Subject: Anonymous logins and a security question...

From: [email-masked]
Date: Mon, 17 Nov 97 12:33:25 +0100

Hi!

Three questions:

1/ I want to disable anonymous login; how do I do? Would it be enough to
remove "anonymous" in ftpaccess so that it does not belong to a class?
Or what is needed?

2/ As default the server at connect time displays the name of the host
and the name of the server (wu-ftpd) and the version of the server. Can
I change that? How? I do only want it to display as little as possible
because I do not want to give away any info regarding what I am running
(for security reasons)...

3/ Are there any special considerations regarding security that should
be dealt with or is the server as safe as it can be if I set it up
"correctly" and use the latest version with the latest patches?

I am running wu-ftpd 2.4.2Beta15 on Redhat Linux...

Thanks!

/Per

---

From: [email-masked]
Date: 17 Nov 1997 21:35:43 GMT

Pink elephants with an attitude inspired [email-masked] to tell garfield.mail.wu-ftpd:
: 1/ I want to disable anonymous login; how do I do? Would it be enough to
: remove "anonymous" in ftpaccess so that it does not belong to a class?
: Or what is needed?
put ftp in /etc/ftpusers (or wherever ftpusers is located on your system)

: 2/ As default the server at connect time displays the name of the host
: and the name of the server (wu-ftpd) and the version of the server. Can
: I change that? How? I do only want it to display as little as possible
: because I do not want to give away any info regarding what I am running
: (for security reasons)...
You can hack the version stuff out of vers.c. As for the hostname.. well,
you need to connect somewhere don't you? ;-) You can take it out of the
source as well.

: 3/ Are there any special considerations regarding security that should
: be dealt with or is the server as safe as it can be if I set it up
: "correctly" and use the latest version with the latest patches?
See the references to the Secure Anonymous FTP FAQ (and other links) in the
wu-ftpd faq. I know you don't want Anonymous FTP, but it's useful anyway.

-- 
Perry Rovers ([email-masked])