Subject: class in ftpaccess and other question

From: "Peniak, Rick - MLG" <[email-masked]>
Date: Fri, 16 Jul 1999 10:06:10 -0700

Hi All,

I have read the man page for ftpaccess, but I'm still confused about
classes. I have the default line in my ftpaccess file, ie:

class   all   real,guest,anonymous  *

and have on idea how to, say, deny user X from being able to access the ftp
server, or deny anonymous users from being able to access the ftp server (I
tried removing 'anonymous' from the comma separated list and it didn't do
anything). What exactly is the class directive for in lamens terms?

I understand all other parts of the file.

Question #2:

Management at my company has forced the installation of wu-ftpd before I
started. My boss, with whom I work directly, wants me to find out all the
benefits of wu-ftpd in terms of security over the vanilla ftpd that came
with the HPUX10.20 server I am working on. I looked and couldn't find any
documentation regarding this. If someone could point me in the right
direction I would greatly appreciate it.

Thanks for all your help.

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 16 Jul 1999 13:34:18 -0400

On Fri, Jul 16, 1999 at 10:06:10AM -0700, Peniak, Rick - MLG wrote:

> and have on idea how to, say, deny user X from being able to access the
> ftp server, or deny anonymous users from being able to access the ftp
> server (I tried removing 'anonymous' from the comma separated list and it
> didn't do anything). What exactly is the class directive for in lamens
> terms?

A way of assigning a handle to a group of users.  That handle is used
elsewhere to control some security features.

Access to the daemon is not allowed unless the user can be classified in
this way.

Of course, as you're using it, it's not much of a classification.
Consider, though, if you have an Internet connection, a proxy to the LAN,
and use the reserved Class-A network 10 for your LAN.  Then you could say:

  class inside real,guest,anonymous 10.0.0.0/8
  class outside real,guest,anonymous !10.0.0.0/8

Now you could set different rules (user limits, etc) based upon whether the
user was from inside the proxy or outside.

> direction I would greatly appreciate it.

I doubt such a document exists.  The old BSD in.ftpd is so bad I don't
think anyone would seriously consider wasting their time trying to describe
HOW bad it is for anything but the most pedestrian use.

To be fair, though, if all you need is anonymous FTP.  And you're not
connected to the Internet.  And you don't have any local users on the Unix
box running the daemon.  And nobody on your LAN can use any Web or FTP
client.  Then the daemon which came with the OS might be secure enough for
your purposes.  Note, I said "might".

-- 

Gregory A Lundberg              WU-FTPD Development Group
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Bob Luckin <[email-masked]>
Date: Fri, 16 Jul 1999 14:28:53 CDT

> your purposes.  Note, I said "might".

You missed out the logging feature.  :-)  The reason I originally installed
wu-ftpd was to see what files were being pulled by whom and when.  It allowed
me to get some handle on which programs were popular, and which releases were
so little in demand that I could archive them off the site to save space.
Plus, if a developer discovered a serious bug, I could give him a list of
all the users who had pulled that version, so he could contact them.
(I was running a site used purely for internal software releases at the time).

Cheers, Bob
-- 
Bob Luckin      [email-masked]      "Coder, adapt.  FTP Ada, redo C"