Subject: block bad mail addresses?

From: Michael Finken <[email-masked]>
Date: Mon, 13 Oct 1997 13:17:19 +0200 (MET DST)

Hi,

I see a lot of connections where the anonymous user uses 'IE30User@' or
'mozilla@' as password.  I want people to use their real mail addresses.

Can I configure a filter for e-mail addresses in WU-FTPD?

Thanks,
Michael

--
Michael Finken                                NENTEC Netzwerktechnologie GmbH
Tel.:  +49 721 9495-0                         76227 Karlsruhe/Germany
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Old pilots never die, they just go to a higher plane.

---

From: Becki Kain <[email-masked]>
Date: Mon, 13 Oct 1997 08:13:27 -0400 (EDT)

I'm not certain how you get people to change that - that is the default
when they goto your site from internet exploder and netscape agitator.

beckers

---

From: Anders Thulin <[email-masked]>
Date: Tue, 14 Oct 1997 09:03:58 +0200 (MET DST)

> 'mozilla@' as password.  I want people to use their real mail addresses.

    Can you distinguish between a good address and a bad one? How?
There is, as far as I know, no guaranteed way to do so. 

  A syntactically bad address is possible to detect, of course. Just
parse it using the *full* RFC822 syntax.

  A syntactically correct address can still be bad. How to check? Perhaps
by finding the mailhost of the specified domain, connecting to it, and
requesting 'VRFY mailbox'.  Some will verify, but the tendency is to
give a noncomittal answer - the site won't verify, but will attempt delivery of
a mail. 

  And even then, how do you verify that people have used their real mail
address?  You can't.  'root@localhost' for instance, works for most UNIX
systems, but certainly isn't the real address. And you can't entirely
rely on exclusion of bad address - [email-masked]'  can
easily be a real mail address. And even if you could rely on it, how about
[email-masked]'? Or [email-masked]'? 

  If you allow anonymous FTP, why not accept it? Anonymous is anonymous,
and IE30user and mozilla are no worse than any other alias. If you don't like
full anonymity, don't provide anonftp.

  I see that others have posted suggestions for how to handle this problem,
although none seem to question the problem description.

  If the problem is lack of authentication, anonftp is not the answer. If the
problem is that you want some kind of traceability, filtering on mailbox names
doesn't help. If you don't like to see 'IE30User' or 'mozilla' in the logs,
perhaps the easiest solution would be to filter them away before the log
entries are made?

  If the problem is that Netscape and Microsoft provide defaults where you
think they shouldn't, then complain.  It's not likely to change anything, as
these browsers are primary for making Internet easier for people who don't
understand it. If the problem is that people don't understand Internet, ...
well, and so on.

  I hope I don't sound offensive - I don't mean to be. But not liking anon
users names doesn't sound like a good problem statement. It may be an
indication of a real problem, but so far it sounds much more like a perceived
problem. Don't solve those -- they change as quickly as perceptions change.
Better find the real problem.

  

> Tel.:  +49 721 9495-0                         76227 Karlsruhe/Germany - - -
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Old
> pilots never die, they just go to a higher plane.

Anders Thulin       [email-masked]        013-23 55 32
Telia Engineering AB, Teknikringen 6, S-583 30 Linkoping, Sweden