Subject: denying real users

From: "Richard L. Goerwitz" <[email-masked]>
Date: Sat, 18 Jan 1997 11:17:26 -0500 (EST)

How does one deny all access by real users, allowing only anonymous
FTP?  I've tried the obvious:

  limit         real   0 Any /home/ftp/useanon.msg

But for some odd reason (haven't examined the source in detail) the
server only displays the file "usenanon.msg" when a nonexistent login
ID is given.  Frankly this makes me nervious, because obviously it
can be used to determine whether a given login ID corresponds to a
real account name on the system.

Perhaps I'm just being stupid.  But I really don't want cleartext
passwords coming in from the outside, and so I don't want any real
users - just anonymous ones.

Richard Goerwitz

---

From: Michael Brennen <[email-masked]>
Date: Thu, 23 Jan 1997 21:14:55 -0600 (CST)

On 23 Jan 1997, Perry Rovers wrote:

> Pink elephants with an attitude inspired "Richard L. Goerwitz" <[email-masked]> to tell garfield.mail.wu-ftpd:
> : How does one deny all access by real users, allowing only anonymous
> : FTP?  I've tried the obvious:
> There's a PARANOID option in the top-level Makefile for that (b11)

PARANOID is a tcp wrappers option in /etc/hosts.allow that has nothing to
do with ftpd.  From the hosts.allow man page:

       PARANOID
              Matches any host whose  name  does  not  match  its
              address.    When  tcpd  is  built  with  -DPARANOID
              (default mode), it drops requests from such clients
              even  before  looking at the access control tables.
              Build without -DPARANOID when you want more control
              over such requests.

I've not had to solve the question posed; does simply leaving 'real' out
of the /etc/ftpaccess class statements not work? 

   -- Michael    ([email-masked])

---

From: Bob Myers <[email-masked]>
Date: Thu, 23 Jan 1997 20:11:01 -0800

Perry Rovers wrote:
> --
> Perry Rovers ([email-masked])

You could also make sure all user shells are *not* listed in
/etc/shells...  but this could have other side effects. :-)

-- 
Bob Myers                          InteleNet Communications, Inc.
Email: [email-masked]           18101 Von Karman Avenue, Suite 550
Phone: 714-851-8250 x227           Irvine, CA 92612
Fax:   714-851-1088                http://www.intelenet.net/

---

From: Perry Rovers <[email-masked]>
Date: 24 Jan 1997 20:20:11 GMT

Pink elephants with an attitude inspired Michael Brennen <[email-masked]> to tell garfield.mail.wu-ftpd:
: On 23 Jan 1997, Perry Rovers wrote:

: > Pink elephants with an attitude inspired "Richard L. Goerwitz" <[email-masked]> to tell garfield.mail.wu-ftpd:
: > : How does one deny all access by real users, allowing only anonymous
: > : FTP?  I've tried the obvious:
: > There's a PARANOID option in the top-level Makefile for that (b11)

: PARANOID is a tcp wrappers option in /etc/hosts.allow that has nothing to
: do with ftpd.  From the hosts.allow man page:

Well, I remembered something about paranoid:

        add -DPARANOID to CFLAGS to disable questionable functions.
        add -DANON_ONLY to CFLAGS if you're building an anonymous-only server.

>From the FIXES-2.4-HOBBIT file. They were listed close together :)

---

From: Michael Brennen <[email-masked]>
Date: Sat, 25 Jan 1997 23:22:42 -0600 (CST)

Hmmmm.  Sorry about that; I had completely forgotten about that compile
option.

---

From: "Richard L. Goerwitz" <[email-masked]>
Date: Wed, 29 Jan 1997 13:57:11 -0500 (EST)

> > : FTP?

The easy answer is: define ANON_ONLY in config.h.  But this seems a bit of
a kludge.  The ftpaccess file defines a "real" keyword.  And it's possible
to limit the number of users by class.  Hence it should be possible to lim-
it the number of real users to zero, and to, say, output a message saying
that the server is anonymous-only if any real users try to log in.

In other words, the ftpaccess file appears to provide a way of disallowing
real users, without having to resort to a recompile.

Yet it doesn't work this way, in practice.

Anybody know why offhand?

Richard Goerwitz

---

From: Chris Richards <[email-masked]>
Date: Wed, 29 Jan 1997 03:50:03 +0000

> Anybody know why offhand?

Well, set it up as such and it will work:

class   users   real            *
limit   users   0   Any                 /etc/local/ftpd/ftpmsgs/real_users

Hope this helps,
cjr
-- 
_______________________________________________________________________
Chris Richards       [email-masked] | Texas A&M University
Server Administration and Architecture | Department of Computer Science
http://www.cs.tamu.edu/people/richards | Internet Publishing Services

---

From: "Richard L. Goerwitz" <[email-masked]>
Date: Thu, 30 Jan 1997 10:14:52 -0500 (EST)

> limit   users   0   Any                 /etc/local/ftpd/ftpmsgs/real_users

Thanks.  Actually, I used a setup precisely equivalent to this one,
and it didn't work.  But that was a patchlevel or two ago.  Have any
bugs been fixed?

Richard