--------------------------------------------------------------------------
mod_wrap: a proftpd modules links with and uses the TCP wrappers library of
	Wietse Venema (ftp://ftp.porcupine.org/pub/security/tcp_wrappers_7.6.tar.gz)

If proftpd is running in inetd mode, one might wonder what the point of this
module is, as inetd will already (on most systems, anyway) be configured to
call/use tcpd and the TCP wrappers library.  There are two main reasons that
prompted the development of this module: 1) the ability to use the same
host-based access control when proftpd is run in standalone mode, using
the same system files as inetd would use (hence a shallower learning curve
for those who don't want to learn proftpd's Allow and Deny directives), and
2) the ability to specify different files for different anonymous* and
virtual servers, hence having different access rules for each server.

*NOTE: the operation for allowing/denying anonymous logins, via mod_wrap,
is a little different that logins using system usernames.

The syntax for the added configuration directives is as follows:

	UseHostsAllowFile <full-path-to-allow-file>
	UseHostsDenyFile <full-path-to-allow-file>

where the full path to the file is optional -- if the directive is used, and
no argument given, the module will assume the use of the standard location
for the allow/deny files, that is, /etc/hosts.allow and /etc/hosts.deny.
The daemon name that mod_wrap will look for in these files is "proftpd".

  HostsAllowSyslogLevel syslog-level
  HostsDenySyslogLevel  syslog-level

where syslog-level is the same range of arguments as accepted by the
SyslogLevel directive -- read its description for more details.

Configuration contexts:

The UseHostsAllowFile and UseHostsDenyFile configuration directives are
allowed in the following configuration contexts:
"server", <Anonymous>, and <VirtualHost>

The HostsAllowSyslogLevel and HostsDenySyslogLevel configuration directives
are allowd in the following configuration contexts:
"server", <Anonymous>, and <VirtualHost>

Further reading for the use of the TCP wrapper files can be found
by reading hosts_access(3) and hosts_access(5) (a MUST).

Notes:

Appropriate HTML configuration entries for this module's directives should
accompany this file, in "Configuration.html"

The ability to set per-user access controls allows for users of a shared
login/account to restrict access to that account, or (in a more paranoid
strain) if a user suspects someone on the 'net has his login information and
wants to be sure their files can only be reached from certain hosts.
 
mod_wrap does not honor AnonymousGroup.  That is, if the user logging in
is a member of an AnonymousGroup, the HostsAllowFile and HostsDenyFile, if
used, will be that of the container server context, not <Anonymous> (the
AnonymousGroup directive isn't allowed in that context, anyway).  The
reasoning behind this had to do with the process, at authentication-time, of
determine anonymous versus non-anonymous connection requests, and the order
in which these determination steps occur.  I just decided it wasn't worth it,
and don't think it should be a supported feature (unless anyone can provide
me a practical case where such functionality would be useful).

--------------------------------------------------------------------------
Copyright 2000 TJ Saunders
TJ Saunders <tj@digisle.net>
August 12, 2000
--------------------------------------------------------------------------
