ioSecureAdduser - don't allow too big ip-range

[Pharaoh]

Hi,
is it possible to make ioFTPD not accept IP change to *@* or *@220.* because it is not specific enough? only allow at least 2 numbers after the @?
eg: *@210.115.* will be allowed because it has a more specific range (210.115)

TIA.

P.S. I am using ver. 4.9.4

[MaistroX]

This is a VERY intressting issue, coz this is allso needed for Beta 5+ of security reason, not only to be able to force atlest *@xxx.xxx.*.* , but allso be able to force Ident, so indent is needed in "addip" to be able to add ip at all.

anything u could add to ioFTPD, D1 ?


Would be a very appreciated security option

[Stardog]

perhaps adding this to the hosts.rules file?

[Mouton]

Originally posted by MaistroX
anything u could add to ioFTPD, D1 ?

dark specified many times that everything that isn't ftpd related would have to be scripted.

Your request require a script. A couple of lines in tcl/php/whatever would do.

[GOD-EMPEROR]

actually I would suggest that ip/ident filtering on adduser be set like glftpd with something secure_ip capabilities, but as long as addip is a staple of ftpd usage, the same settings should apply to that as well....

[Pharaoh]

Originally posted by GOD-EMPEROR
actually I would suggest that ip/ident filtering on adduser be set like glftpd with something secure_ip capabilities, but as long as addip is a staple of ftpd usage, the same settings should apply to that as well....

I agree with u, mate.
This feature should be quite easy to implement, and very useful.

[ADDiCT]

Ok, made this in 10 mins.
It will check ident@ip for addip/adduser/gadduser events

edit ioftpd.ini :

[Pre]
site = ..\scripts\ioSecureAdduser.exe

(tell me if it's any good)

[Pharaoh]

Originally posted by ADDiCT
Ok, made this in 10 mins.
It will check ident@ip for addip/adduser/gadduser events

edit ioftpd.ini :

[Pre]
site = ..\scripts\ioSecureAdduser.exe

(tell me if it's any good)

Is there any chance you could make it not allow adding IPs like:
*@* or even 1 number like *@128.* (an option that will be set in ioftpd.cfg by the admin), for example, something like:
minimumIPnumbers = 0 will allow adding *@*
minimumIPnumbers = 1 will not allow *@*, BUT will allow adding IPs like *@128
minimumIPnumbers = 2 will only allow IPs like *@128.217.*
3 will be 3 numbers and 4 will be only exact IP.

AND the ftp output when somebody try to add *@* (or any other, according to the option in the cfg file) when it is blocked would be something like "Can't add IP, not specific enough"

TIA.

P.S. Damn, I wish I was a programmer

[ADDiCT]

minimumIPnumbers = 0 will allow adding *@*
----> don't use the tool, or set ident_ip_mask = *

minimumIPnumbers = 1 will not allow *@*, BUT will allow adding IPs like *@128
----> ident_ip_mask = *@*#.*

minimumIPnumbers = 2 will only allow IPs like *@128.217.*
----> ident_ip_mask = *@*#.*#.*

(but now i come to think of it, i will have to change something else important in my tool first)

[Pharaoh]

Thanks mate, work as advertized!
SITE ADDUSER tester tester *@*
200-+-----------------------------
200-| BAD: *@*
200-+-----------------------------
200 Command FAILED.

Any chance you can change the BAD: to a custom message that the admin choose, or simply something like "IP NOT SPECIFIC ENOUGH" (like in glFTPD), so that the ops will get the message:

SITE ADDUSER tester tester *@*
200-+-----------------------------
200-| IP NOT SPECIFIC ENOUGH: *@*
200-+-----------------------------
200 Command FAILED.

THX again, bro, best 10min spent!!

[Pichento]

Hiya Addict.

Can you add the following option in the cfg. I need to be able to force:

ident@xxx.xxx.xxx.*

OR

*@xxx.xxx.xxx.xxx

For adding valid IP's

Thanks in advance!

[Pharaoh]

Originally posted by Pichento
Hiya Addict.

Can you add the following option in the cfg. I need to be able to force:

ident@xxx.xxx.xxx.*

OR

*@xxx.xxx.xxx.xxx

For adding valid IP's

Thanks in advance!

I *think* that you should just change the included ioSecureAdduser.ini file like this:
for ident@xxx.xxx.xxx.* change it to:
ident_ip_mask = *??@*#.*#.*#.*
and for *@xxx.xxx.xxx.xxx change it to:
ident_ip_mask = *@*#.*#.*#.*#

[ADDiCT]

problem is he needs both possibilities
i'm working on that, specify as many masks as u need

[ADDiCT]

- u can specify as many ident_ip_mask entries as needed
- use ### for a numeric ip part (no more *#)

[Pichento]

Thanks man!

Really - Really neat work.