Subject: Access control (restricting "real" login hosts)

From: Ross Wheeler <[email-masked]>
Date: Wed, 30 Oct 1996 22:49:46 +1100 (EST)

Hi,
   I've spent the last hour reading through the archives, and am 
surprised not to have found an answer. Perhaps it's so simple I just 
can't see it?!

Problem: I want to allow anonymous login from anywhere, but "real" logins 
must come from one of a specified set of hosts.

I had used /etc/ftphosts with entries of:

	allow	anonymous	*
	allow	ALL		*.my.domain
	allow	ALL		*.your.domain

It doesn't work, but the man page (ftphosts) doesn't cover it very well!

Surely, this is not an uncommon request? Anyone got a working skeleton 
they can send me please?

Regards, RossW

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Wed, 30 Oct 1996 15:00:41 +0100 (MET)

> I had used /etc/ftphosts with entries of:

Maybe it's better to define classes, and limit them to 0, like :

class visitors anonymous *
class users real *.mydomain.com
class wrong real *

limit visitors  100   Any   /var/spool/ftpd/msgs/msg.toomanyanon
limit users     100   Any   /var/spool/ftpd/msgs/msg.toomanyuser
limit wrong       0   Any   /var/spool/ftpd/msgs/msg.noaccess

                                          Grtx KH

-- 
  Koos van den Hout,     Internetter, Unix freak, ISFJ and BBS SysOp at large
  [email-masked] (Home)        BBS Koos z'n Doos (+31-30-6036637 28k8)
  [email-masked] (Work)  <-- finger -l for PGPkey    (+31-30-6056619 14k4)
  http://www.hvu.nl/~koos (WWW)    Looking for a license plate with "RFC 822"
  Unix op z'n NL's : Segment overtreding - kern uitgescheten       KH106-RIPE

---

From: Michael Brennen <[email-masked]>
Date: Wed, 30 Oct 1996 10:50:25 -0600 (CST)

I have no idea where you are getting the "allow" directive; it is not in
the latest beta 11.  Try the following in your /etc/ftpaccess, as well as
'man ftpaccess'. 

class   remote  anonymous * localhost
class   my      real      *.my.domain
class   your    real      *.your.domain

   -- Michael

---

From: Alain Magloire <[email-masked]>
Date: Wed, 30 Oct 1996 12:43:56 -0500 (EST)

> the latest beta 11.  Try the following in your /etc/ftpaccess, as well as

The 'allow' directive is use in _PATH_FTPHOSTS
by default, it will map to

#define _PATH_FTPHOSTS  "/etc/ftpd/ftphosts"

The man page is short and dry ;-)... but he ! Don't we love Unix :) 
You can have does two directives in ftphosts.

     allow <username> <addrglob> [<addrglob> ...]
          Only allow host(s) matching <addrglob>  to  log  in  as
          <username>.

     deny <username> <addrglob> [<addrglob> ...]
          Always deny host(s) matching <addrglob> to  log  in  as
          <username>.

the problem with Ross Wheeler scheme was the misuse
of the <username> field. It has to be a <USERNAME> login
not a <TYPELIST>.

So a line like this in _PATH_FTPHOSTS:

deny rossw home.albury.net.au

will logout `rossw' from ftpd server home.albury.net.au

But if you're trying to restrict a class of user then
ftpaccess should be use instead. See Michael Brennen
and Koo V. D. H. posts.

Note: also the ftpusers can be handy but like ftphosts,
      there is no globing on the username so each
      must have an entry.
--
alain