Subject: some way to encrypt passwords

From: "Roger A. Hanke" <[email-masked]>
Date: Tue, 6 Aug 1996 09:51:43 -0400

Dear List,
 Have customers requesting that we somehow encrypt their FTP passwords
so that they can not be sniffed off of the network if someone gained physical
access.
 Since we are currently using SSL with our HTTP servers the first suggestion
was to use FTP over SSL as well. Does anyone know of any work with the
WUFTPD to allow it to run on top of a SSL session? Or has there been any
other work in this area for other approaches to protecting the real or guest
account passwords from going in the clear across the network?

 Any info would be appreciated. Thanx,
	Roger Hanke

-------------------------------------------------------------------
 Roger A. Hanke         AT&T Easy World Wide Web Service
 (908)949-4091          [email-masked] or
 FAX (908)949-7171              [email-masked]
 HO 6C-111              http://lynxhub.ho.att.com/~rah/	
-------------------------------------------------------------------

---

From: Michael Brennen <[email-masked]>
Date: Tue, 6 Aug 1996 10:54:12 -0500 (CDT)

> so that they can not be sniffed off of the network if someone gained physical

S/Key with the beta load below is about the best way around this that I
know of right now.  The S/Key mods are in the source, and the docs tell
you how to turn it on.  I've used it; it works.

   -- Michael

This is the location for the latest wu-ftpd.  You can't see the
directory contents, but get the file anyway.  It's there.

ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-11.tar.Z

WU-FTPD FAQ:  http://www.hvu.nl/~koos/wu-ftpd-faq.html

guest howto:  ftp://ftp.fni.com/pub/wu-ftpd/guest-howto

There are additional security references in the above docs.

---

From: <[email-masked]>
Date: Sun, 11 Aug 1996 13:25:01 -0700 (PDT)

You could always install sshd and have them use 'scp'

---

From: Mike Batchelor <[email-masked]>
Date: Mon, 12 Aug 1996 08:41:44 -0400 (EDT)

> > account passwords from going in the clear across the network?

Use the S/Key support in the academ beta 11 version.  You can get the S/Key
libraries from ftp.win.tue.nl in /pub/security in the package
logdaemon-5.0.tar.gz.  Not only will you get the S/Key libs, but you also
get S/Key support for Telnet, rlogin, rsh, su and so on.

I recommend using the OPIE key calculators for Mac and Windows, available
from ftp.nrl.navy.mil /pub/security/opie/contrib.  You can also just use the
whole OPIE 2.22 package instead of logdaemon 5.0 on your servers.  The
latest version of Fetch 3.0.1 support S/Key for ftp, using an external
calculator.  For Windows, use Winsock FTP, which shows server responses in
the small window at the bottom of the program (so you can see the S/Key
challenge).

---
  + + +      %%%%% Mike Batchelor % [email-masked] %%%%% A Division
 Capitol.Net %%%%%%%%%%% 301-306-9090 % V.34/ISDN %%%%%%%%%%%    of
     + + +   %% Serving Washington DC, No.VA, and Maryland %%   Criticom, Inc.