|
|
campus - FTP-server for
BeOS®
Access configuration
Beginning with release 3.0 campus has the ability to deny access to
other hosts based on the ip address and/or the hostname. To do this a new
configuration option is introduced, the ip keyword.
Format: IP Connect Deny|Allow Hostmask|IPMask
Important notes:
- By default all accesses are allowed.
- If hostname resolving is disabled only IP-masks can be used to control
accesses!
- The Connect keyword must always be present although currently
it does not seem to be necessary. This is because in future releases of
campus there will be more options in the IP configuration.
The configuration of IP restriction is similar to that of the file
access. The lines either deny or allow access for the given argument
(see below for an explanation of possible masks) and are applied from
top to bottom whenever a user connects to the system.
Examples
The easiest way to explain possible host- and IP-masks are examples:
- IP Connect Deny *
This lines denies access for all machines, even the machine on
which campus is running.
- IP Connect Allow 127.0.0.1
This lines allows access for the local machine. The IP address
of the connecting machine has to match the given address exactly.
- IP Connect Allow *.be.com
Here all machines that are in the domain be.com are allowed to connect.
Remeber that for this to work you have to enable the resolving of hostnames!
- IP Connect Allow Binary 10.255.255.255
In this case the IP mask is used as a 32 bit value and a logical AND
is performed with the two complement of the mask and the address of
the remote host. The IP address of the remote host matches the mask
if the result is equal to the mask.
The use of a binary mask to control IP access is an advanced feature
that should only be used if you really know what you are doing and
are familiar with IP network addresses.
- IP Connect Allow 10.*
This line does the same as the line above but does not use a binary
masl but a textual match for the IP address.
To get a bit more practical here is an example of a configuration, in the
following situation:
- The machine is connected to a local network with IP addresses 192.168.1.x
- The machine is connected to the inmternet on an arbitrary address
- Connections from the local network are allowed, from the internet only
certain machines will be allowed to access the server.
The IP access part of the configuration will look like this:
IP Connect Deny *
IP Connect Allow 192.168.1.*
or
IP Connect Allow Binary 192.168.1.255
IP Connect Allow *.be.com
Normally you won't need to have a lot of lines in the access configuration
if you don't plan to allow or deny access to your machine on a per-address
basis. But keep in mind that due to the automatic reload of the configuration
you have the possibility to deny access for a specific machine on the fly
if you for example spot a denial-of-service attack from it.
Copyright © 1997-2000 Stegemann & Co., Inc., All Rights reserved.
Created: May 7, 2000. Last modified: April 25, 2000.
|