Subject: skey vs local authentication for v2.4

From: [email-masked] (David Sears)
Date: Thu, 17 Oct 96 14:16:31 MDT

I have been running wu-ftpd v2.4 with s/key enhancements for quite sometime,
and in general am very happy with its performance.  The machine running the
wu-ftpd is an internal server.  I am running s/key to reduce security risks
associated with connections from an untrusted net through my firewall.  
The firewall is running a ftpd proxy and tcp wrappers.

The configuration can be represented as:

            Untrusted Network
                  |
    Outside Net   |
                  |
               Firewall
                 - ftp proxy (w/access control lists)
                 - tcp wrappers
                  |
     Inside Net   |
                  |
---------------------------------------------------------
   |           |         |             |        |      
ClientA     ClientB    Server       ClientC  ClientD  ...
                         - wu-ftpd
			 - w/s/key

Current ftp Authentication Methods:

   UntrustedNet  --ftp--> Server   S/Key  (must pass tcpd and ACLs
                                           on firewall first)
   ClientA       --ftp--> Server   S/Key
   ALL           --ftp--> Server   S/Key

Desired ftp Authentication Methods:

   UntrustedNet  --ftp--> Server   S/Key  (must pass tcpd and ACLs
                                           on firewall first)
   ClientA       --ftp--> Server   Account password
   ALL InsideNet --ftp--> Server   Account password

However, (there is always a "however,") when any internal client ftps
to my internal server they are also forced to use s/key.  This is
an unnecessary inconvenience, IMHO.  I would like the internal users
to use their account password for internal ftp authentications.  So I made 
some changes to the ftpd.c file (7 lines plus comments) and have included 
them here for comments.

dmsears{442}% diff -c3 ftpd.c ftpd.c.961017
*** ftpd.c      Thu Oct 17 13:41:50 1996
--- ftpd.c.961017       Thu Oct 17 13:39:03 1996
***************
*** 49,60 ****
  #include <sys/file.h>
  #include <sys/wait.h>
  
- /*  961017-dms  FIREWALL definition MUST match the value of the 
-  *              remotehost variable in the pass() subroutine!!!  */
- #ifdef SKEY
- #define FIREWALL "firewall"
- #endif
- 
  #ifdef AIX
  #include <sys/id.h>
  #include <sys/priv.h>
--- 49,54 ----
***************
*** 885,891 ****
          acl_setfunctions();
   
  #ifdef SKEY
!     if ((!skey_haskey(name)) && (strcmp(FIREWALL,remotehost)==0))
          reply(331, "Password [%s] for %s required.", skey_keyinfo(name), name);
      else
  #endif
--- 879,885 ----
          acl_setfunctions();
   
  #ifdef SKEY
!     if (!skey_haskey(name))
          reply(331, "Password [%s] for %s required.", skey_keyinfo(name), name);
      else
  #endif
***************
*** 1009,1015 ****
              passwd++;
   
  #ifdef SKEY
!         if ((!skey_haskey(the_user)) && (strcmp(FIREWALL,remotehost)==0))
          {
             i = skey_passcheck(the_user, passwd);
   
--- 1003,1009 ----
              passwd++;
   
  #ifdef SKEY
!         if (!skey_haskey(the_user))
          {
             i = skey_passcheck(the_user, passwd);

Can anyone see additional risks associated with these changes?  Better
ideas always welcomed.

TIA

David