0600 (MDT)

>Yes. It's a policy question whether you accept that or not.

The "!nameserved" is actually misleading.  What this actually means is
"disallow access if the IP address does not resolve to a hostname".
Perhaps a better notation would be "!resolve" or "!hostname".  A
misconfigured DNS server could have an A record for a hostname
(hostname maps to an IP address) but forget to have the reverse mapping
PTR record in an in-addr.arpa file (or have no such lookup at all).
This would produce the same result.

Shane Castle             | "Perfection, then, is finally achieved, not
Boulder County Info Svcs | when there is nothing left to add, but when
Boulder CO USA           | there is nothing left to take away."
                         |                - Antoine de Saint-Exupery

---

From: "James B. Byrne" <[email-masked]>
Date: Wed, 07 Aug 1996 11:41:24 -0400

> Wouldn't it also deny access to the computers that don't have an entry

Yes, but this would only be an issue for someone dealing with a poorly
setup ISP or internet connected corporate LAN.  In both cases a squawk
at the appropriate decible level should obtain the desired modification.

Regards,
-- 
James B. Byrne			mailto:[email-masked]
Harte & Lyne Limited		http://www.harte-lyne.ca
Hamilton, Ontario		905-561-1241