Subject: Re: Is this security policy possible?

From: "Craig Shrimpton" <[email-masked]>
Date: Sat, 5 Dec 1998 14:05:20 -0500

Basically, I'm running a public web server and I'm trying to reduce password
snarfing as much as possible.  I have users who log in as guests over the
Internet and most use easily crakable/sniffable passwords.  I want to set it
up so any anonymous login from anywhere is permitted.

class    remote    anonymous    *

Next, I want people who login to my  dialup server to access the server as
guest or anonymous.

class    local      guest    *.domain    0.0.0.0   1.1.1.1
(I assume I replace *.domain and 0.0.0.0, etc. with my domain and globbed
ips)

Finally, I want real or guest users to to be able to login from sites
considerd non-local if and only if they are in the ftphosts.  I.E., I want
special control for those users that don't use my ISP for server access.
Some users I may want to let in from any ip (*) or some from predefined ips.

The last class entry is what I'm not sure of.

Thanks,

Craig

-----Original Message-----
From: Gregory A Lundberg <[email-masked]>
To: Craig Shrimpton <[email-masked]>
Cc: [email-masked] <[email-masked]>
Date: Saturday, December 05, 1998 8:25 AM
Subject: Re: Is this security policy possible?

>
>For specific hints, I'd need specific examples or what you do / do not
>want to happen.
>
>--

---

From: Gregory A Lundberg <[email-masked]>
Date: Sat, 5 Dec 1998 16:53:49 -0500 (EST)

On Sat, 5 Dec 1998, Craig Shrimpton wrote:

> Basically, I'm running a public web server and I'm trying to reduce
> password snarfing as much as possible.  I have users who log in as
> guests over the Internet and most use easily crakable/sniffable
> passwords.  I want to set it up so any anonymous login from anywhere
> is permitted.
> 
> class    remote    anonymous    *
> 
> (I assume I replace *.domain and 0.0.0.0, etc. with my domain and
> globbed ips)
> 
> considerd non-local if and only if they are in the ftphosts.  I.E., I
> want special control for those users that don't use my ISP for server
> access. Some users I may want to let in from any ip (*) or some from
> predefined ips.
> 

I run the VR version so I'll use CIDR to specify this stuff, but you
should be able to work it out using old-stlye address globs.  Just
remember that there are ways to fool with DNS to get arround addrglobs.

Here's the security model I'll stipulate:

1) Anonymous FTP allowed from everywhere.
2) All users are guests (chroot'd) unless I say otherwise
3) All users from 'my' network are allowed
4) I have a few users, small enough to manage specially, who I want to
   allow from specific machines or networks.
5) Except for (3) and (4), all other non-anonymous access is not allowed.

My network is 205.133.13.0/24 and, for discussion, we'll say I also run a
10-net, 10.0.0.0/8

First, let's address ftphosts.  I need to allow 'anonymous' and 'ftp' from
everywhere.  I need to allow '*' (everyone) from my networks.  And I have
two users 'orville' and 'wilbur' who I want to allow special non-local
access from their home machines.  Orville comes in from somewhere at
Wright State University (*.wright.edu) and Wilbur uses a machine which
doesn't have a name (I'll use the non-routable 192.168.0.5).

So, my /etc/ftphosts should look like:

# /etc/ftphosts
#
# Allow anonymous FTP from anywhere
#
allow ftp       0.0.0.0/0
allow anonymous 0.0.0.0/0
#
# Allow Orville from Wright State only
# This can be a risk .. I'm trusting the hostmaster at wright.edu to have
# set things up right and not deligated any subdomains to non-trusted
# people.  Considering it's an EDU domain, probably a bad choice but what
# the heck, this is _just_ an example.
#
allow orville   *.wright.edu
deny  orville   0.0.0.0/0
#
# Allow Wilbur from his machine only
# This is a risk only if I allow people on my network so they can spoof
# the IP address.  I don't and my upstream doesn't, so it's pretty safe on
# this end.  At Wilbur's end someone could spoof his IP address.  Ah well,
# such is the Internet.
#
allow wilbur    192.168.0.5/32
deny  wilbur    0.0.0.0/0
#
# Allow anyone from my local network (this includes Orville and Wilbur)
# No risk here .. I control these numbers and the physical network.
#
allow *         205.133.13.0/24
allow *         10.0.0.0/8
#
# Deny everyone else
#
deny  *         0.0.0.0/0
#
# eof

Now, I need to set up my ftpaccess.  I'm using VR so I can also show the
everyone's a guest feature as well:

# /etc/ftpaccess
#
# Separate local and remote for each type so we can do different limits
#
class localanon   anonymous 205.133.13.0/24 10.0.0.0/8
class localguest  guest     205.133.13.0/24 10.0.0.0/8
class localreal   real      205.133.13.0/24 10.0.0.0/8
class remoteanon  anonymous 0.0.0.0/0
class remoteguest guest     0.0.0.0/0
class remotereal  real      0.0.0.0/0
#
# Everyone's a guest, we'll use UID and forget about Unix groups.
#
guestuser *
#
# Well, I'm a real user and so is 'ftp' for anonymous.
# This 'ftp' thing is an anachonism.
#
realuser ftp
realuser lundberg
#
# Also, let's be nice to anything else running on the machine.
#
nice 15
#
# Let's limit anonymous users to an hour total connect time.
# This doesn't effect transfers in progress when the limit is passed.
#
limit-time anonymous 60
#
# Limit remote anonymous to 25 sessions
#       remote guest to 2 sessions (there's just the two of 'em).
#       remote real to 1 (just me)
#       local sessions are limited to 50 each, except me .. I'm not
#           limited (which is a risk of DoS if someone breaks into my
#           account .. I don't _really_ unlimit myself, this is a example)
#
limit remoteanon  25 Any
limit remoteguest  2 Any
limit remotereal   1 Any
limit localanon   50 Any
limit localguest  50 Any
limit localreal   -1 Any
#
# There's a few files and directories that are just to dangerous, so let's
# keep people from retrieving them.  The last one is so I don't do
# anything really *dumb* like try to RETR /dev/zero
#
noretrieve core
noretrieve /home/users/bin/ /home/users/etc/
noretrieve /boot/ /dev/ /lost+found/ /proc/ /home/lost+found/
#
# People mainly use clients nowadays, so let's set the login failure limit
# low.
#
loginfails 2
#
# Not using /etc/ftpgroups
#
private no
#
# I don't like to show the version number on the greeting.
#
greeting brief
#
# And the machine is multihomed so let's be sure the hostname on the
# greeting is what we want it to be.
#
hostname ftp.vr.net
#
# Any comments to my ftp alias
#
email [email-masked]
#
# Let's support message and readme files
#
message .welcome login
message .message cwd=*
readme  README*  cwd=*
readme  readme*  cwd=*
#
# Let's log the important stuff
#
log transfers real,guest,anonymous inbound,outbound
log security real,guest,anonymous
#
# And let's let people do on-the-fly compress and tar for downloads.
#
compress yes *
tar      yes *
#
# Let's make sure anonymous users can't change anything.  This is the
# default, but I like it here anyway.
#
chmod     no anonymous
delete    no anonymous
overwrite no anonymous
rename    no anonymous
umask     no anonymous
#
# And let's do a quick check on anonymous passwords.
#
passwd-check rfc822 warn
#
# For uploads, let's only allow clean names.  I don't allow spaces in
# names, although I guess I should nowadays.
#
path-filter anonymous,guest /etc/pathmsg ^[-A-Za-z0-9_\.]*$ ^\. ^-
#
# Here's the meat.  The upload limitations ...
#
# I'm the only real user but I limit myself to safe things anyway.
#
upload /home/users/lundberg * no
upload /home/users/lundberg /tmp yes nodirs
upload /home/users/lundberg /home/users/lundberg   yes
upload /home/users/lundberg /home/users/lundberg/* yes
upload /home/users/lundberg /home/ftp/incoming   yes vrnet vrnet 440 nodirs
upload /home/users/lundberg /home/ftp/incoming/* yes vrnet vrnet 440 nodirs
upload /home/users/lundberg /home/ftp/private/*/incoming   yes * * 440 nodirs
upload /home/users/lundberg /home/ftp/private/*/incoming/* yes * * 440 nodirs
#
# Anonymous users can only upload into the incoming areas.  This first
# line is the default but I like to state it anyway.
#
upload /home/ftp *                     no
upload /home/ftp /incoming             yes vrnet vrnet 440 nodirs
upload /home/ftp /incoming/*           yes vrnet vrnet 440 nodirs
upload /home/ftp /private/*/incoming   yes * * 440 nodirs
upload /home/ftp /private/*/incoming/* yes * * 440 nodirs
#
# Guests .. I use Unix permissions to keep them out of each other's areas
# and since they're chroot'd I only need worry about the system-level
# stuff.
#
upload /home/users/* /      no
upload /home/users/* /bin   no
upload /home/users/* /bin/* no
upload /home/users/* /etc   no
upload /home/users/* /etc/* no
#
# Let's set the anonymous root here so I don't have to mess with
# /etc/passwd
#
anonymous-root /home/ftp
#
# And set the guest root, again so I don't have to fight with the home
# directory entries in /etc/passwd.
#
guest-root /home/users
#
# There's a lot of special UID and GID used for system management and we
# don't want anyone trying to spoof as on of them!  This makes
# /etc/ftpusers unneeded.
#
# Anyone trying to log in with a UID or GID less than 100 on my system is
# not welcome.  Also, my company-files owner and group isn't allowed to
# use FTP .. employees use their accounts and nobody uses the company
# account.
#
deny-uid %-99 vrnet
deny-gid %-99 vrnet
allow-uid ftp
allow-gid ftp
#
# eof

Special note to non-VR (non-BeroFTPD) users.  Several of the features
discussed above are available in other ways, or not available at all, in
the standard WU-FTPD 2.4.2 (Beta-18) release.

Final note: while a lot of this is what's in my running /etc/ftpaccess, a
lot is here just for example.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195