Subject: access denied probs !?

From: Service ISK <[email-masked]>
Date: Tue, 8 Dec 1998 11:55:40 +0100

Hello

I have a problem with a running wu-ftpd on an freebsd 2.2.2
(wu-2.4(1) as package from freebsd).

All runs very well, but at one time I edited the
/usr/local/etc/ftphosts for a new user, no user couldn't come in (530
access denied) and (name in /usr/local/etc/ftphosts). Nothing changed
only this file.

my .../ftphosts:
allow user1 *
allow usern *
deny * *
all other files like sample from wu-ftpd but no anonymous.
Users are in passwd with .../false.

The first time this happend I searched and searched and didn't found
something was wrong. Then if I comment out the line "deny * *" in the
../ftphosts file all runs well!? I didn't understand this, but it
worked.

Now it happens an second time and nothing want't to go to run it up.

What is wrong or what did I wrong and why is this happening? Someone
an idea or help?

I have wu-ftpd on an other freebsd machine running and this one runs
well all the time. I did control over both the rights but didn't
found some other.

Please help, I think my hairs go out.  ;-)

Regards and sorry for my bad english.
Sigi.

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 8 Dec 1998 08:06:37 -0500 (EST)

On Tue, 8 Dec 1998, Service ISK wrote:

> ../ftphosts file all runs well!?

You need to allow 'ftp' and 'anonymous' in ftphosts.

# /etc/ftphosts
#
# Allow anonymous FTP from anywhere
#
allow ftp *
allow anonymous *
#
# Allow real/guest users 'user1' and 'usern' from anywhere.
#
allow user1 *
allow usern *
#
# Deny *EVERYONE* else from *EVERYWHERE*
#
deny * *
#
# eof

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Service ISK <[email-masked]>
Date: Tue, 8 Dec 1998 14:35:41 +0100

>You need to allow 'ftp' and 'anonymous' in ftphosts.

Thanks for your quick reply.

Hmmm, why do I need this?
I don't want anonymous and ftp to log in!
And it was running further without this two entries!

If I do them in, it is the same --> access denied and in syslog "name
in /usr/local/etc/ftphosts".

Regards Sigi.

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 8 Dec 1998 09:21:19 -0500 (EST)

> And it was running further without this two entries!

Sorry, my misunderstanding.  I thought your complaint was anonymous FTP
wasn't working.

> ># Deny *EVERYONE* else from *EVERYWHERE*

The deny * means if the name is not *EXACTLY* equal to 'user1' or 'usern'
then _deny_ access to _everyone_ _else_ (the first *) from _everywhere_
(the second *).

That means the user named 'greg' cannot FTP in.  It doesn't matter
whether 'greg' is set up correctly or not.  He cannot use FTP because the
ftphosts says so.

If you want 'user6' to be allowed to FTP you need to either add him in
ftphosts _before_ the deny or remove the deny and allow everyone.

So what is the problem?

--

---

From: Service ISK <[email-masked]>
Date: Tue, 8 Dec 1998 15:56:38 +0100

>Sorry, my misunderstanding.  I thought your complaint was anonymous
>FTP wasn't working.
>

:-)  Excuse, maybe I didn't explain exactly:

wu-ftpd is running for a long while very fine. I have the users in
passwd with group ftponly. In ftpaccess I have ftponly as guestgroup.
No anonymous login needed, only users for webspace. In ftphosts I
have all users like "allow username *". So it worked. Now after I
edited ftphosts (first time) for a new user no user come in the ftp
server, all get "access denied" and "name in .../ftphosts". I
searched and searched but found no error. Then I did an "#" bevor the
"deny * *" line in ftphosts and all worked fine. I don't understand
why. Now it happend twice. I edited the ftphosts for a new user and
after that nobody can get in, all get "access denied" and "name in
../ftphosts". I edit as root and I did always so.

I had copied the ftpaccess.sample, but this worked although not.

I hope you understand my problem now. Sorry for my bad english.

Sigi.

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 8 Dec 1998 10:25:45 -0500 (EST)

On Tue, 8 Dec 1998, Service ISK wrote:

> No anonymous login needed, only users for webspace. In ftphosts I have
> all users like "allow username *". So it worked. Now after I edited
> ftphosts (first time) for a new user no user come in the ftp server,
> all get "access denied" and "name in .../ftphosts". I searched and
> searched but found no error. Then I did an "#" bevor the "deny * *"
> line in ftphosts and all worked fine. I don't understand why. Now it
> happend twice. I edited the ftphosts for a new user and after that
> nobody can get in, all get "access denied" and "name in ../ftphosts".
> I edit as root and I did always so.

If you have a user, 'user1', do you want to restrict that user to only
accessing the ftp site from a specific machine or network?

If not the following command will fix your problem:

  rm -f /etc/ftphosts

If do need this restriction, you need to specifically list each user in
/etc/ftphosts. This sounces like what you have done.  If it is not working
there is a typographical error in your /etc/ftphosts file.

If you only need to restrict some users but do not care where others come
from, you need to be more specific in your deny:

# /etc/ftphosts
#
# Allow user1 from the machine 'user1.sample.com' and no other machine
#
allow user1 user1.sample.com
deny user1 *
#
# Allow all other users from everywhere.  This is the default, so we
# do not need to say anything!
#
# eof

Given everything you have said, and looking at the example you sent in
your first email, I suggest the correct solution is:

  rm -f /etc/ftphosts

--

---

From: Service ISK <[email-masked]>
Date: Tue, 8 Dec 1998 17:19:29 +0100

>have

Many thanks. In the moment I need no restrictions on this server.

Sigi.

---

From: [email-masked] (Agustin Arroyo Sotomayor)
Date: Tue, 08 Dec 1998 10:34:10 -0600

I would like to unsubscribe form the WU-FTPD mailing list.
Could some one explain me how to do it.
Thanks

--
*******************************
Agustín Arroyo Sotomayor
Amorfhia, S.A. de C.V.
Tels.- +52(5)-5132812/2872/2751 Fax.- +52(5)-6551783
mailto:[email-masked]
http://www.amorfhia.com.mx
*******************************

---

From: Service ISK <[email-masked]>
Date: Tue, 8 Dec 1998 19:24:02 +0100

>Many thanks. In the moment I need no restrictions on this server.

Oooh NOOOOO. That doesn't work. Now all users can change in other
directories!
The "..././:..." in the passwd doesn't work more!?

Please help.

Sigi.

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 8 Dec 1998 13:30:21 -0500 (EST)

> The "..././:..." in the passwd doesn't work more!?

Of course it does.

Check the FAQ.

Probably you don't have -a on the command line.
Or you forgot to kill -HUP inetd.
Or the users are not in the guest group.
Or the guestgroup in the ftpaccess isn't there or names the wrong group.
Or the daemon's using a different ftpaccess file than the one you're editing.

All this has NOTHING to do with /etc/ftphosts.  If it doesn't work now, it
never worked before.  You probably never checked.

-- 

The location of the latest version of wu-ftpd can be found in the 
directory
 
      ftp://ftp.academ.com/pub/wu-ftpd/private/
 
You can't see the directory contents, so read the message informing you
of the actual filename to retrieve. It's there.
 
wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd FAQ:              http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

--

---

From: Service ISK <[email-masked]>
Date: Tue, 8 Dec 1998 20:05:36 +0100

>> The "..././:..." in the passwd doesn't work more!?

No, it doesn't (on my machine)!

>Probably you don't have -a on the command line.

I never had an "-a" in the command line and it worked.
I tested with and without --> the same.

>Or you forgot to kill -HUP inetd.

I made it.

>Or the users are not in the guest group.

They are.

>Or the daemon's using a different ftpaccess file than the one you're

I didn't change the ftpd, the ftpaccess and there is no other
ftpaccess on the machine! The ftpd is from an freebsd package and
worked until now.

>All this has NOTHING to do with /etc/ftphosts.  If it doesn't work
>now, it never worked before.  You probably never checked.

I check every installing new user and it worked always bevor !!

Oh, I think that is a silly little problem wich isn't found in all
the snow here.  ;-)

Sigi.

>wu-ftpd FAQ:
>http://www.cetis.hvu.nl/~koos/wu-ftpd-faq.html
>wu-ftpd list archive:
>http://www.landfield.com/wu-ftpd/mail-archive/
>
>-- 
>