Subject: Re: ftp access

From: Keith Smith <[email-masked]>
Date: Tue, 17 Oct 1995 21:18:40 -0400

At 12:57 PM 17/10/95 GMT, you wrote:
>I define the two classes external and internal. The external one is
>determined by one hostname/ipadress on my network. The internal one is
>determined by all other hosts on my network.
>
>Today the entries in ftpaccess looks like this:
>
>class   external        anonymous,guest 130.226.64.30
>class   internal        anonymous,guest,real 130.226.65.* 130.226.66.*
130.226.67.*
>class   internal        anonymous,guest,real 130.226.64.1* 130.226.64.2*
130.226.64.4* 130.226.64.5* 130.226.64.6* 130.226.64.7* 130.226.64.8*
130.226.64.9*
>class   internal        anonymous,guest,real 130.226.64.31 130.226.64.32
130.226.64.33 130.226.64.34 130.226.64.35 130.226.64.36 130.226.64.37
130.226.64.38 130.226.64.39
>
>Is it possible somehow define the internal one as * except
>130.226.64.30? That would make ftpaccess much more readable and
>understandable. 

Yes, use domain names. Our domain paradigm.co.nz, therefore all machines are
below that, eg: machine.paradigm.co.nz

Sothe ftpaccess looks like:
   class local   real,guest,anonymous   *.paradigm.co.nz
   class remote  real,guest,anonymous   *

Regards,
Keith.

-------------
Keith Smith                                     [email-masked]
Paradigm Technology Limited                     Senior Software Engineer
P.O. Box 10-268                                 +64 (4) 495-1000 (voice)
Wellington, New Zealand                         +64 (4) 495-1003 (fax)
                   [all required disclaimers apply]

---

From: [email-masked] (Ulla Fischer)
Date: Wed, 18 Oct 95 13:40:15 GMT

>> determined by one hostname/ipadress on my network. The internal one
>> is determined by all other hosts on my network.
>> 
>> class internal anonymous,guest,real	130.226.65.* 130.226.66.* 130.226.67.*
>> class internal anonymous,guest,real	130.226.64.1* 130.226.64.2* 130.226.64.4* 130.226.64.5* 130.226.64.6* 130.226.64.7* 130.226.64.8* 130.226.64.9*
>> class internal anonymous,guest,real	130.226.64.31 130.226.64.32 130.226.64.33 130.226.64.34 130.226.64.35 130.226.64.36 130.226.64.37 130.226.64.38 130.226.64.39

Keith> Yes, use domain names. Our domain paradigm.co.nz, therefore all
Keith> machines are below that, eg: machine.paradigm.co.nz
Keith> So the ftpaccess looks like: 
Keith> class local real,guest,anonymous *.paradigm.co.nz 
Keith> class remote real,guest,anonymous *

Thanks for the advice, but it doesn't solve my problem. Keith's ftp
access file doesn't deny any access from machines on the local domain.

I need to deny access to real users one the ftp server, if the
connection is established from one specific host on my local
domain. But I must let guest and anonymous through. 

If I write
	class external anonymous,guest	special.dmi.min.dk
	class internal anonymous,guest,real	*
users from machine special can connect to the ftp server as real, and
I don't want that.

Any comments or ideas?

Ulla Fischer
Danmarks Meteorologiske Institut      Email: [email-masked]
Edb-afdelingen                        Phone: + 45 39 15 75 00 
Lyngbyvej 100                         Phone: + 45 39 15 75 54
2100 Koebenhavn 0                     Fax:   + 45 39 15 75 98
Denmark

---

From: Keith Pilotti <[email-masked]>
Date: Wed, 18 Oct 1995 12:45:07 -0700

How about a class that includes only the specific host and has zero 
connections allowed?

class   external real 			badhost.domain
class   internal guest,anonymous,real	*.domain
limit   external  0 Any              /ftpmsgs/sorry.msg
limit   internal  1000 Any           /ftpmsgs/toomany.msg

Just make sure this class appears before the class that includes the other 
hosts in *.dom.ain -- the first match found is the one that applies.

+Keith (the other Keith :)

  > >> class internal anonymous,guest,real	130.226.64.1* 130.226.64.2* 130
.226.64.4* 130.226.64.5* 130.226.64.6* 130.226.64.7* 130.226.64.8* 130.226.64.9
*
  > >> class internal anonymous,guest,real	130.226.64.31 130.226.64.32 130
.226.64.33 130.226.64.34 130.226.64.35 130.226.64.36 130.226.64.37 130.226.64.3
8 130.226.64.39
 
--
Keith F. Pilotti                                [email-masked]
QUALCOMM Incorporated                           UNIX Computer Support Team
6455 Lusk Boulevard                             +1 619 658-4555 (Voice)
San Diego, CA 92121-2779                        +1 619 658-2115 (FAX)

---

From: [email-masked] (Ulla Fischer)
Date: Thu, 19 Oct 95 12:23:18 GMT

Keith#2> How about a class that includes only the specific host and
Keith#2> has zero connections allowed?

Keith#2> class external real badhost.domain 
Keith#2> class internal guest,anonymous,real *.domain 
Keith#2> limit external 0 Any /ftpmsgs/sorry.msg 
Keith#2> limit internal 1000 Any /ftpmsgs/toomany.msg

That was a good idea. I'll use it. Thank you very much. 

Keith#2> Just make sure this class appears before the class that
Keith#2> includes the other hosts in *.dom.ain -- the first match
Keith#2> found is the one that applies.

Works just fine.

Ulla Fischer

>> I define the two classes external and internal. The external one
>> is determined by one hostname/ipadress on my network. The
>> internal one is determined by all other hosts on my network.

>> 130.226.64.4* 130.226.64.5* 130.226.64.6* 130.226.64.7* 130.226.64.8* 130.226.64.9 *
>> class internal anonymous,guest,real 130.226.64.31 130.226.64.32 130.226.64.33 130.226.64.34 130.226.64.35 130.226.64.36 130.226.64.37 130.226.64.3 8 130.226.64.39

>> understandable.  I need to deny access to real users one the ftp
>> server, if the connection is established from one specific host on
>> my local domain. But I must let guest and anonymous through.