Subject: RFC 2228, FTP Security Extensions

From: "Roger A. Hanke" <[email-masked]>
Date: Thu, 4 Dec 1997 09:26:10 -0500

Now that RFC 2228 was published in October 1997 my managers are starting
to ask about it. Dont remember reading any discussion in the mailing
list about it? So what are people thoughts, should WUFTPD be enhanced to
support these FTP security extensions? Has any work already been done
in this area?
	Thanx,
	Roger Hanke

---

From: Kent Landfield <[email-masked]>
Date: Thu, 4 Dec 1997 13:22:11 -0600 (CST)

# Now that RFC 2228 was published in October 1997 my managers are starting
# to ask about it. Dont remember reading any discussion in the mailing
# list about it? So what are people thoughts, should WUFTPD be enhanced to
# support these FTP security extensions? Has any work already been done
# in this area?

Cygnus did an implementation of the GSSAPI mechanism as a part of their
KerbNet product, which you can get free from
http://www.cygnus.com/product/kerbnet-index.html.  This code has also
been integrated into MIT's krb5 tree.  There are several other
implementations, but none are free.  I am currently looking at what it
would take to integrate what was done there with wu-ftpd.

Now the problem...  The FTP Protocol is in the process of changing and
potentially drastically.  Yes it will be backwards compatible with the
current RFC 959 but beyond that...

There is a great deal of work that is ongoing with the IETF FTPEXT working
group.  These efforts include

     * FTP Security Considerations 
     * FTP Extensions for Variable Protocol Specification 
     * Internationalization of the File Transfer Protocol 
     * Feature negotiation mechanism for the File Transfer Protocol 
     * Extended Directory Listing and Restart Mechanism for FTP 

For more information on this see http://w3.hethmon.com/ftpext/ 

[ Stepping up on to the soapbox and grabbing the microphone... ]

I have some serious concerns about the way the community is approaching this
area.  There seems to be multiple camps producing FTP related works that are
not communicating with the others.  Because of that we are seeing the begining
of splintering of FTP capabilities.  Something needs to happen or we may see 
the end of a "Fully" functional FTPD that is available in source form. 

What do I mean ?  If there is not an effort, in much the same light as the
appache or linux folks, to incorporate these new features then the only 
version of FTPD that you will want to run in a production network is one
you have to pay bucks for. The free versions will not have the neat and nifty
features that management sees as a checklist item.  I'm sick of that approach.

Wu-ftpd was developed to better the foundation of the net (NSF grant funded 
development).  Because of that we have all benefited.  What would it be like
for the smaller sites if there wasn't an effort such as Apache and you had to 
buy your web server, your mailers, your ftp client and server software, your
PC operating systems, etc. ?

I propose we need to address this on this list soon or watch the wu-ftpd
become just a footnote in Internet history.

[ Stepping down to see the crowds reaction and take my licks. ]

Thoughts ?

-- 
Kent Landfield                        Phone: 1-817-545-2502             
Email: [email-masked]             http://www.landfield.com/
Email: [email-masked]                   http://www.nfr.net/
Please send comp.sources.misc related mail to [email-masked]
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/