Subject: FTP-GW related question

From: "Todd Williams" <[email-masked]>
Date: Wed, 11 Apr 2001 17:22:38 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

We have recently added an application server using the FWTK 2.1's ftp-gw.
There is no authentication happening, nor should there be as there is no
auth server defined.  I've been using the ftp-gw in the past from other
hosts without any issues, however I am beginning to suspect that something
the ftp client of the app server has somehow generated these auth related
error messages in syslog:

Apr 11 16:50:36 fwtkhost ftp-gw[13903]: fwtkcfgerr: no authserver defined!
cannot authenticate!
Apr 11 16:50:37 fwtkhost ftp-gw[13903]: app1.my-internal.com/192.168.123.4:
STOR foo.txt

Is there any easy way to clean this error up?

Thanks in advance,

Todd

---

From: Keith Young <[email-masked]>
Date: Wed, 11 Apr 2001 20:30:24 -0400

> Is there any easy way to clean this error up?

Todd,

What does your netperm-table look like?

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Wed, 11 Apr 2001 20:39:13 -0400

>Is there any easy way to clean this error up?
You've got -auth or -authall enabled on the ftp-gw, or your user is 
entering an "auth" command. It's possible they're running some peecee FTP 
client that's sending an auth command for some reason or another..
         -Rick

---

From: "Todd Williams" <[email-masked]>
Date: Thu, 12 Apr 2001 10:30:42 -0400

>>What does your netperm-table look like?

The numbers have been changed to protect the innocent.  :)

netacl-in.ftpd: timeout 60
netacl-in.ftpd: hosts 192.168.8.100 -exec /usr/sbin/in.ftpd -l -a
netacl-in.ftpd: hosts 192.168.8.118 -exec /usr/sbin/in.ftpd -l -a
netacl-in.ftpd: hosts 192.168.8.145 -exec /usr/sbin/in.ftpd -l -a
netacl-in.ftpd: hosts 192.168.8.149 -exec /usr/sbin/in.ftpd -l -a
netacl-in.ftpd: hosts 192.168.9.135 -exec /usr/sbin/in.ftpd -l -a
netacl-in.ftpd: hosts unknown -exec /bin/cat /usr/local/etc/ftp/noftp.txt
netacl-in.ftpd: hosts * -exec /bin/cat /usr/local/etc/ftp/noftp.txt

Note, there is no reference to -auth or -authall.  The ftp application
(Net::FTP perl module) is possibly generating some sort of auth request, and
perhaps that's where we need to look.  Regardless, I was pondering if there
was an easy way to shut off the logging messages like this: "fwtkcfgerr: no
authserver defined! cannot authenticate!" in this case.

Thanks,

Todd

---

From: Ted Keller <[email-masked]>
Date: Thu, 12 Apr 2001 20:36:29 -0400 (EDT)

So your allowing specific addresses to ftp to your firewall? - then using
the vendor ftp daemon to connect externally.....  You may want to
reconsider this (or I'm not understanding what your are trying to do - and
use the ftp-gw for ftp proxying.

ted keller

---

From: "Todd Williams" <[email-masked]>
Date: Fri, 13 Apr 2001 10:22:31 -0400

We're allowing specific internal private RFC 1918 host addresses to use the
ftp-gw as an ftp proxy to public internet sites, and seeing the error
messages as previously mentioned.  There is no FTP'ing to the firewall.

Todd Williams

-----Original Message-----
From: Ted Keller [mailto:[email-masked]]
Sent: Thursday, April 12, 2001 8:36 PM
To: Todd Williams
Cc: 'Keith Young'; [email-masked]; 'Rick Murphy'
Subject: RE: FTP-GW related question

ted keller

---

From: Ted Keller <[email-masked]>
Date: Fri, 13 Apr 2001 13:09:32 -0400 (EDT)

So why don't you have entries like....

ftp-gw: denial-msg      /usr/local/fwtk/deny.txt
ftp-gw:         timeout 21600
ftp-gw:         directory /fwroot
ftp-gw:         permit-hosts xxx.xxx.xxx.* -log { retr stor }
ftp-gw:         permit-hosts xxx.xxx.xxx.* -log { retr stor }

and have your inetd file call your ftp-gw proxy?

ted keller

---

From: "Todd Williams" <[email-masked]>
Date: Fri, 13 Apr 2001 13:44:33 -0400

You'll have to forgive my brain fart...  I copied the wrong part of the
netperm-table file.  I don't know what I was thinking there.  My apologies.

Here's what it should have been:

ftp-gw: denial-msg      /usr/local/etc/ftp/ftp-deny.txt
ftp-gw: welcome-msg     /usr/local/etc/ftp/ftp-welcome.txt
ftp-gw: help-msg        /usr/local/etc/ftp/ftp-help.txt
ftp-gw: permit-hosts 192.168.120.* -log { retr stor }
ftp-gw: permit-hosts 192.168.130.* -log { retr stor }
ftp-gw: permit-hosts 192.168.123.4 -log { retr stor }
ftp-gw: permit-hosts 192.168.123.6 -log { retr stor }
ftp-gw: timeout 900

> > > Is there any easy way to clean this error up?

Sorry for the confusion.

Todd