Subject: Ftp-WG: status of rfc 2228

From: [email-masked]
Date: Mon, 3 Nov 2003 22:44:04 -0500

hello all,

i'm new to the list.

very recently, i've taken an interest in the status of rfc 2228 as i wish to implement some means of user authentication, integrity protection, and optional data encryptiong to an existing ftpd implementation.

i was wondering if anyone knew which ftp implementations currently support the proposed security extensions.

and finally, are there any thoughts on combining the control connection and data connection?  in my eyes, this would eliminate the bounce attack and make ftp less of a problem for nat'd connections and firewalls.

thanks for any feedback

abe

---

From: Robert Elz <[email-masked]>
Date: Tue, 4 Nov 2003 06:41:28 -0500

Date:        Mon, 3 Nov 2003 22:44:04 -0500
    From:        [email-masked]
    Message-ID:  <[email-masked]>

  | i was wondering if anyone knew which ftp implementations currently
  | support the proposed security extensions.

Sorry, no reply from me on that part, perhaps someone else might
know of some.

  | and finally, are there any thoughts on combining the control connection
  | and data connection?

No, no thoughts, and no chance.   That would require revising FTP
until it was close enough identical to HTTP.   We already have HTTP,
we don't need a variation of it running on a different port and called
FTP.   If the dual connection part of FTP means that problems are caused
that limit where FTP is permitted, then perhaps FTP will eventually die
out.   That certainly has not happened yet.

kre

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 4 Nov 2003 08:39:27 -0500

>i was wondering if anyone knew which ftp implementations currently support the proposed security extensions.
There are many implementations supporting

  GSSAPI-Kerberos 5
  Kerberos 4
  Secure Remote Password
  Transport Layer Security v1

Kermit <http://www.kermit-project.org/> is a FTP client which supports 
all of the above.
We have a partial list of servers at 
<http://www.kermit-project.org/ftpd.html>

>and finally, are there any thoughts on combining the control connection and data connection?  in my eyes, this would eliminate the bounce attack and make ftp less of a problem for nat'd connections…
If you want a secure file transfer solution which requires only a single 
channel, then
you want RFC 2839, Internet Kermit Service.  
<ftp://ftp.isi.edu/in-notes/rfc2839.txt>
and <http://www.kermit-project.org/iksd.html>