Subject: Re: block bad mail addresses?

From: Dan Niles <[email-masked]>
Date: Tue, 14 Oct 1997 10:26:08 -0500

There really isn't any point to blocking mozilla@ and IE30User@ 
entries.  Most people, especially if forced, will simply input
a bogus email address like [email-masked].  The only way
to ensure that the addresses in your logs is correct would be
to verify each one.  This would put way too much load on the
server, but could be easily programmed.

Someone mentioned that they thought trivial and rfc822 were the same.
I do not believe that is the case.  They both handle user@ the same
because the host the client came from is used as the host. 

Dan

---

From: Bob Luckin <[email-masked]>
Date: Tue, 14 Oct 97 11:12:45 CDT

> server, but could be easily programmed.

What makes you think that most people would deliberately use a bogus email
address when the non-helpful browser default is disallowed ?

I'm sure there are a lot of FTP admins out there who believe they have a
reasonably decent customer base - the majority of which who would do the
right thing with a bit of education - which is what Kent's proposal could
provide.

Your situation may be different.  Fine - you simply don't have to turn
that feature on if it gets implemented in a future release.  But I think
there are plenty of other FTP admins who believe this feature could help
in their particular circumstances.

Of course the proposed solution wouldn't prevent a determined user from
supplying a bogus email address.  That's not what it's intended to do, though.
One way to use it is to encourage people to stop using uninformative defaults
supplied with browsers.  It may not be 100% effective, but that's not enough
reason not to adopt it.  Nor (depending upon the target user base) does it
necessarily place any unfair restrictions on the user base for a particular
server, as another poster seemed to be implying.

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "Coder - redo C"

---

From: Kent Landfield <[email-masked]>
Date: Tue, 14 Oct 1997 11:57:37 -0500 (CDT)

Well... sigh..  It seems that there is NO WAY for users of netscape or IE
to get it right even if they WANTED to... I just spent 10 minutes playing
with them and can't get either one to do the right thing, even though I
have my email address entered correctly...  If you know of a way to do it
*please* let me know.

To all the lazy netscape and IE users I maligned I'm sorry. ;)  Seems that
there is just no way to block those addresses without disabling all browser
access.  WHY AM I NOT SUPRISED!  (Wait, maybe that's not so bad... Access 
a site only with Netscape... Hmmm wonder what Netscape would think of the 
idea ? I'm KIDDING folks!)

I have messages into both Netscape and MS asking what the basis of this is.
Let's see who answers. ;) 

# There really isn't any point to blocking mozilla@ and IE30User@ 
# entries.  Most people, especially if forced, will simply input
# a bogus email address like [email-masked].  The only way
# to ensure that the addresses in your logs is correct would be
# to verify each one.  This would put way too much load on the
# server, but could be easily programmed.

This was not what happend BB (Before Browsers).  If the browsers did the
right thing then they would give the user a clickable option to use their
email address as their anonymous ftp password and those that didn't would
use the default.  All moot at this point in time.

# Someone mentioned that they thought trivial and rfc822 were the same.
# I do not believe that is the case.  They both handle user@ the same
# because the host the client came from is used as the host. 

??

>From the manpage...
     passwd-check <none|trivial|rfc822> (<enforce|warn>)
          Define the level and enforcement of  password  checking
          done by the server for anonymous ftp.

            none      no password checking performed.
            trivial   password must contain an '@'.
            rfc822    password must be an rfc822 compliant address.

If rfc822 password checking was not broken then why can you type 

anon@

as an anonymous password and get in ?  anon@ is not a valid rfc822 address 
last I checked. But then again, I'd better check again...  My track record 
is not too good lately. ;)

validate_eaddr(kent) == 0
validate_eaddr(kent@) == 1
validate_eaddr([email-masked]) == 1
validate_eaddr([email-masked]) == 1
validate_eaddr(@nfr.net) == 0
validate_eaddr(nfr.net) == 0

Test program below.

-- 
Kent Landfield                        Phone: 1-817-545-2502             
Email: [email-masked]             http://www.landfield.com/
Please send comp.sources.misc related mail to [email-masked].
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/

--------------------------- testprog.c -----------------------

#include<stdio.h>

char *names[] = {
	 "kent",
	"kent@",
	"[email-masked]",
	"[email-masked]",
	"@nfr.net",
	"nfr.net",
	NULL,
};

int validate_eaddr(eaddr)
char *eaddr;
{
    int i,
      host,
      state;

    for (i = host = state = 0; eaddr[i] != '\0'; i++) {
        switch (eaddr[i]) {
        case '.':
            if (!host)
                return 0;
            if (state == 2)
                state = 3;
            host = 0;
            break;
        case '@':
            if (!host || state > 1 || !strncasecmp("ftp", eaddr + i - host, host))
                return 0;
            state = 2;
            host = 0;
            break;
        case '!':
        case '%':
            if (!host || state > 1)
                return 0;
            state = 1;
            host = 0;
            break;
        case '-':
            break;
        default:
            host++;
        }
    }
    if (((state == 3) && host > 1) || ((state == 2) && !host) ||
        ((state == 1) && host > 1))
        return 1;
    else
        return 0;
}

void main()
{
      int rc;
      int c;
      char *name;
      
      for (c = 0; names[c] != NULL; c++) {
           rc = validate_eaddr(names[c]);
           printf("validate_eaddr(%s) == %d\n", names[c], rc);
      }
}

---

From: [email-masked] (Josef Siemes)
Date: Tue, 14 Oct 1997 19:44:59 +0200 (DFT)

> to get it right even if they WANTED to... 

It is possible, at least with Netscape 3.02 (Solaris):
Options -> Network preferences -> Protocols,
there check the box 'Send Email address as Anonymous FTP Password'

I think this wasn't possible with NS 2.x and earlier.

Regards,

Josef Siemes,
[email-masked]

---

From: Kent Landfield <[email-masked]>
Date: Tue, 14 Oct 1997 13:20:15 -0500 (CDT)

# It is possible, at least with Netscape 3.02 (Solaris):
# Options -> Network preferences -> Protocols,
# there check the box 'Send Email address as Anonymous FTP Password'
# 
# I think this wasn't possible with NS 2.x and earlier.

gak!! I thought I squished all the 2.x versions on my net...  I just 
checked the copy I normally use and sure enough it was right there.
Great! Now I can unapologize to all the lazy Netscape users. ;) Now 
if someone knows if IE4.0 supports this as well then filtering might 
be useful after all. 

Thanks Josef!

---

From: Dan Niles <[email-masked]>
Date: Wed, 15 Oct 1997 10:16:17 -0500

> # because the host the client came from is used as the host. 

If you ftp from your.host.net to some other host and enter user@
as your anon ftp password, it is taken to mean [email-masked].
Therefore, user@ satisfies trivial and rfc822 because it really
means [email-masked].  I don't remember where I read this,
but it was somewhere in the wu-ftpd docs or source.  It does explain
why trivial and rfc822 both handle user@ the same.