Subject: Global address access denial

From: Keith Oborn <[email-masked]>
Date: Fri, 27 Feb 1998 13:51:36 +0000

I've been asked to set up an instance of wu-ftp that permits acess
only from certain user/address combinations.

So, for example, I want to permit

allow keith	195.129.28.*

(an ftphosts line)

but deny keith access from any other address.

ftphosts seems to have an implied "permit everything else", rather than "deny
everything else" - the latter is akin to the way that, for instance, a Cisco
access list would work "permit this, this, and this. If I haven't mentioned it,
deny it" 

If there was an ability to wildcard the username in ftphosts, that would do the
trick. Something like:

allow keith 195.129.28.*
deny keith *.*.*.*
deny ALL *.*.*.*

would do the trick if the list is processed from the top looking for the first
match.    

In ftpaccess, there is a deny statement, which presumably can be used to do
relatively global denials. The problem is, I'm not sure how the precedence is
worked out between the two config files.

If I say "deny *.*.*.*" in ftpaccess, can I then say "allow keith 195.129.28.*"
in ftphosts and have it work?

Of course, I'm going to play with this, but setting up tests can't be
exhaustive, and I need to prove, to a relatively non-technical audience, that
this works in a general fashion. 

 -- 
Keith Oborn      Sony Communication Network UK       0171 426 8655
15th Floor, Commercial Union Tower, 1, Undershaft, London EC3A 8EE
home: [email-masked]             office: [email-masked]