From owner-cvs-etc  Mon Oct 27 10:42:07 1997
Return-Path: <owner-cvs-etc>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id KAA13421
          for cvs-etc-outgoing; Mon, 27 Oct 1997 10:42:07 -0800 (PST)
          (envelope-from owner-cvs-etc)
Received: from gvr.gvr.org (root@gvr.gvr.org [194.151.74.97])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id KAA13334;
          Mon, 27 Oct 1997 10:40:32 -0800 (PST)
          (envelope-from guido@gvr.org)
Received: (from guido@localhost)
	by gvr.gvr.org (8.8.6/8.8.5) id TAA02224;
	Mon, 27 Oct 1997 19:39:50 +0100 (MET)
From: Guido van Rooij <guido@gvr.org>
Message-Id: <199710271839.TAA02224@gvr.gvr.org>
Subject: Re: Fingerd problems (was Re: cvs commit: src/etc master.passwd)
In-Reply-To: <199710271743.KAA00685@rocky.mt.sri.com> from Nate Williams at "Oct 27, 97 10:43:05 am"
To: nate@mt.sri.com (Nate Williams)
Date: Mon, 27 Oct 1997 19:39:50 +0100 (MET)
Cc: tom@uniserve.com, nate@mt.sri.com, ache@FreeBSD.ORG,
        cvs-committers@FreeBSD.ORG, cvs-all@FreeBSD.ORG, cvs-etc@FreeBSD.ORG
X-Mailer: ELM [version 2.4ME+ PL32 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-cvs-etc@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

Nate Williams wrote:
> >   A problem with fingerd is that is does fuzzy lookups by default.  If
> > /etc/master.passwd is large, it will use a significant amount of CPU.
> > Starting up 30-40 fingerds makes an easy and effective DoS attack.
> 
> If this is a problem, disable fingerd.  If that's not feasible, then I
> think your other solution is really the only other solution (limiting
> the # of fingerd's that should run.)

Perhaps implement a switch to fingerd disallowing the fuzzy lookups.
Now that I think of it: It should be part of the -s flag as it gives
an easy way of guessing usernames. (consider taht a *lot* of ppl
in the netherlands have either 'van' or 'de' as a separate word
in their family name).

-Guido