Subject: [827] WFTPD won't send banner... firewall.

From: Thomas Leavitt <[email-masked]>
Date: Mon, 05 Dec 1994 11:06:57 -0800 (PST)

> 
> Howdy,
> 
> One of my users is trying to connect via ftp to webcom.com, from a
> machine behind a partial firewall (incoming TCP/UDP connections are
> blocked).
> 
> His ftp client is hanging, because your ftp server isn't sending a
> banner message ("220 webcom.com FTP server (Version wu-2.4(6) Wed Nov
> 23 22:34:23 PST 1994) ready.").
> 
> On the surface, this appears to be a security issue - your ftp server
> not allowing connections from hosts it can't connect back to.  Except
> that I can still telnet to your ftp server from these hosts, and
> (because I'm not an ftp client, and I don't have to follow the
> protocol and wait for the banner) login.
> 
> So, actually, it looks like this hypothetical security "feature" has
> broken your ftp server, and not actually bought you any additional
> security.
> 
> Could you have someone fix this?
> 

Help! This is utterly beyond me. How do I deal with this, stop this
behavior, etc?

Sincerely,
Thomas Leavitt
--
Web Communications (sm)            Thomas [email-masked]
Voice: (408) 457-9671              Lead Systems & Network Admin./Tech Suppt.
 
<a href="http://www.webcom.com/">Web Communications Home Page</a>

---

From: [email-masked]
Date: Mon, 05 Dec 1994 15:23:57 -0500 (EST)

The referenced mail message was received by "[email-masked]", a user who is 
no longer with the company and for whom we have no forwarding address, 
or it is an invalid address, which means there is no one there to read
your mail!  This mail appears to have been directed to the following
address(es):

    [email-masked]

Please verify that you actually mailed the person whom you were
intending to mail.  If you mailed a group alias, you should contact 
that alias's owner and explain to them that the alias contains an
ex-employee or an invalid address.  If you have further questions,
please address them to [email-masked].

The Mailer Daemon

---

From: Thomas Leavitt <[email-masked]>
Date: Thu, 08 Dec 1994 13:34:50 -0800 (PST)

Greetings.

I have re-compiled the FTP Server to turn off RFC 1431 (RFC 931)
compatibility, as a note in my distribution stated that this may cause
some connections to hang.

In this process, I looked through the source code. It looks to me
as if the security features of "authenticate" are only used with
Kerberos. If this is the case, are there any other security features or
other options that may be turned off to lessen the length of server
to client dialog on login.

What are the performance implications of guestgrouping a large 
number of users? (are there any?)

Sincerely,
Thomas Leavitt

--
Web Communications (sm)            Thomas [email-masked]
Voice: (408) 457-9671 x101         Lead Systems & Network Admin./Tech Suppt.