Subject: Re: no fake anonymous passwords

From: Bob Luckin <[email-masked]>
Date: Wed, 6 Nov 96 14:09:05 CST

Bill said :-
> I have hacked the beta-11 code to extend the rfc822 checking to reject
> various known bogus passwords (mozilla@ comes to mind :-).  I currently
> have this set to warn on our ftp site, ftp.celestial.com, and am
> considering putting this to enforce (after all giving valid e-mail
> address is a small price to pay for the free software that people
> download from our site).  The main problem with doing this at this
> time is that there's no way to get Netscape 2.0 to provide a real
> e-mail address replacing their mozilla crap.

I've done something similar with the internal FTP server I run here - people
have to supply their employee number, rather than some arbitrary email
address.

Browsers tend to try to supply an email address by default, which would
be rejected by the FTP server.  I got round the problem by writing a CGI
script which prompts the user for their number, and then uses this to
return the HTTP "Location:" header to the browser, with the password they
entered built in to the URL.  This seems to work fine.

Then instead of creating a straight link to your FTP server on the original
HTML page, you create a link to the CGI script instead.

Hope this suggestion helps !

Cheers, Bob
-- 
Bob Luckin                   EDA Systems Distribution and Billings team
Texas Instruments
P O Box 650311, MS 3937      MSG: VOLY              Email: [email-masked]
Dallas, TX 75265   U.S.A.    Tel: (972) 917 5081    Fax: (972) 917 7966

---

From: Alain Magloire <[email-masked]>
Date: Wed, 6 Nov 1996 16:21:32 -0500 (EST)

[..deleted..]
> HTML page, you create a link to the CGI script instead.

My HTML and CGI is out of date but if a user specify a URL like this in
the Web Browser:

ftp://your.host.name/pub/foo.txt

I don't think CCI scripts will help. The browser will contact
directly the FTP daemon.

What I mean is: once they pass the CGI script and enter
FTP, when they save the link in their Bookmarks .. It will
show:
ftp://hostname...
^^^

> Hope this suggestion helps !

yes, I do think you have a good idea nevertheless.

--
alain

---

From: [email-masked] (Bill Campbell)
Date: Wed, 6 Nov 1996 13:43:23 -0800 (PST)

...
>ftp://your.host.name/pub/foo.txt
Actually this just gets it to go to the site without password checking.
It will force netscape to ask for a password if the URL is something like:
	ftp://[email-masked]/pub/foo.txt

This doesn't help though if the person simply puts ftp://site.name/ in
manually since Netscape will then supply it's Mozilla silliness.

Bill
--
INTERNET:   [email-masked]  Bill Campbell; Celestial Systems, Inc.
UUCP:               camco!bill  PO Box 820; 2835 82nd Avenue S.E. S-100
FAX:            (206) 232-9186  Mercer Island, WA 98040-0820; (206) 236-1676
URL: http://www.celestial.com/

Government spending?  I don't know what it's all about.  I don't know
any more about this thing than an economist does, and, God knows, he
doesn't know much.
		-- Will Rogers