Subject: Re: question on access

From: Ian Willis <[email-masked]>
Date: Thu, 23 Jul 98 19:05:00 BST

On Mon, 20 Jul 1998 09:13:45, Jim Busch ([email-masked]) wrote:

|         I have a HP machine running HP-UX 10.20 with wu-ftp running inside our
| firewall.  I also have created several client guest accounts for external
| access and a couple internal guest accounts.  The client accounts are used
| for sending files from outside our company to us.  The internal accounts
| are used to move files from the FTP servers to the local offices.
|         What i would like to do is limit the internal accounts such that only
| people inside the firewall can use them.  I.E. someone could not take the
| login name and password and use them from outside the firewall, but at the
| same time still have the client accounts work from the outside.  In our
| internal network we use 10.xxx.xxx.xxx for our IP numbers.  With each
| office having a different second octet.  Is there a way to set accounts so
| only people with certain IP (ie 10.xxx.xxx.xxx) can log in ??  OR is there
| a better way to do this ??

The ftphosts file is used to allow or deny access to individual FTP users
from various hosts, the first allow or deny line that matches a host is
used. The following entries allow access to account internal-guest-username1
from any machine with an IP address starting with 10 and denies access to
that account from all other addresses. If there is no entry for a user,
access is allowed.

allow	internal-guest-username1	10.*.*.*
deny	internal-guest-username1	*

Ian Willis
SCO Internet Engineering Group, Watford, England