Subject: Ftp-WG: FTPS using a Web browser

From: "Paul V Ford-Hutchinson" <[email-masked]>
Date: Tue, 16 Oct 2001 10:22:57 -0500

Alun Jones wrote:
==================

I've yet to see a web browser that supports FTP over TLS - and the name
"FTPS" hasn't yet been applied to any particular FTP security
implementation.  Granted, if anything is going to be called "FTPS", then 
it
should be the "FTP over TLS" specification currently in internet-draft
form.  However, it is also worth noting that a specification for "ftps"
URIs should be drafted by the appropriate bodies, and described adequately
for future implementors - for instance, in "ftps", should the data 
transfer
as well as the initial command connection be encrypted?  [Almost 
certainly,
yes]  Calling it "ftps" and leaving it up to others to implement is liable
to cause the problem that browser implementors, already woefully 
inadequate
in their FTP implementations, may choose to implement the deprecated
"implicit SSL connection" syntax, rather than using the more appropriate
"AUTH" commands.

===================

As ever - the reality is always more complicated than it needs to be. 
"ftps" is a recognised "well-known port" (990).  It was registered by 
Chris Allen (then of Consensus and a co-author of RFC2246), back in the 
days (1997) when everyone was SSL-ifying protocols that way.

The history of the ftp-over-tls draft included a definition of what an 
ftps protocol might actually mean.  It was defined in draft-00 thru 
draft-06 and defined as deprecated  in draft-07.  It is entirely missing 
from draft-08 (which just sneaked out last week).

ftps as a url scheme (RFC1738) is not defined anywhere, nor have I ever 
seen it. 

The TLS upgrade  mechanism in http (RFC2817) says that the url scheme for 
such sessions will be http:.  But I don't see a huge rush to deploy 
RFC2817.  This document also contains a statement that it is the IETF 
direction not to ssl-ify protocols on connection - made at the Washington 
IETF apparently.

There are other sftp and ftps claimants (SSH and SRA spring to mind; and 
simple ftp (port 115) - whatever that is). 

I am hoping that FTP-over-TLS is getting sufficiently well supported now, 
that it should be the way that any new implementation (esp. one that has 
access to an SSL stack) should choose to secure FTP. 

Now, about that secure ftp and firewall interoperability draft I'm writing 
...... 

Paul

--
Paul Ford-Hutchinson :  eCommerce application security : 
[email-masked]
MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926 
462005
http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html

Alun Jones <[email-masked]>
Sent by: ftp-wg-owner <[email-masked]>
16/10/2001 03:45 PM
Please respond to FTPEXT Working Group

        To:     FTPEXT Working Group <[email-masked]>
        cc: 
        Subject:        Ftp-WG: FTPS using a Web browser

At 08:34 AM 10/16/2001, you wrote:
>Internet Explorer as Nestcape Navigator are able to list, send and 
receive
>files using the FTP  protocol.
>Although, these internet browsers support TLS for HTTP connections, they
>don't seem to support FTPS.
>
>Does anybody know if a Web Browser supporting FTPS exist or is in
>development ?

I've yet to see a web browser that supports FTP over TLS - and the name
"FTPS" hasn't yet been applied to any particular FTP security
implementation.  Granted, if anything is going to be called "FTPS", then 
it
should be the "FTP over TLS" specification currently in internet-draft
form.  However, it is also worth noting that a specification for "ftps"
URIs should be drafted by the appropriate bodies, and described adequately
for future implementors - for instance, in "ftps", should the data 
transfer
as well as the initial command connection be encrypted?  [Almost 
certainly,
yes]  Calling it "ftps" and leaving it up to others to implement is liable
to cause the problem that browser implementors, already woefully 
inadequate
in their FTP implementations, may choose to implement the deprecated
"implicit SSL connection" syntax, rather than using the more appropriate
"AUTH" commands.

Alun.
~~~~

--
Texas Imperial Software   | Try WFTPD, the Windows FTP Server. Find us at
1602 Harvest Moon Place   | http://www.wftpd.com or email [email-masked]
Cedar Park TX 78613-1419  | VISA/MC accepted.  NT-based sites, be sure to
Fax/Voice +1(512)258-9858 | read details of WFTPD Pro for NT.