Subject: Re: block bad mail addresses?

From: Hon-Yin Kok <[email-masked]>
Date: Tue, 14 Oct 1997 07:02:52 -0500 (CDT)

Hi Ken, 

  I guess you are not trying to offer anonymous ftp service, rather it should
be called restrictive ftp service.  Some companies I help setup uses firewall
and the only way to get out is through a proxy.  

  I notice most of the users are non-computer literate and don't even know 
what you are talking about. You sounds like you are trying to create a kiosk 
or headache for many system administrator rather than offering the best 
service to the users.  Are you sure that is what the whole group in general 
want simply because you are the only one who prefer to change.  

  I feel preety comfortable with web browsers users since I know I can trust
the user * to a certain extend * because they can read and download files only, 
and not able to write to my disk.  Isn't that more important?  I notice some 
school around here uses a software called foolproof lock which disable the 
user abilities to write some part of the harddisk hence the users are not able 
to modify the preferences, therefore I suppose these users will never be able 
to get into your site.  Some users around the world, for example cybercafe 
offer public terminals...  and I doubt they will take time to modify the user 
preference simply because you don't like to see the mozilla@ as a user.

Just my 2 penny thought...  -KHY

> # Kent Landfield said :-
> # > This has been bothering me for a long time too.  Changes would need to be 
> # > made to the code to deal with this.  I'm just brainstorming here so... 
> # > (Warning Will Robinson!) I'd suggest extending the ftpaccess file directive 
> # > passwd-check usage from
> # > 
> # >     passwd-check  <none|trivial|rfc822>  [<enforce|warn>]
> # > 
> # >                        to
> # > 
> # >     passwd-check  <none|trivial|rfc822|rfc822-limit>  [<enforce|warn>]
> # > 
> # > The passwd-check for rfc822-limit would read an exclusion list in a file
> # > somewhere and an associated message file.  The exclusion file would have
> # > an entry such as
> # > 
> # >    # Email  - Message file
> # >    IE30User   noieuser.msg
> # > 
> # > and the noieuser.msg file might contain 
> # > 
> # >  "Please change the default email address setting in Internet Explorer 3.0.
> # >   Until that is done you will not be allowed anonymous access to this site."
> # > 
> # > This way it would be generic enough to be used for any such address 
> # > restriction.  In the above example I was sugggesting the 'enforce' was
> # > being used.  If enforce was not the case then the message file would be
> # > tailored accordingly.  Thoughts ?
> # 
> # As proposed, this additional check would only be made if the rfc822-limit
> # option was specified, when I assume the standard rfc822 checks would also
> # be made.  I'd prefer to have it available for all of the existing options,
> # not just rfc822.  OK, "none" might not make much sense, but certainly for
> # trivial as well.
> 
> Oh, I think there may be a bug in the rfc822 as I see no difference in
> trivial and rfc822. If I type 'kent@' in trivial I get in.  (This is how
> trivial is suppose to work.)  When I type in 'kent@' with rfc822 set I
> get the same results and no warning of an invalid RFC822 address being
> specified.  Maybe I should submit this to Stan....
> 
> # Another way of achieving this would be to add individual lines to the
> # ftpaccess file like :-
> #    noanonpsw  mozilla  mozilla.msg
> #    noanonpsw IE30User  ieuser.msg
> # 
> # This should be OK if you don't have too many alternative passwords you want
> # to disallow - especially since it cuts down the need for another external
> # file, and could be checked no matter what authentication type you specified.
> 
> Yeah, I thought of that.  Here is a list of massively repeated entries
> that I have in my logs. I'd put an entry for each one somewhere.
> 
>     IE30User@
>     IE30Usera@
>     IE40user@
>     Netscape@
>     WWWuser@
>     anonymous@
>     cache@
>     guest@
>     harvest@
>     http@
>     httpgw@
>     lynx@
>     mozilla@
>     netcache@
>     nobody@
>     none@
>     proxyuser@
>     squid@
>     whoever@
>     wwwuser@
> 
> -- 
> Kent Landfield                        Phone: 1-817-545-2502             
> Email: [email-masked]             http://www.landfield.com/
> Please send comp.sources.misc related mail to [email-masked].
> Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/
>

---

From: Suzanne Archibald <[email-masked]>
Date: Tue, 14 Oct 1997 08:11:55 -0400

More importantly, his suggestions block all people behind certain proxies, witness the lines: (How fair is this to people with no control over the firewall they are often forced behind due to corperate and ISP choices ? (example, AOL (used to?) proxy all http and ftp connections using a cache server)

>>     squid@

Suzanne Archibald

Programmer

<bold>Crysalis Software

</bold>http://www.crysalis.com/

---

From: Kent Landfield <[email-masked]>
Date: Tue, 14 Oct 1997 09:34:21 -0500 (CDT)

Good grief folks... It is truly amazing the response I've received on this...
Some are all for it and others sound as if it will break the world. ;)

I thought I said...
# > # >                                      I'm just brainstorming here so... 
# > # > (Warning Will Robinson!) 
;)

#   I guess you are not trying to offer anonymous ftp service, rather it should
# be called restrictive ftp service.  Some companies I help setup uses firewall
# and the only way to get out is through a proxy.  

I offer anonymous ftp.  That will not change.  What has changed is the way that
browsers are impacting sites offering anonymous ftp access.  Most sites use
email as the password for anonymous access.  The purpose there was to provide
an attempt for the user to identify themselves as they access the site.  Any 
user that wished to not identify themselves could enter anything they wished 
as long as it was in the form of an email address.  The user in this case had
to make a conscious decision as to what to enter.

Then came the dumbing up of the net. People became too lazy to even change
the basics in their browsers.  A facility that had been working nicely for
many years quit being functional at all.  How bad can it be ?   Let's examine 
my situation and see the usefulness of using the email address as the 
password...

    38% - mozilla
    19% - IE30User
    15% - other similar default ids
    28% - user entered /configured addresses

72% of the addresses supplied are default out-of-the-box addresses .... 72%...

#   I notice most of the users are non-computer literate and don't even know 
# what you are talking about. You sounds like you are trying to create a kiosk 
# or headache for many system administrator rather than offering the best 
# service to the users.  Are you sure that is what the whole group in general 
# want simply because you are the only one who prefer to change.  

TAKE THE TONE ELSEWHERE OK?  This has been complained about before.  If I 
thought I was the only one this affected  I would write it myself as a local
enhancement. I currently am doing that with other enhancements that are local 
in scope.  The idea here is there is a problem and we are looking for a 
solution.  If this was implemented and you felt that you didn't want to
use it, then don't.  

Now... Take a look at what you just said.  I'm creating a headache for people
who what something for free from my system when I only ask that a valid attempt
be made to enter something other than out-of-the box defaults as the email
address.  This was why the feature was inplemented in the first place. The
browsers have subverted its usefulness. The suggestion I put forward for
allowing message files associated with addresses that are disallowed was to
educate the user's as to how to do it right.

#   I feel preety comfortable with web browsers users since I know I can trust
# the user * to a certain extend * because they can read and download files only, 
# and not able to write to my disk.  Isn't that more important?  

More important than what ? This does not change a policy of requiring
something other than defaults be entered at the anonymous password prompt
anymore than your policy of disallowing writing to the incoming directory.
Some of us need to be able to have writable public areas.  If you had to
supply writeable areas would you still be as comfortable ?

#                                                                I notice some 
# school around here uses a software called foolproof lock which disable the 
# user abilities to write some part of the harddisk hence the users are not able
# to modify the preferences, therefore I suppose these users will never be able 
# to get into your site.  

Then if that's the case, the users at that site should set a bonfire under the
admin's butt to correct the situation.  The school should want to protect itself
from rogue students by doing a better job of assuring all their users are
identifiable. The school lawyers might be interested in this.  I'll bet they'd 
change that in a hurry. Aside from that, this kind of protecting the user from 
themselves is just plain wrong!  

#                         Some users around the world, for example cybercafe 
# offer public terminals...  and I doubt they will take time to modify the user 
# preference simply because you don't like to see the mozilla@ as a user.

So they will not be able to access any site with that restriction.  If that is
the policy then that is the policy.  When you are asking to get someting for 
free you should at least abide by the "minimal" requirements to do so.

And can the cybercafe public terminals write to your disk ? Aren't you 
inhibiting their ability to pass warez ? :)

---

From: Kent Landfield <[email-masked]>
Date: Tue, 14 Oct 1997 09:53:38 -0500 (CDT)

# More importantly, his suggestions block all people behind certain proxies, 
# witness the lines: (How fair is this to people with no control over the 
# firewall they are often forced behind due to corperate and ISP choices ? 
# (example, AOL (used to?) proxy all http and ftp connections using a cache 
# server)
# 
# >>     cache@
# >>     harvest@
# >>     httpgw@
# >>     netcache@
# >>     proxyuser@
# >>     squid@

Those were examples only.  I was not advocating that I would.  I was 
advocating that I would like the ability to have that capability if
I deem to use it at some point.  Your point is that it is not fair
for a local site administrator to set a local policy that affects those
that cannot help themselves... How is what I have described all that 
different than

  deny !nameserved /etc/msgs/msgs.named

I choose to use it or I don't.  This is a local policy decision that the
end users have no control over.

Things won't change for the better unless there is some indication of what 
better is.  The problem today could get serious enough that ftp starts to 
disappear as more and more site admins move to httpd only due to better 
individual identification and access control.  Then we can all start 
complaining at the apache folks.

User's do have a lot more control over corporate policy than you might
imagine. I know first hand as one who has been on the receiving end of
that "force".  And if an ISP doesn't wish to adapt to the changing net,
chances are there are many more willing to supply you with the services 
you require.

---

From: Jim Simmons <[email-masked]>
Date: Tue, 14 Oct 97 11:19:24 EST

To answer the original question, here's a patch I have used with
wu-2.4.2-beta-12.  I haven't tried it with later versions but I
suspect it would be trivial to get working.

Note that this isn't ideal -- the list of blocked users is defined in
a header file, so it gets compiled into wu-ftpd.  For my use this was
acceptable.  Also, the list will need to be updated some--browsers
have changed since this was last used.

Once the patch is made and strict.h created/updated, build wu-ftpd like usual
and install it.  To activate the checks, change your ftpaccess file
passwd-check setting to:

	passwd-check strict enforce

You can turn off the checking by resetting the passwd-check line in
ftpaccess.

----------------------------------------------------------------------
diff -cr wu-ftpd-2.4.2-beta-12/src/ftpd.c wu-ftpd-2.4.2-beta-12new/src/ftpd.c
*** wu-ftpd-2.4.2-beta-12/src/ftpd.c	Mon Jan 20 00:05:11 1997
--- wu-ftpd-2.4.2-beta-12new/src/ftpd.c	Thu Feb 13 16:12:12 1997
***************
*** 117,123 ****
  #include "conversions.h"
  #include "extensions.h"
  #include "pathnames.h"
! 
  #ifdef M_UNIX
  #include <arpa/nameser.h>
  #include <resolv.h>
--- 117,123 ----
  #include "conversions.h"
  #include "extensions.h"
  #include "pathnames.h"
! #include "strict.h"				/* JWS */
  #ifdef M_UNIX
  #include <arpa/nameser.h>
  #include <resolv.h>
***************
*** 1312,1317 ****
--- 1312,1359 ----
          return 0;
  }
  
+ 
+ int
+ #ifdef __STDC__
+ validate_strict( char *eaddr )					/* JWS */
+ #else
+ validate_strict( eaddr )					/* JWS */
+ char *eaddr;
+ #endif
+ {
+     char *cp = eaddr;
+     char user[80];
+     int i;
+ 
+     if ( *cp == '-' )			/* Skip leading -, if any */
+ 	cp++;
+ 
+     					/* Get the "user name".  Assume that
+ 					   it is everything up to the first
+ 					   non-alphanumeric.  Convert it to
+ 					   lower case for comparison. */
+     for ( i = 0;  i < sizeof( user ) - 1;  i++ )  {
+ 	if ( ! isalnum( *cp ) )
+ 	    break;
+ 	if ( isupper( *cp ) )
+ 	    user[i] = tolower( *cp++ );
+ 	else
+ 	    user[i] = *cp++;
+ 	}
+     user[i] = '\0';
+ 
+     					/* Make sure name isn't in list
+ 					   (defined in strict.h) */
+ 
+     for ( i = 0;  i < sizeof( exclude_strict ) / sizeof( char *);  i++ )
+ 	if ( strcmp( user, exclude_strict[i] ) == 0 )
+ 	    return 0;				/* Oops, don't like this user*/
+ 
+     return 1;					/* Ok */
+ }
+ 
+ 
+ 
  void
  #ifdef __STDC__
  pass(char *passwd)
***************
*** 1420,1431 ****
          char *pwin,
           *pwout = guestpw;
          struct aclmember *entry = NULL;
!         int valid;
  
          if (getaclentry("passwd-check", &entry) &&
              ARG0 && strcasecmp(ARG0, "none")) {
  
!             if (!strcasecmp(ARG0, "rfc822"))
                  valid = validate_eaddr(passwd);
              else if (!strcasecmp(ARG0, "trivial"))
                  valid = (strchr(passwd, '@') == NULL) ? 0 : 1;
--- 1462,1480 ----
          char *pwin,
           *pwout = guestpw;
          struct aclmember *entry = NULL;
!         int valid, failed_strict = 0;
  
          if (getaclentry("passwd-check", &entry) &&
              ARG0 && strcasecmp(ARG0, "none")) {
  
! 	    if (!strcasecmp(ARG0, "strict")) {			/* JWS */
! 		valid = validate_eaddr(passwd);
! 		if ( valid )  {
! 		    valid = validate_strict(passwd);
! 		    failed_strict = ! valid;
! 		    }
! 		}
!             else if (!strcasecmp(ARG0, "rfc822"))
                  valid = validate_eaddr(passwd);
              else if (!strcasecmp(ARG0, "trivial"))
                  valid = (strchr(passwd, '@') == NULL) ? 0 : 1;
***************
*** 1440,1445 ****
--- 1489,1504 ----
                         authenticated ? authuser : "joe");
                  lreply(530, "[%s will be added if password ends with @]",
                         remotehost);
+ 
+ 		if ( failed_strict )  {				/* JWS */
+ 		    lreply(530, "If you are connecting through a gopher or");
+ 		    lreply(530, "WWW client, it is not identifying you by");
+ 		    lreply(530, "name.  Please ftp directly to this machine.");
+ 		    lreply(530, "Providing a valid e-mail address allows us");
+ 		    lreply(530, "to notify you of data updates, revisions,");
+ 		    lreply(530, "or errors.");
+ 		    }
+ 
                  reply(530, "Login incorrect.");
  		acl_remove();	
                  if (++login_attempts >= lgi_failure_threshold) {
----------------------------------------------------------------------

And the file wu-ftpd-2.4.2-beta-12new/src/strict.h is:
----------------------------------------------------------------------
/* Include file defining "user" names that shouldn't be allowed as first part
   of the password entered for anonymous users. */

/* "users" must be alphanumeric and in lowercase. */

static char *exclude_strict[] = {
    "ftp",
    "gopher",
    "guest",
    "anonymous",
    "user",
    "wwwuser" };
----------------------------------------------------------------------

Hope this helps,

Jim