Subject: RFC 931 authentication

From: Nick Maclaren <[email-masked]>
Date: Wed, 07 Oct 1998 19:25:16 +0200

Attempting to build Beta 18, I discover that RFC 931 code is present,
but is pretty firmly excluded.  Yes, I can easily include it, but
does this indicate that it is not fully supported?

Naturally, I am not crazy enough to rely on the identification, but
it can save a fair amount of poking around when chasing up users who
have done something odd or triggered a problem.  So, I am being
foolish to enable it?

Regards,
Nick Maclaren,
University of Cambridge Computing Service,
New Museums Site, Pembroke Street, Cambridge CB2 3QG, England.
Email:  [email-masked]
Tel.:  +44 1223 334761    Fax:  +44 1223 334679

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 7 Oct 1998 14:54:21 -0400 (EDT)

On Wed, 7 Oct 1998, Nick Maclaren wrote:

> but is pretty firmly excluded.  Yes, I can easily include it, but does
> this indicate that it is not fully supported?
> 
> Naturally, I am not crazy enough to rely on the identification, but it
> can save a fair amount of poking around when chasing up users who have
> done something odd or triggered a problem.  So, I am being foolish to
> enable it?

This has been on Stan's TODO list for some time now (ie., years).  I'd
never noticed the code was there, just diabled.

If you to enable it, there's a few things to look out for:

 - While it's called from the mainline (ftpd.c) there is no support for
   A_RFC931 there.  That means the code will detect that the user was
   authenticated via RFC931, but there is no way to handle that as a
   special case.  This has effect in the password check logic for
   anonymous users (it will insert their username in the suggested
   response if they supply a password the daemon doesn't like).  It also
   has effect in the xferlog (the name from RFC931 is logged).  There's a
   comment about a magic cookie (%u) which should display the RFC931 name,
   but the code for that cookie is not present.

 - The login time will be extended by the time it takes for the RFC931
   transaction to occur.  If the remote system does not respond quickly,
   the user may become frustrated at the appearently slow response time
   from the server.

If you enable this code and it works, send me a private email and I'll see
about finishing out the code (adding the magic cookie).

I think the main reason a lot of people don't care whether this code is
present is you can get the same effect, a lot easier and more reliably,
using the tcpwrappers (tcpd) on the command-line in your inetd.conf file.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195