Subject: Re: BUG??? WU!

From: Dave Jevans <[email-masked]>
Date: Thu, 27 Nov 1997 08:46:55 -0800 (PST)

With regard to the tar --rsh-command  feature of GNU tar,
and possible security problems....

When we designed our secure ftpd, we spent many months designing
a more secure and flexible extensibility engine than that provided
in wu-ftpd.  Basically, our ActiveAgents replaces the wu-ftpd
conversion capability with a separate server that can run the
extended programs such as tar, gzip and others that are user
defined.   The ActiveAgents server can run in its own "sandboxed"
environment, even on another machine, so you can effectively 
isolate programs and avoid potential --rsh-command security holes.

Also, because these commands are run by a server that is separate
from the ftpd, even anonymous users can use it without the tar
command being accessible in their chrooted environment.

My $0.02.   :-)    Happy Thanksgiving!

David Jevans, President
Differential Inc.  -  Software For Extranet Business Communities
[email-masked]
(408) 864-0603
www.differential.com       

  * Try FileDrive EX: Commerce-grade FTP Server And Client Software *