Subject: Secure FTP solutions

From: Forrest Aldrich <[email-masked]>
Date: Mon, 23 Sep 1996 14:07:56 -0400 (EDT)

While we await SSL-wu-ftpd, I'm curious if anyone out there is aware
of any _commercial_ solutions for secure FTP (client and server ... multi-
platform).

Thanks,

Forrest

---

From: [email-masked] (Bill Campbell)
Date: Mon, 23 Sep 1996 11:49:11 -0700 (PDT)

>of any _commercial_ solutions for secure FTP (client and server ... multi-
Do we really need secure ftp when tools like ssh (Secure Shell) are
available?  The encryption options of ssh are probably better than
that available with SSL, scp allows automatic gzip compression of the
data stream, and it's as easy to use as the cp command.

Bill
--
INTERNET:   [email-masked]  Bill Campbell; Celestial Systems, Inc.
UUCP:               camco!bill  PO Box 820; 2835 82nd Avenue S.E. S-100
FAX:            (206) 232-9186  Mercer Island, WA 98040-0820; (206) 236-1676
URL: http://www.celestial.com/

Government spending?  I don't know what it's all about.  I don't know
any more about this thing than an economist does, and, God knows, he
doesn't know much.
		-- Will Rogers

---

From: Michael Brennen <[email-masked]>
Date: Mon, 23 Sep 1996 14:39:44 -0500 (CDT)

On Mon, 23 Sep 1996, Bill Campbell wrote:

... somebody else wrote ...
> data stream, and it's as easy to use as the cp command.

Yes.  I don't allow shell access of *any* kind to my servers.  I use ssh
for remote admin maintainence, but I don't allow client access at all via
ssh, only guest ftp. 

   -- Michael

---

From: "Peter C. Norton" <[email-masked]>
Date: Mon, 23 Sep 1996 16:15:32 -0400 (EDT)

> for remote admin maintainence, but I don't allow client access at all via

Depending on the resources at your client's end, you could establish an ssh
connetion to proxy ftp between you and your client.  That should provide you
with a pretty high degree of security.  Of course, if they're using a mac,
aren't willing to upgrade their systems, or aren't concerned about security,
then they're not going to do it.

-- 
- Hofstadter's Law:  It always takes longer then you expect, - 
- even when you take into account Hofstadter's Law -

[email-masked] 
http://www.sensenet.com
Systems Administrator, Sensenet, Inc.

---

From: [email-masked] (Bill Campbell)
Date: Mon, 23 Sep 1996 13:21:05 -0700 (PDT)

>for remote admin maintainence, but I don't allow client access at all via
It would be reasonably easy to allow scp without allowing ssh or
slogin (the most difficult part is probably getting the public keys of
the remote systems on the server).

Bill

---

From: Chin Fang <[email-masked]>
Date: Mon, 23 Sep 1996 18:27:32 -0700 (PDT)

Just client guest ftp login won't do you any good.  In fact, if sendmail
is not configured correctly (e.g. smrsh is not used, or worse, procmail
is employed) a smart user can gain as much done as with a shell access,
of course, with more effort.

Or, really even worse, if you have something like Microsoft FrontPage installed
since in its current form, most likely the server needs to run with the UID
of root, all hell break loose.  However, many ISPs, large or small, even 
they do use guest FTP login for *security*, they support FrontPage and user
CGI, which defeats the entire purpose of security completely.

Among the web hosting business, such joke sites are plenty.  Many of them
are set up with such a lame security that their entire site can be wiped
out in minutes.

Interestingly, CERT has never said anything about Microsoft FrontPage
being a security threat.  It spends most effort/time on obscure stuff
that only experts can *take advantage* of (really experts never care
about cracking systems, so this is a moot point :(

It's an unhealthy trend, but hey,... that's business.

Chin Fang
[email-masked]
==============================================================================

---

From: Forrest Aldrich <[email-masked]>
Date: Mon, 23 Sep 1996 17:08:35 -0400 (EDT)

| Do we really need secure ftp when tools like ssh (Secure Shell) are
| available?  The encryption options of ssh are probably better than
| that available with SSL, scp allows automatic gzip compression of the
| data stream, and it's as easy to use as the cp command.
[ ... ]

	Bill,  I mentioned above "Commerical" solutions.  The application
	that I'm seeking to resolve does not leave room for
	utilizing packages on the net like ssh at this time.

	Forrest