Subject: Disable Login after wrong password

From: [email-masked]
Date: Thu, 14 Jan 1999 13:57:13 +0100

Hi,

I am wondering if it is possible to disable the ftp account after the user
has entered (let say) 3 times the wrong password ?
The account should be completely disabled, I do not mean the disconnect
feature setting in ftpaccess (loginfails <number>).

System: Solaris 2.6, wu-ftp 2.4.2-beta 18

Any comments or suggestion ?

Ralf Kruedewagen
Cologne - Germany
[email-masked]

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 14 Jan 1999 08:30:01 -0500 (EST)

On Thu, 14 Jan 1999 [email-masked] wrote:

> I am wondering if it is possible to disable the ftp account after the
> user has entered (let say) 3 times the wrong password ? The account
> should be completely disabled, I do not mean the disconnect feature
> setting in ftpaccess (loginfails <number>).

Possible?  Yes, anything is possible with code; it's not a feature of the
daemon.  I'm not even sure how to portably code such a feature.

Advisable?  That's the question.  I doubt this is a very smart feature to
have.  It gives a lot of power to the ftp daemon, and in an area where the
few, if any, programs should be allowed.  The possible DoS attacks against
such feature make my back shiver just thinking about them.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195