Subject: Re: How to find corrupted transfer?

From: [email-masked] (Andy Church)
Date: Tue, 21 Apr 1998 09:16:57 EDT

>1) I interupted the transfer on the client side, but couldn't find any
>error messages neither in xferlog nor in syslog on the server computer. 
>I wasn't able to find, that the transfer was aborted.

     The server can't tell the difference between an aborted upload and a
finished upload; both are signified by the client closing the data
connection.

>2) I tried to physicaly disconnect the client computer from the net (by
>pulling out the ethernet cable) during file transfer (I wanted to
>simmulate possible problem) and find that ftpd is running for 3 hours by
>now without any error message (netstat says, that the connection is
>established). I thought it should timeout after 900 sec.
>
>I use wu-ftpd 2.4.2b14 on linux 2.0.33.

     Upgrade to 2.4.2b16, which will fix this problem (among others).

>I need to know, whether the transfer was OK, because I will need to have
>anonymous ftp server, where many people will have to upload their files.

     The only way to be certain is to compute checksums of the file on the
original system and the server.  In other words, if you only have access to
the server, there's no way to be certain the files were uploaded correctly.

  --Andy Church                  | If Bell Atlantic really is the heart
    [email-masked]       | of communication, then it desperately
    www.dragonfire.net/~achurch/ | needs a quadruple bypass.

---

From: Gregory A Lundberg <[email-masked]>
Date: Tue, 21 Apr 1998 13:55:49 -0400 (EDT)

> the server, there's no way to be certain the files were uploaded correctly.

Taking this a step further, require the user to upload an MD5 hash or a
PGP signature then run a cron which deletes files some (long) time later
which either don't have signatures or for which the signatures don't match
the actual file.  If you were to require PGP, you could also then check
the signature to make sure it's one you trust and either delete the file
or email youself about the lack of trust.

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              email: [email-masked] [205.133.13.8]
Kettering, OH 45409-1615 USA    voice: +1 (937) 299-7653

---

From: Martin Vysohlid <[email-masked]>
Date: Wed, 22 Apr 1998 08:58:41 +0200 (MET DST)

> the actual file.  If you were to require PGP, you could also then check

I'm afraid, that I can't require neither MD5 nor PGP. The users, that will
upload files (or directories) will be ordinary users with differnt
operating systems.

I think that the best way to do this anonymous upload for me would be to
hack the ftpd and make it behave like this:

For every IP of connecting computer, the server would make special
directory whith read/write access only for this IP. The users would have
chance to check the files themselves and correct the problems.  When the
files/dirrectories aren't changed for a long time it could be moved from
the ftp area.

I think this would be quite good solution. The only problem could arise,
when more people share the same IP. The resolusion would have to be done
by that anonymous password (e-mail address).

I'm afraid, that I don't have neither time nor knowledge (to make it
quickly) for hacking ftpd, but I'm interester about your opinion about
this solution.

Martin