Subject: Problem with RFC822 checking

From: "Scott W. Tyree" <[email-masked]>
Date: Wed, 18 Sep 1996 15:20:37 -0400 (EDT)

In my /etc/ftpaccess file I have:

	password-check rfc822 warn

It appears that as long as the userid part of the password is 7 characters
it works fine, but if it's more or less I get the following:

Name (ftp.server.name:userid): anonymous
331 Guest login ok, send your complete e-mail address as password.
Password:
230-The response '123456@s' is not valid
230-Next time please use your e-mail address as your password
230-        for example: [email-masked]
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> 

Anyone seen this before and know what the fix is?

Thanks in advance,
Scott Tyree

---

From: Alain Magloire <[email-masked]>
Date: Thu, 19 Sep 1996 10:21:42 -0400 (EDT)

> Anyone seen this before and know what the fix is?

yes the validate_eaddr(char *passwd) is very weak.
But there is not limit on the user part off the passwd
so
'12345678910@'
will work fine but on the ortherhand
'1234567@x'
will give you a warning.
It will not accept a hostname of only one character ;-)
that's why 
'123456@s'
is giving you warnings but
[email-masked]
will work fine.

Furthermore, suppose you have ftpd running on machine foo.bar.com
you are on machine foo.bar.com you loggin to ftp as anonymous
giving a passwd like
'joe@foo'
Ftpd will give you a warning and even log you out if you had 'enforce' ;-)
but
[email-masked]'
or
'joe@'
or
[email-masked]'
will work fine. Just take a look at the src in ftpd.c you will see
what I mean.

> Anyone seen this before and know what the fix is?

none that I know of, aside from rewriting validate_eaddr()
or simply advertise to your clients
'username@'
just with the '@' nothing else after

BTW, if you decide to rewrite validate_eaddr() be a gentleman...
send me a patch ;-)

cheers,
--
alain