Subject: Ftp-WG: FTP over SSL

From: Jeffrey Altman <[email-masked]>
Date: Fri, 24 Aug 2001 10:57:22 -0500

> Frankly, since you say it's widely deployed, I'm scared.  To me that means
> that there are a lot of differing and probably incompatible implementations
> out there.  That's mainly an emotional reaction: I've not seen ANY RFC 2228
> implementations other than the Murray-draft contribution to WU-FTPD and ONE
> other implementation (which, IIRC, was WS_FTP).  But it's not totally
> emotional: one of the positions I'm looking at is for a VERY security
> conscious organization and, if there were a working RFC 2228 implementation
> out there, I am absolutely POSITIVE they would be using it.  The fact they
> are not tells me either there are none, or their research showed that what
> was there had some reason for not using it (either there was nothing, or
> there were servers but no clients, or clients but no servers, or the (my
> guess) clients for some servers could not inter-operate with servers for
> other clients).

RFC 2228 has been implemented in the FTP client and servers shipped
with MIT Kerberos (AUTH KRB4, AUTH GSSAPI); Heimdal Kerberos (AUTH
KRB4, AUTH GSSAPI); and the Secure Remote Password (AUTH SRP) kit.
These implementations have been available since at least the mid 90s.

Microsoft has an implementation of RFC 2228 for authenticating their 
FTP client and server with NTLM.

> Frankly, the ONLY reason I sponsored including the contribution of
> Murray-draft implementation into WU-FTPD was because it needs a second,
> independent implementation to proceed to RFC status.

The TLS draft has been implemented in several clients and servers by
Peter Runestig.  His work is available at

  ftp://ftp.runestig.com/

Alun Jones has implemented it in the server for WFTPD.

I've implemented in the Kermit client which also supports RFC 2228 for
KRB4, GSSAPI-KRB5 and Secure Remote Password.

Cute-FTP has it implemented in that client as well.  

IBM has implemented AUTH TLS in some of their server products.

I think we have plenty of implementations.

 Jeffrey Altman * Sr.Software Designer      C-Kermit 8.0 Beta available
 The Kermit Project @ Columbia University   includes Secure Telnet and FTP
 http://www.kermit-project.org/             using Kerberos, SRP, and 
 [email-masked]          OpenSSL.  SSH soon to follow.