Subject: Re: block bad mail addresses?

From: Kent Landfield <[email-masked]>
Date: Mon, 13 Oct 1997 10:21:19 -0500 (CDT)

Michael Finken <[email-masked]> wrote:
# > I see a lot of connections where the anonymous user uses 'IE30User@' or
# > 'mozilla@' as password.  I want people to use their real mail addresses.
# > Can I configure a filter for e-mail addresses in WU-FTPD?

Becki Kain <[email-masked]> responded:
# I'm not certain how you get people to change that - that is the default
# when they goto your site from internet exploder and netscape agitator.

This has been bothering me for a long time too.  Changes would need to be 
made to the code to deal with this.  I'm just brainstorming here so... 
(Warning Will Robinson!) I'd suggest extending the ftpaccess file directive 
passwd-check usage from

    passwd-check  <none|trivial|rfc822>  [<enforce|warn>]

                       to

    passwd-check  <none|trivial|rfc822|rfc822-limit>  [<enforce|warn>]

The passwd-check for rfc822-limit would read an exclusion list in a file
somewhere and an associated message file.  The exclusion file would have
an entry such as

   # Email  - Message file
   IE30User   noieuser.msg

and the noieuser.msg file might contain 

  "Please change the default email address setting in Internet Explorer 3.0.
   Until that is done you will not be allowed anonymous access to this site."

This way it would be generic enough to be used for any such address 
restriction.  In the above example I was sugggesting the 'enforce' was
being used.  If enforce was not the case then the message file would be
tailored accordingly.  Thoughts ?

-- 
Kent Landfield                        Phone: 1-817-545-2502             
Email: [email-masked]             http://www.landfield.com/
Please send comp.sources.misc related mail to [email-masked].
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/

---

From: Bob Luckin <[email-masked]>
Date: Mon, 13 Oct 97 11:25:22 CDT

Kent Landfield said :-
> tailored accordingly.  Thoughts ?

As proposed, this additional check would only be made if the rfc822-limit
option was specified, when I assume the standard rfc822 checks would also
be made.  I'd prefer to have it available for all of the existing options,
not just rfc822.  OK, "none" might not make much sense, but certainly for
trivial as well.

Another way of achieving this would be to add individual lines to the
ftpaccess file like :-
   noanonpsw  mozilla  mozilla.msg
   noanonpsw IE30User  ieuser.msg

This should be OK if you don't have too many alternative passwords you want
to disallow - especially since it cuts down the need for another external
file, and could be checked no matter what authentication type you specified.

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "Coder - redo C"

---

From: Kent Landfield <[email-masked]>
Date: Mon, 13 Oct 1997 12:10:12 -0500 (CDT)

# Kent Landfield said :-
# > This has been bothering me for a long time too.  Changes would need to be 
# > made to the code to deal with this.  I'm just brainstorming here so... 
# > (Warning Will Robinson!) I'd suggest extending the ftpaccess file directive 
# > passwd-check usage from
# > 
# >     passwd-check  <none|trivial|rfc822>  [<enforce|warn>]
# > 
# >                        to
# > 
# >     passwd-check  <none|trivial|rfc822|rfc822-limit>  [<enforce|warn>]
# > 
# > The passwd-check for rfc822-limit would read an exclusion list in a file
# > somewhere and an associated message file.  The exclusion file would have
# > an entry such as
# > 
# >    # Email  - Message file
# >    IE30User   noieuser.msg
# > 
# > and the noieuser.msg file might contain 
# > 
# >  "Please change the default email address setting in Internet Explorer 3.0.
# >   Until that is done you will not be allowed anonymous access to this site."
# > 
# > This way it would be generic enough to be used for any such address 
# > restriction.  In the above example I was sugggesting the 'enforce' was
# > being used.  If enforce was not the case then the message file would be
# > tailored accordingly.  Thoughts ?
# 
# As proposed, this additional check would only be made if the rfc822-limit
# option was specified, when I assume the standard rfc822 checks would also
# be made.  I'd prefer to have it available for all of the existing options,
# not just rfc822.  OK, "none" might not make much sense, but certainly for
# trivial as well.

Oh, I think there may be a bug in the rfc822 as I see no difference in
trivial and rfc822. If I type 'kent@' in trivial I get in.  (This is how
trivial is suppose to work.)  When I type in 'kent@' with rfc822 set I
get the same results and no warning of an invalid RFC822 address being
specified.  Maybe I should submit this to Stan....

# Another way of achieving this would be to add individual lines to the
# ftpaccess file like :-
#    noanonpsw  mozilla  mozilla.msg
#    noanonpsw IE30User  ieuser.msg
# 
# This should be OK if you don't have too many alternative passwords you want
# to disallow - especially since it cuts down the need for another external
# file, and could be checked no matter what authentication type you specified.

Yeah, I thought of that.  Here is a list of massively repeated entries
that I have in my logs. I'd put an entry for each one somewhere.

    IE30User@
    IE30Usera@
    IE40user@
    Netscape@
    WWWuser@
    anonymous@
    cache@
    guest@
    harvest@
    http@
    httpgw@
    lynx@
    mozilla@
    netcache@
    nobody@
    none@
    proxyuser@
    squid@
    whoever@
    wwwuser@

---

From: Becki Kain <[email-masked]>
Date: Mon, 13 Oct 1997 20:42:00 -0400 (EDT)

I like it!  that would also allow people to add customer bad addresses.

beckers

On Mon, 13 Oct 1997, Kent Landfield wrote:

> Search the Usenet Hypertext FAQ Archive at http://www.faqs..org/faqs/
>