Subject: Re: HELP!!!

From: James McMahon <[email-masked]>
Date: Tue, 09 Mar 1999 09:08:43 +1100

I had this same problem a month or so ago.  The following is the reasons for
the change, and a
recommendation that you change the format of your ftphosts file ( mostly
paraphrased from an email that I received from Gregory Lundberg)

--

if you have a statement in your ftphosts file such as

allow usera 10.1.1.*

then usera on host 10.1.1.attacker.net could log in to your server.

A far better (security wise) and equivalent (effect wise) solution is to use
one of the following formats:

allow usera 10.1.1.0/24 or
allow usera 10.1.1.0:255.255.255.0

After saying all that, the above problems were fixed in Beta 15 and Beta 16 so
that the 10.1.1.* notation would work as you expected and not allow hosts of
the form 10.1.1.attacker.net

In summary ... If you upgrade to Beta15 or Beta16, it will work as you expect,
but I would still recommend you modify your ftphosts file to use CIDR or
address:netmask notation.

Anyway, I hope this has made it a bit clearer for you.

James
Secure Gateway Environment

Bitar, Martin (NCI) wrote:

> I NEED HELP!!
>
> I upgraded our WU-FTP server from Version wu-2.4.2-academ[BETA-18] to
> [BETA-18-VR14].  However, it seems that the new server does NOT accept wild
> cards with IP addresses in the ftphost file.  All ftp accounts listed in
> the
> file can no longer get in.  They get a "login incorrect" message. The
> entries in logfiles,  state the following:
>  "FTP LOGIN REFUSED (name in /etc/ftphosts) FROM `users' hostname` [users'
> IP address], userid"
>
> However, when I add a full IP address, the users can ftp successfully.
>
> My ftphosts and ftpaccess files are intact and haven't changed after the
> upgrade.  I checked them - and the entries in them - repeatedly after the
> upgrade to insure their accuracy and validity.   It worked  seamlessly
> before, but doesn't after the upgrade  :-<  I had to revert back to the old
> version of wu-ftpd.  I also tried a clean install on a different server to
> rule out the possibility of any conflicts with files from an older
> installation/version.......same results!
>
> I'm running Solaris 2.6 on an Ultra-1 box.  Any input would be GREATLY
> appreciated!
>
> Martin

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 8 Mar 1999 18:19:30 -0500 (EST)

On Tue, 9 Mar 1999, James McMahon wrote:

> In summary ... If you upgrade to Beta15 or Beta16, it will work as you
...VR15 or VR16 ...
> expect, but I would still recommend you modify your ftphosts file to
> use CIDR or address:netmask notation.

I hope I didn't confuse beta and VR numbers like that.  not that it'd
surprise me if I did, my heads been so groggy with this cold lately ...

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195