Subject: Re: [netatalk-admins] security question

From: [email-masked] (William P. McGonigle)
Date: 17 Nov 98 16:16:31 EST

Is there a clever way to keep guests IP restricted and let authenticated users
in from the 'net?

-Bill

---

From: Michael M Han <[email-masked]>
Date: Tue, 17 Nov 1998 22:32:08 -0800

Previously...
>Is there a clever way to keep guests IP restricted and let authenticated users

Sure. Use afpd.conf to startup separate servers... Say one, listening
on ddp and a custom tcp/ip port, accessible to all the world, but not
allowing guests. And a second tcp/ip-only, restricted to local nets on
the default port 548 (configured via wrappers), allowing *only*
guest... something like this I imagine:

"Users" -ddp -tcp -rand2num -port 5480 -noguest -noclear blah blah blah
"Guest" -noddp -tcp -guest -noclear -norand2num blah blah blah

Hrmm, actually, looking more carefully at the hosts_access(5) man
page, this might be tricky... but I think that you can specify a
daemon pattern like:

[email-masked]:5480

maybe escaping the colon? Otherwise you could always multihome the box
and bind each tcp listener to a different IP, so you don't need to
specify the port number...
_________
mike ([email-masked])
Indian burns are not our cultural heritage
 - The collected wisdom of Bart Simpson

---

From: Jonathan Benson <[email-masked]>
Date: Wed, 18 Nov 1998 17:11:44 +1100

>From what I know you could:
Set up multiple servers (perhaps need to use IP aliasing?)
Set one of them to only allow access from the internal network and allow guest
access
Set the other to allow authenticated but no guests from anywhere

Not even sure if you'd need TCP wrappers for that but you might to block access to
the guest server.

I'm sure someone out there will have done this, so time for them to speak up...

Jonathan

--
Jonathan Benson B.Eng. (Soft Sys Hon) <[email-masked]>
Systems Administrator, Phoenix Magazines, Phone: +61 3 9696 7200
http://www.phoenixmags.com.au

---

From: [email-masked]
Date: Thu, 19 Nov 1998 10:48:31 +1300

> I'm sure someone out there will have done this, so time for them to speak up...

I've run afpd -d from inetd with tcp_wrappers; crude, but effective.

-- 
Rodger Donaldson			[email-masked]
Systems Support				Direct line	: 04 474 0560
Wellington Newspapers Limited		Fax		: 04 474 0309
You are in a maze of twisty little companies, all working against each other.