Newsgroups: bit.listserv.advanc-l
Date:         Tue, 1 Sep 1992 11:37:39 MST
              <ADVANC-L@IDBSU.BITNET>
From:         Dan Lester <ALILESTE@IDBSU.BITNET>
Subject:      ftp restrictions

Last week there was some discussion, both on and off list, of the potential
security problem of patrons being able to ftp files from the Advance
systems.

Following is a collection of information that some of us have put together
on the problem and ways of solving it.   The materials from Tom at
Humboldt are reposted (and edited a bit) with his permission.

BSU has solved the problem by creating a file in the root directory of Unix
named ftpusers.  The contents of this file are the logins that do NOT
require passwords, such as "catalyst" for our system.  This seems secure
at the moment.

Our next question is whether there is any need to even have ftp loaded on
our system.  We were using it to transfer patron files from another
campus machine that maintains those files.  Since we have changed how that
file transfer occurs, we may just omit ftp from the system.  Is there any
reason not to?

dan




From: tem@scout.humboldt.edu
Date: Wed, 26 Aug 92 16:43 PDT

The file /etc/ftpd.deny did not work on our DG/UX (dg sysadm manual said it
would). Created file /etc/ftpusers and this works. Right now I just have adv
and advance in file, but planning to add more. This does not seem to stop
anonymous ftp users. The DG/UX manual recommends deleting anonymous from
/etc/passwd if you are not going to use it.



From: tem@scout.humboldt.edu
Date: Wed, 26 Aug 92 23:26 PDT

Humboldt State
--------------
Unix DG/UX Release 4.32 Aviion
FTP server is DG/UX TCP/IP Release 4.30 May 90
Universe is 5.4
Advance is 3.?

vs.

Boise State
-----------
Unix DG/UX Release 5.4
FTP server DG/UX TCP/IP Release 5.4 June 91
Universe 6.3
Advance 4.02.1

We seem to be operating on an earlier revision of unix, tcp/ip, universe
and advance.

* You might find that /etc/ftpd.deny works fine on your system. *
  (method described in dg/ux manual)

* /etc/ftpusers disabled specific ftp logins on our system  *
  (maybe due to our earlier tcp/ip rev number?)



From: tem@scout.humboldt.edu
Date: Thu, 27 Aug 92 13:05 PDT

A slight correction to my previous email about disabling anonymous ftp.

The ftpd.deny documentation mentions that to disable anonymous ftp, you
should remove the ftp username from the /etc/passwd file.

I have not removed username ftp from /etc/passwd. I am not sure if this
disables all ftp or just anonymous ftp. I will talk with geac before deleting
the ftp user in /etc/passwd. My main concern was the advance logins without a
password.

Tom Mendenhall
Humboldt State University
Arcata, Ca.
Voice: (707) 826-3167
Fax: (707) 826-5590
Internet: scout.humboldt.edu

*****************************************************************************
* Dan Lester                          Bitnet:   alileste@idbsu              *
* Associate University Librarian      Internet: alileste@idbsu.idbsu.edu    *
* Boise State University                                                    *
* Boise, Idaho  83725                 BSU and I have a deal: I don't speak  *
* 208-385-1234                        for them and they don't speak for me. *
*****************************************************************************
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU