Subject: no fake anonymous passwords

From: Jeffrey Auerbach <[email-masked]>
Date: Wed, 6 Nov 1996 13:12:50 -0500 (EST)

Hello,

I have recently set up an anonymous ftp site at my company.  It works
fine, but it is missing one thing.  WHen i log in as anonymous, I can put
garble(anything) as a password.  How can i fix it to make it say,  That is
not a valid password, use: [email-masked] (the real users domain).  Ive
seen this on some major site and think it is a good thing to have.  Does
anyone know??  Thanks for any wisdom that might be passed on to me.

Jeffrey Auerbach

---

From: [email-masked] (Bill Campbell)
Date: Wed, 6 Nov 1996 10:53:32 -0800 (PST)

>anyone know??  Thanks for any wisdom that might be passed on to me.
See:
# passwd-check  <none|trivial|rfc822>  [<enforce|warn>]

I have hacked the beta-11 code to extend the rfc822 checking to reject
various known bogus passwords (mozilla@ comes to mind :-).  I currently
have this set to warn on our ftp site, ftp.celestial.com, and am
considering putting this to enforce (after all giving valid e-mail
address is a small price to pay for the free software that people
download from our site).  The main problem with doing this at this
time is that there's no way to get Netscape 2.0 to provide a real
e-mail address replacing their mozilla crap.

Bill
--
INTERNET:   [email-masked]  Bill Campbell; Celestial Systems, Inc.
UUCP:               camco!bill  PO Box 820; 2835 82nd Avenue S.E. S-100
FAX:            (206) 232-9186  Mercer Island, WA 98040-0820; (206) 236-1676
URL: http://www.celestial.com/

Government spending?  I don't know what it's all about.  I don't know
any more about this thing than an economist does, and, God knows, he
doesn't know much.
		-- Will Rogers

---

From: "Matthew N. Reichman" <[email-masked]>
Date: Wed, 6 Nov 96 11:11:41 -0800

On Wed, 6 Nov 1996 at 13:12:50
Jeffrey Auerbach <[email-masked]> wrote:
____________________

> WHen i log in as anonymous, I can put
> garble(anything) as a password. How can i fix it to make it
> say, That is not a valid password, use: [email-masked] (the
> real users domain).(

In your ftp_access file:

     passwd-check <none|trivial|rfc822> (<enforce|warn>)
	  Define the level and enforcement of password checking
	  done by the server for anonymous ftp.

	    none      no password checking performed.
	    trivial   password must contain an '@'.
	    rfc822    password must be an rfc822 compliant
	  address.

	    warn      warn the user, but allow them to log in.
	    enforce   warn the user, and then log them out.

---
Be well,

Matthew Reichman
<[email-masked]>
NeXTMAIL, SUN Mail & MIME welcome
PGP key --> email w/ subject "request_PGP"
Computer Privacy Information --> http://www.eskimo.com/~joelm/

---

From: Perry Rovers <[email-masked]>
Date: Wed, 6 Nov 1996 23:55:52 +0100 (MET)

> 	    enforce   warn the user, and then log them out.
For some reason the 'enforce' doesn't seem to work here (FreeBSD 2.x.5
where x is 0 and 1). It also doesn't seem to matter if there are ()'s
around the 2nd keyword or not. Users do get warnings but are never logged
off.

BTW why is there no description of the guestserver directive in the
ftpaccess manpage? I find it a very handy feature and haven't had problems
with it yet.

Perry Rovers, Amsterdam (and a number of other places), The Netherlands
Mail: mailto:[email-masked]       | Amsterdam is zo'n gezellige stad
FTP : ftp://ftp.iaehv.nl/pub/users/perry | omdat er zo verdomd veel
WWW : http://www.iaehv.nl/users/perry    | Brabanders wonen - Hans van Mierlo

---

From: [email-masked] (Jim Waterman)
Date: Wed, 6 Nov 1996 17:52:00 -0700 (MST)

Perry Rovers wrote to say:
|
....
|
|BTW why is there no description of the guestserver directive in the
|ftpaccess manpage? I find it a very handy feature and haven't had problems
|with it yet.

I can't resist this teaser; what is the guestserver directive ?
Could you be enticed into providing a short description ?

TIA

JimW
/**********************************************************************/
   Jim Waterman          P.O. Box 6036              [email-masked]
   (303) 682-4003        Boulder, CO 80306          http://enfo.com
/**********************************************************************/
  Sending unsolicited commercially-oriented e-mail to this address 
  indicates the sender agrees to pay a $100 flat fee to the recipient 
  for transmissions, storage and proofreading services.
/**********************************************************************/

---

From: Perry Rovers <[email-masked]>
Date: Thu, 7 Nov 1996 14:38:05 +0100 (MET)

Striking two flying objects with one mail:

--- rfc822 enforce/warn ---

>> For some reason the 'enforce' doesn't seem to work here
>> (FreeBSD 2.x.5 where x is 0 and 1). It also doesn't seem to
>> matter if there are ()'s around the 2nd keyword or not.
Incorrect statement, since I've just found that without ()'s it works.

> What are the exact command lines you are using?

# password check: must be rfc822 compliant or the user is logged off
passwd-check rfc822 (enforce)

But I've found that 
passwd-check rfc822 enforce
does work..

--- rfc822 enforce/warn ---

> Could you be enticed into providing a short description ?
I'm enticed to say: use the source Jim :) (that's how I found it).
Basically, it's just an entry that's used when user ftp is not in
the /etc/ftpusers file but you want anonymous logins to try another
server. Useful when you're moving a server and don't want to create extra
messages. Say, someone is supposed to use ftp.iaehv.nl instead of
whatever.iaehv.nl, because 'whatever' is now something else but still
people are trying to connect to it. Just add the following to
/etc/ftpaccess:

guestserver ftp.iaehv.nl

and upon login users get the following message:
'Guest login not allowed on this machine, use ftp.iaehv.nl instead'
and they're disconnected.

---

From: Alain Magloire <[email-masked]>
Date: Thu, 7 Nov 1996 09:24:30 -0500 (EST)

> |ftpaccess manpage? I find it a very handy feature and haven't had problems

Well since we're in the `undocumented feature' aera ;).
There is also an undocumented `.notar' really usefull sometimes
especially when some idiot is trying to get pub.tar.

--
alain

---

From: Alain Magloire <[email-masked]>
Date: Thu, 7 Nov 1996 09:43:20 -0500 (EST)

> passwd-check rfc822 enforce

Yes it does, but it's not a real check i.e it just
check the syntaxe([email-masked]) to be rfc822 adress compliant.

So I can loggin to the ftp server and do

user ftp
pass [email-masked]

and it will work fine. So putting 
rfc22 enforce
will in no way coerce clients to put they're real email as passwd.

Having `mozilla@' or some funny putting [email-masked]'
it's equally bad.

wu-ftpd relies on identd to have accurate information on the users.

--
alain

---

From: Gene Rackow <[email-masked]>
Date: Thu, 07 Nov 1996 09:37:03 -0600

I haven't looked at the recent version os wu-ftpd, but I've considered
a number of times of creating a "bad-passwd" file in which there could be
things like mozilla@ and several other rather common bogus setups.  If it
gets one of those, it would just send back a message stating their address
is incorrect and drop them.  Like stated below, ident is not really an
answer as not all sites have it, or if they do it's not accurate anyway.
--Gene

---

From: Perry Rovers <[email-masked]>
Date: Thu, 7 Nov 1996 23:23:58 +0100 (MET)

> things like mozilla@ and several other rather common bogus setups.  If it
That would be a very nice feature.

> answer as not all sites have it, or if they do it's not accurate anyway.
Like when users start their own identd's.

>  >check the syntaxe([email-masked]) to be rfc822 adress compliant.
Of course, that's what the rfc822 says doesn't it? :)

>  >will in no way coerce clients to put they're real email as passwd.
Right, but at least it is some incentive (and since there is no other
mechanism available yet..)