Subject: WTMP / DNS / Data connections

From: TTSG <[email-masked]>
Date: Wed, 2 Sep 1998 14:58:57 -0400 (EDT)

Hi,

	Ok, its my turn for questions today.

	1) Is there any way to stop wtmp loggin. In 1 day only its
grown to 11Meg!

	2) Is there a way to stop DNS lookups?  If nothing more to
stop all the :

Sep  2 14:57:08 tyr named[27669]: Lame server on '13.230.125.207.in-addr.arpa' (in '125.207.in-addr.arpa'?): [170.142.1.74].53 'DNS2.STATE.TN.US': learnt (A=128.9.128.127,NS=128.8.10.90)
Sep  2 14:57:32 tyr named[27669]: Lame server on '62.107.14.209.in-addr.arpa' (in '14.209.in-addr.arpa'?): [205.137.48.7].53 'NS3.AGIS.NET': learnt (A=128.63.2.53,NS=192.36.148.17)
Sep  2 14:57:32 tyr named[27669]: Lame server on '62.107.14.209.in-addr.arpa' (in '14.209.in-addr.arpa'?): [205.137.48.5].53 'NS1.AGIS.NET': learnt (A=128.63.2.53,NS=192.36.148.17)

	messages

	3) What/where is this :

Sep  2 01:15:46 tyr ftpd[10020]: mozilla@ of 210.96.13.54 [210.96.13.54]: data connect from 210.96.13.73 for /pub/download/webcelerator.exe (1336971 bytes)

	What is different about that connection than any other?

			Thanks, Tuc/TTSG

---

From: Cameron Lemon <[email-masked]>
Date: Wed, 02 Sep 1998 16:16:34 -0300

>         1) Is there any way to stop wtmp loggin. In 1 day only its

During compilations, an option is available to log to a different file.  I did this when I compiled my beta 18.

> Sep  2 14:57:32 tyr named[27669]: Lame server on '62.107.14.209.in-addr.arpa' (in '14.209.in-addr.arpa'?): [205.137.48.5].53 'NS1.AGIS.NET': learnt (A=128.63.2.53,NS=192.36.148.17)

If you wish to dive into the code you can stop it, however the answer is no.  It is a good thing to have the WUFTPD perform forward/reverse lookups.

>         What is different about that connection than any other?

Just that the info was made available to the daemon to log is all.

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 2 Sep 1998 15:25:47 -0400 (EDT)

On Wed, 2 Sep 1998, TTSG wrote:

> 1) Is there any way to stop wtmp loggin. In 1 day only its grown to
> 11Meg! 

Once again, there's an old patch in the mailing list which addresses this,
or you can grab VR6 from ftp.vr.net and get it and a lot of other
improvements/fixes for the daemon.

> 2) Is there a way to stop DNS lookups?  If nothing more to stop all the: 
> 

Nope.

> What is different about that connection than any other?

Other than the fact that it wasn't generated by WU-FTPD, but by some other
ftp daemon?

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: TTSG <[email-masked]>
Date: Wed, 2 Sep 1998 16:15:47 -0400 (EDT)

> improvements/fixes for the daemon.
	I'm suprised I've only been "pitched" (Don't take it the wrong
way) by the VR folks.  Bero? Anyone in the NCFTPD camp?
> > Sep  2 14:57:32 tyr named[27669]: Lame server on '62.107.14.209.in-addr.arpa' (in '14.209.in-addr.arpa'?): [205.137.48.5].53 'NS1.AGIS.NET': learnt (A=128.63.2.53,NS=192.36.148.17)
	This is sad. Why? Yea, yea, yea, security.  But *I* should be able
to make that call, not the machine. If its so security oriented then why
isn't TCPWRAPPERS built in (Not that I want it)
> Other than the fact that it wasn't generated by WU-FTPD, but by some other
	I'm not running any others..............

			Tuc/TTSG

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 2 Sep 1998 16:31:25 -0400 (EDT)

On Wed, 2 Sep 1998, TTSG wrote:

> I'm suprised I've only been "pitched" (Don't take it the wrong way) by
> the VR folks.  Bero? Anyone in the NCFTPD camp? 

you want the work done for you, take an existing patch.  Otherwise, dig
through the mailing list archives for the original posting  (Hint: it's
referenced in my FIXES* file).  Whose patches should I refer to, maybe
it's because I know my own best?  Bero's just merged mine into his.   the
NCFTPD camp has its own mailing list.

> This is sad. Why? Yea, yea, yea, security.  But *I* should be able to
> make that call, not the machine. If its so security oriented then why

If it's the log message you're concerned about, tell bind to stop
generating them.  And I have inclusion of tcpwrappers in my TODO list. 

> > > Sep 2 01:15:46 tyr ftpd[10020]: mozilla@ of 210.96.13.54
> > > [210.96.13.54]:  data connect from 210.96.13.73 for
> > > /pub/download/webcelerator.exe (1336971 bytes)

OK, so you're running an old (and therefore not as secure) version of
wu-ftpd.  Get the latest before you get hacked.  With your traffic, it's
only a matter of time.

What this is telling you is you machine was used in what could potentially
be an 'ftp bounce' attack.  Sure, the RFC allows the data connection to
come from some IP address other than the control connection, but wu-ftpd
no longer does.  If you want to read more on this subject, see
http://www.cert.org/ (I don't recall the advisory number .. sometime in 97
or early 98 it was.) 

----

---

From: TTSG <[email-masked]>
Date: Wed, 2 Sep 1998 17:07:30 -0400 (EDT)

> NCFTPD camp has its own mailing list.
	I'm sorry Gregory, I'm not trying to insult you. I'm sorry if I
have.  I'm not trying to accuse you of trolling the group to make 
converts.  I will take a look at your patches. I just had hoped that
the problems/functionality would be in the Academ releases, so that I
don't have to keep getting them and patching them.  
> generating them.  And I have inclusion of tcpwrappers in my TODO list. 
	I have a feeling I'll need to re-compile it. Doesn't seem to
be a command line/config file option. 
> http://www.cert.org/ (I don't recall the advisory number .. sometime in 97
	Um...................
heimdall:/usr/spool/uucp/.Admin# ftp tyr.ttsg.com
Connected to tyr.ttsg.com.
220 tyr.ttsg.com FTP server (Version wu-2.4.2-academ[BETA-18](1) Tue Aug 25 11:50:21 EDT 1998) ready.
Name (tyr.ttsg.com:root):

tyr# strings ftpd|grep "data connect"
Can't open data connection.
%s of %s [%s]: data connect from %s for %s%s
Opening %s mode data connection for %s%s.
Using existing data connection for %s%s.
Can't build data connection: no PORT specified
Can't build data connection
     No data connection

	Its in there, just can't figure out WHERE. I see bits and pieces of
it, but not the whole string.

			Tuc/TTSG

---

From: TTSG <[email-masked]>
Date: Wed, 2 Sep 1998 17:15:59 -0400 (EDT)

> wu-ftpd.  Get the latest before you get hacked.  With your traffic, it's
	AH, got it (I musta looked 242 times )

Around line 2494 of a Beta-18 virgin ftpd.c

        if (strcmp(dataaddr, remoteaddr) != 0) {
        /*
         * This will log when data connection comes from an address different
         * than the control connection.
         */
            syslog(LOG_NOTICE, "%s of %s [%s]: data connect from %s for %s%s",
                anonymous ? guestpw : pw->pw_name, remotehost, remoteaddr,
                dataaddr, name, sizebuf);
        }

	Does this imply firewalls? NAT?

			Tuc/TTSG

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Wed, 2 Sep 1998 22:53:34 +0200 (CEST)

> 	1) Is there any way to stop wtmp loggin. In 1 day only its

Get either BeroFTPD or the VR6 patches for wu-ftpd.

> 	2) Is there a way to stop DNS lookups?

Why would you want to do that?

> If nothing more to stop all the :
> 

You can prevent named from logging those.
Add "check-names response ignore" to your named.conf/named.boot file.
Check "man named" for details.

> 	What is different about that connection than any other?

According to the code generating the warning:
/*
 * This will log when data connection comes from an address different
 * than the control connection.
 */

The control connection is the connection on which the ftp server accepts
commands and sends replies; the data connection is the one on which the
actual files are transmitted.
This message can be caused by a strange client, a proxy, or a firewall, or
by someone feeding commands directly into the ftp server by telnetting
into port 21; probably nothing to worry about.

LLaP
bero

-- 
Windows 98 supports real multitasking - it can boot and crash simultaneously.
***
Anyone sending unwanted advertising e-mail to this address will be charged
$25 for network traffic and computing time. By extracting my address from
this message or its header, you agree to these terms.

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 2 Sep 1998 17:29:21 -0400 (EDT)

> 	Does this imply firewalls? NAT?

Considering what you're seeing, probably dynamic NAT.  What concerns me is
*** THIS SHOULD NOT BE ALLOWED *** .oO( Ouch! Can I yell any louder? )  I
thought it _was_ disallowed.  Does anyone remember seeing anything from
Stan about re-enabling it? 

----

---

From: TTSG <[email-masked]>
Date: Wed, 2 Sep 1998 17:42:23 -0400 (EDT)

> Get either BeroFTPD or the VR6 patches for wu-ftpd.
	I think I will definitely have to do that.
> Why would you want to do that?
	TOO EXPENSIVE an operation. PLUS all the crud its putting out
because of Lame servers , bad refferals, etc.  If I really need it,
I'll take the IP in the log on another machine and resolve it there.
But for what I'm doing I don't.
> Check "man named" for details.
	Checked that, still getting it all :

Sep  2 17:31:02 tyr named[25527]: bad referral (169.83.209.in-addr.arpa !< 166.169.83.209.in-addr.arpa)
Sep  2 17:31:02 tyr named[25527]: ns_forw: query(17.202.255.200.in-addr.arpa) No possible A RRs
Sep  2 17:31:05 tyr named[25527]: Lame server on '73.8.6.200.in-addr.arpa' (in '8.6.200.in-addr.arpa'?): [204.97.212.10].53 'NS3.SPRINTLINK.NET': learnt (A=198.41.0.4,NS=128.8.10.90)
> into port 21; probably nothing to worry about.
	Ok, thanks.  Just an unwanted log message, thats all. Shouldn't
it be wrapped by an "if (logging){ }"????

			Tuc/TTSG

---

From: Harris Kosmidhs <[email-masked]>
Date: Fri, 4 Sep 1998 15:31:41 +0300 (EEST)

> improvements/fixes for the daemon.

Just a thought...
Why the VR? patches aren't in the wu-ftpd original package?
I haven't tried them yet, but I believe they work :))

Harris

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Fri, 4 Sep 1998 18:32:14 +0200 (CEST)

> I haven't tried them yet, but I believe they work :))

They do work... I think the only reason they aren't in the original
package is that the original package hasn't added any features for months.
(years?)
That's why I decided I was fed up with it and started doing my own
version, BeroFTPD (which has the VR? patches in the original package).

LLaP
bero