Subject: Re: question on access

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 20 Jul 1998 11:09:40 -0400 (EDT)

On Mon, 20 Jul 1998, Jim Busch wrote:

> I have a HP machine running HP-UX 10.20 with wu-ftp running inside our
> firewall.  I also have created several client guest accounts for
> external access and a couple internal guest accounts.  The client
> accounts are used for sending files from outside our company to us.  The
> internal accounts are used to move files from the FTP servers to the
> local offices.

You will have problems with Passive mode in this configuration.

> What i would like to do is limit the internal accounts such that only
> people inside the firewall can use them.  I.E. someone could not take
> the login name and password and use them from outside the firewall, but
> at the same time still have the client accounts work from the outside. 
> In our internal network we use 10.xxx.xxx.xxx for our IP numbers.  With
> each office having a different second octet.  Is there a way to set
> accounts so only people with certain IP (ie 10.xxx.xxx.xxx) can log in
> ??  OR is there a better way to do this ?? 

I'm not sure if this will get you all the way to where you want to go, but
use the class statement to define who may access how.  For instance:

class insiders real 10.*.*.* *.inhouse.domain localhost
class outsiders guest *

With no other classes, anonymous users will be denied (not in any class)
and real users from anywhere outside your 10-net, localhost, or the DNS'd
internal domain inhouse.domain (that should mean anywhere else) should
also be denied access (not in any class).  Guest users will be chroot'd to
specific areas and allowed entry from anywhere.

Get the idea?  Hope this helps.

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Jim Busch <[email-masked]>
Date: Mon, 20 Jul 1998 09:13:45 -0400

I have a HP machine running HP-UX 10.20 with wu-ftp running inside our
firewall.  I also have created several client guest accounts for external
access and a couple internal guest accounts.  The client accounts are used
for sending files from outside our company to us.  The internal accounts
are used to move files from the FTP servers to the local offices. 
	What i would like to do is limit the internal accounts such that only
people inside the firewall can use them.  I.E. someone could not take the
login name and password and use them from outside the firewall, but at the
same time still have the client accounts work from the outside.  In our
internal network we use 10.xxx.xxx.xxx for our IP numbers.  With each
office having a different second octet.  Is there a way to set accounts so
only people with certain IP (ie 10.xxx.xxx.xxx) can log in ??  OR is there
a better way to do this ??
	I hope the question is clear enough.  Thanks in advance for any help you
might be able to provide.
James Busch
Regional Systems Administrator
Rapid Design Service
Phone (810) 695-9630
Fax (810) 695-6686

---

From: Kevin Hoffer <[email-masked]>
Date: Tue, 21 Jul 1998 20:06:07 -0400 (EDT)

Didn't get any mail from the group today and not much yesterday just
wondering if it still up and working or if something happened?

Kevin