Commits (10)
-
Rob Swindell authored
The Synchronet FTP server has (since 2001) disallowed PORT/EPRT/LPRT commands with a "reserved" port number (i.e. < 1024) as recommended by RFC2577 and when attempted, would log a "SUSPECTED FTP BOUNCE HACK ATTEMPT" in the data/hack.log file. However, as Karloch (HISPAMSX) pointed out recently, an FTP Bounce Attack to other TCP ports was still possible (and detected/reported by some security scans as a potential vulnerability). So, reject all PORT/EPRT/LPRT commands that specify an IP address other than that used for the control TCP connection unless the sysop specifically enables the new "ALLOW_BOUNCE" option flag (in the [ftp] section of sbbs.ini) and the user is an authenticated non-guest/anonymous user. And as before, log the attempt as a suspected hack attempt. This change also removes the "Directory File Access" checkbox from the Synchronet Control Panel for Windows as that feature is "going away" soon (or at least, it won't be an FTP-specific option/feature if it remains).
5277b057 -
Rob Swindell authored343801e3
-
Rob Swindell authored
... instead of the JSON parse exception as reported via IRC: <matjam> !finger ?bbs:Stupendous BBS@vert.synchro.net result: SyntaxError: JSON.parse
b78c82b4 -
Michael Long authored010b93a7
-
Rob Swindell authored
3rd party external doors - exitilus, jibben, jns See merge request !110
da91f797 -
Deucе authored8311170c
-
Rob Swindell authoredc754ec5b
-
Rob Swindell authored104e9d91
-
Rob Swindell authored2b526b76
Showing
src/sbbs3/sbbs.zip
deleted
100644 → 0
File deleted
xtrn/3rdp-install/jibben.js
0 → 100644