Subject: Re: Allow and deny host connections

From: Glenn Carver <[email-masked]>
Date: Fri, 15 Jan 1999 15:40:20 +0000

> > My problem is that any deny commands in the ftpaccess file take
> > precendent over allow commands in the ftphosts file. What I need to be
> > able to do is deny access from machines not registered in the DNS but
> > override this for specific hosts which we use. It would seem more
> > sensible to me to allow ftphosts to take precedent over entries in
> > ftpaccess since in ftphosts you can specify username whereas in
> > ftpaccess you simply specify an address glob.
> > 
> > Has anyone altered the code along similar lines before I alter the
> > code myself?
> 
> Not to my knowledge.
> 
> You should be able to get the same effect by using tcpwrappers when
> starting the daemon from inetd.  Doing it in the daemon, though, is
> logical since the rest of the work is already there.  I'd be very
> interested in seeing what you come up with.

Good point, I'd forgotten about wrappers.

I've been thinking a bit more about changing the ftpd code and I'd welcome 
comments.

In tidying up the code I'd be tempted to scrap ftphosts altogether and have all
the access control done in the ftpaccess file. Or alternately remove the deny
and allow controls from ftpaccess and do it all in ftphosts.

Part of the problem is that the deny and allow commands in ftpaccess and
ftphosts take different forms. I would propose a more general form for ftpaccess
of:   deny/allow <user> <addrglob> <msgfile>

This would combine the functionality of the ftpaccess and ftphosts file. The
approach could be that of tcp wrappers where the first match applies.

  Glenn

-----------------------------------------------------------------------
Dr. Glenn Carver, Senior Research Associate    Phone: +44 (1223) 336524
Centre for Atmospheric Science,                Fax:   +44 (1223) 336473
Cambridge University, Chemistry Dept.,    [email-masked]
Lensfield Road, Cambridge, CB2 1EW, UK    www.atm.ch.cam.ac.uk/~glenn/

         "Genius is one percent inspiration and ninety nine 
          percent perspiration"   Thomas Edison.
_______________________________________________________________________

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 15 Jan 1999 16:27:15 -0500 (EST)

> approach could be that of tcp wrappers where the first match applies.

I would recommend trying _not_ to break existing config files, so if you
can come up with clausenames other than 'deny' and 'allow' that'd be best.
Otherwise, I'd suggest this is a change best left for a major revision of
the daemon.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Glenn Carver <[email-masked]>
Date: Fri, 15 Jan 1999 21:42:33 +0000

>Otherwise, I'd suggest this is a change best left for a major revision of

That sounds like a recipe for even more confusion to me, and goes against
my natural tendency for tidy code (8-) but I take your point. Major
revisions tend to take a very very long time though. Another option would
be to introduce another file 'ftpconnect' which used new syntax for deny
and allow and took precedent over ftpaccess and ftphosts. Not ideal though.
I'll see how much work is involved. Thanks for the reply.

  Glenn

----
Dr. Glenn Carver, Senior Research Associate,
Centre for Atmospheric Science, Chemistry Dept., Cambridge University, UK
   [email-masked]     http://www.atm.ch.cam.ac.uk/~glenn/