Subject: A question about the ftphosts file

From: James McMahon <[email-masked]>
Date: Tue, 16 Feb 1999 12:16:14 +1100

I have just upgraded from wu-ftpd beta 18 to wu-ftpd beta 18 VR13 and
have noticed the following problem with matching entries in the ftphosts
file.

My allow vhannan  ftphosts file has the following entry:
    allow vhannan  203.37.26.* 203.23.182.* 203.37.27.*

When the above user logs in, the following message is logged to
/var/adm/syslog:

    Feb 16 10:56:12 amethyst.sge.net ftpd[27525]: FTP LOGIN REFUSED
(name in /opt/local/etc/ftphosts) FROM isp265.unl.can.dynamite.com.au
[203.37.27.25], vhannan

When I comment out the users entry in the hosts file, the user can log
in fine (as is to be expected after looking at the source hostacc.c)

It is my understanding that IP's of the above form should be correctly
expanded, but I guess that I could reformulate the ftphosts entry into
IP:Netmask or CIDR notation for it to work correctly.

I was wondering if anyone could shed any light on why this login is
refused?

Thanks,

James McMahon
SGE

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 15 Feb 1999 22:06:38 -0500 (EST)

On Tue, 16 Feb 1999, James McMahon wrote:

> have noticed the following problem with matching entries in the
> ftphosts file.
> 

This is another example of the unsafe code in the older versions of the
daemon.  Consider the host

  203.37.26.attacker.sample.net

If you switch back to an older version you will find access for user
vhannan will be allowed from the attacker.sample.net site.

> IP:Netmask or CIDR notation for it to work correctly.

I have a patch which will be in VR15 (for release on the 1st) which will
re-enable the notational form you're using.  Although I strongly encourage
all administrators to use CIDR notation instead, I can make the patch
available on a by-request basis.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195