Mailing-List: contact cygwin-help AT sourceware DOT cygnus DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT sources DOT redhat DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT sources DOT redhat DOT com>
List-Help: <mailto:cygwin-help AT sources DOT redhat DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT sources DOT redhat DOT com
Delivered-To: mailing list cygwin AT sources DOT redhat DOT com
Message-ID: <001101c0a4f7$827bc240$0100000a@cs.cuc.edu>
From: "Derek Pomery" <dpomery AT cuc DOT edu>
To: <cygwin AT cygwin DOT com>
Subject: Security hole? Request to list for help re: inet.exe on win2k/win98.  Tried various FAQs all past week.
Date: Sun, 4 Mar 2001 14:07:31 -0800
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2314.1300
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300

No one seems to be on #CygWin on openprojects irc, btw.   Is there another
server I should be trying?
Anyway.  Sorry for adding yet another help request to a swamped list, but
I've been searching all over the web, the archives, and irc for any similar
experiences, without success.

Problem seems to be authenticating.
A basic inetd.conf, copied from this list's archives:
ftp          stream tcp nowait nemo /usr/sbin/in.ftpd.exe in.ftpd.exe
telnet       stream tcp nowait nemo /usr/sbin/in.telnetd.exe in.telnetd.exe

Identical save for s/root/nemo/ since I only have one account on the win98
machine, named nemo.  (although, strangely, for reasons my ignorance of
inetd's workings cannot fathom,
I get identical results whether it is "root" or "nemo")
For now, didn't do daemon setup, just ./inetd -d in /usr/sbin
Result, telneting in to my machine  worked from any location I tried.
Trouble is, no authentication occurred.
Output:
$ telnet localhost
Trying 127.0.0.1...
Connected to nautilus.xxxxxx.xxxxxx.xxxxxx.
Escape character is '^]'.
$ exiConnection closed by foreign host.

This is the result using ftp:
$ ftp localhost
Connected to nautilus.xxxxxx.xxxxxx.xxxxxx.
220 nautilus FTP server (GNU inetutils 1.3.2) ready.
Name (localhost:nemo):
530 User nemo access denied.
ftp: Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> quit
221 Goodbye.


Here is my /etc/passwd at the moment:
nemo::500:544::/home/nemo:/bin/bash

So, any thoughts?  I'll post the problems with win2k tomorrow. :)
Sorry for excess paranoia in xxx'ing out domain, but am arguably concerned
about giving out any information when my computer seems to allow anyone to
wander in without authentication.



--
Want to unsubscribe from this list?
Check out: http://cygwin.com/ml/#unsubscribe-simple