Subject: [fwtk-users] Re: Usage of authsrv and time (solved)

From: [email-masked]
Date: Thu, 31 Jan 2002 15:54:53 +0100

Hello.
Thanks Rick, but I think you are not right.

Excerpt of my netperm-table:
...
ftp-gw:	permit-hosts 172.21.36.45 -extnd -authall -log { retr stor }
authsrv:	permit-operation user alice ftp-gw ftp.inria  time 08:00
12:00
authsrv:	deny-operation user michael ftp-gw ftp.zoo.fr  time 17:00
11:00
..

This configuration works well. I (ip 172.21.36.45) can connect thru ftp-gw,
as user alice, to ftp.inria from 08:00 to 12:00.
I ( same ip) cannot connect, thru ftp-gw, as user michael to ftp.zoo.fr from
17:00 to 11:00. Great !

However, to make this works, I had to patch authsrv.c.  Attached is
authsrv.c.diff.
Cp this file in fwtk/auth; then type: patch < authsrv.c.diff ; make authsrv,
...

HTH.
cmic
-------------start of diff -------------8<-----------------------------
--- /usr/tmp2/authsrv.c	Thu Jan 31 13:18:47 2002
+++ authsrv.c	Thu Jan 31 13:22:13 2002
@@ -5,7 +5,15 @@
  * Redistribution and use are governed by the terms detailed in the
  * license document ("LICENSE") included with the toolkit.
  */
-
+/*
+ * Fixed some bugs related to operation with time argument.
+ * NB Example of usage in netperm-table :
+ * ftp-gw:	permit-hosts 172.21.36.45 -extnd -authall -log { retr stor }
+ * authsrv:	permit-operation user alice ftp-gw ftp.inria  time 08:00
12:00
+ * authsrv:	deny-operation user michael ftp-gw ftp.zoo.fr  time 17:00
11:00
+ *
+ *    Michel Marcon CETU (cmic) [email-masked]
+ */
 /*
  *	Author: Marcus J. Ranum, Trusted Information Systems, Inc.
  */
@@ -407,6 +415,9 @@
 minutes(p)
 char *p;
 {
+/* FIXED kludge : supress any char after p[5] */
+	p[5]='\0';
+
 #define D(x) isdigit((unsigned char) x)
 	if (!D(p[0]) || !D(p[1]) || p[2] != ':' ||
 	    !D(p[3]) || !D(p[4]) || p[5] != '\0') {
@@ -419,6 +430,7 @@
 
 /*
  * Return 0 if current time is between upper and lower (inclusive)
+ * Return 1 if invlaid time or current time not between upper and lower.
  */
 static int
 time_ok(upper,lower)
@@ -548,7 +560,8 @@
 	more than 5 argments implies time range is specified.
 	*/
 	if(cfp->argc != top) {
-		if(!time_ok(cfp->argv[cfp->argc - 1], cfp->argv[cfp->argc -
2]))
+/* FIXED  !time_ok ==> time_ok */
+		if(time_ok(cfp->argv[cfp->argc - 1], cfp->argv[cfp->argc -
2]))
 			goto deny_cmd;
 	}
---end of diff-----------------8<------------------------------

> -----Message d'origine-----
> De : Rick Murphy [mailto:[email-masked]]
> Envoyé : jeudi 31 janvier 2002 00:33
> À : fwtk-users
> Objet : [fwtk-users] Re: Usage of authsrv and time
> 
> 
> At 02:22 PM 1/30/02 +0100, [email-masked] wrote:
> >Hello.
> >
> >I want to start and stop ftp-gw service (I use ftp-gw thru 
> authsrv) only on
> >certain hours of the day.
> >I noticed the "time" option of authsrv for that pupose; it 
> mut be used with
> >the -extnd option of ftp-gw. But I am unable to make it work.
> >Anyone has a solution for this kind of problem ??
> 
> I've never tried to make this work, but here's how it's 
> supposed to work.
> 
> You must run ftp-gw with the -extnd option.
> 
> You have authsrv lines in the netperm-table like:
> 
> authsrv:        permit-unknown unauth
> authsrv:        permit-operation ftp-gw user <user> <command> 
> <dest> <tokens>
> authsrv:        permit-operation ftp-gw group <group> 
> <command> <dest> <tokens>
> 
> The first line is required if you don't enable 
> authentication. In that 
> case, the only form of the "operation" line that works is the 
> "user unauth" 
> type.
> 
> For ftp-gw, "<command>" can be RETR, STOR, etc.
> The "<tokens>" field should be something like
>          time 17:00 23:59
> to allow time between 17:00 and 23:59
> 
> If you'll post the way you're trying to configure it - and 
> what errors 
> you're seeing - I can make better suggestions.
>          -Rick
> 
> 
> ---
> You are currently subscribed to fwtk-users as: 
> [email-masked]
> To unsubscribe send a blank email to 
> [email-masked]
> 

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]