Subject: References

From: Steve <[email-masked]>
Date: Mon, 18 May 1998 11:24:40 -0500 (CDT)

I've got a client looking to set up an externally accessible ftp server on
an RS6000.

I've suggested a 43P (shouldn't be getting hit too hard), with wu-ftpd,
however the client is "uncomfortable" at this point because wu-ftpd is
public domain (non-commercial).

Is there such a beast as a commercial implementation of wu-ftpd? I am also
attempting to build a case for using it anyway. Is there a list of some of
the major sites running wu-ftpd, particularly commercial businesses with
rather stringent security requirements. I'm well aware of the wonderfully
stable qualities of wu-ftpd, and know any problems arising are quickly
resolved, but I'm trying to address some political issues here. Any help
would be greatly appreciated.

Please copy me, and not just mailing list, on any responses as I'm just
now subscribing and not active yet. Thanks.

Steve
[email-masked]

---

From: Ben Mehlman <[email-masked]>
Date: Mon, 18 May 1998 14:22:25 -0400 (EDT)

> public domain (non-commercial).

You can tell him that Prodigy Internet uses wu-ftpd on multiple 43P's and in
1.5 years we haven't had a problem.  

-Ben 

----------------------------------------------------------------------------
Ben Mehlman             "It doesn't matter", I say, and I start to pick up
Prodigy Services Corp   the broken glass shards.  "I knew it would happen."
[email-masked]   "Then why you don't stop it?" asks my mother.
                        And it's such a simple question.  -Amy Tan

---

From: chuck <[email-masked]>
Date: Mon, 18 May 1998 14:31:07 -0400 (EDT)

> would be greatly appreciated.

Ah, the political part of the seven layer stack, above application
and financial :) (see http://www.zeitgeist.com/FunStuff/layers.gif).

You COULD check out ncftpd (hit yahoo or similiar) which IS commercial.

Or you could look at the fact that it's tough to make wu-ftpd
commercial because it's been developed and helped by SO many
people.

For example, the s/key stuff wasn't working right (skey is a one
time password mechanism that prevents clear-text passwords from
being used over the net).

I found the problems and fixed them.  That's now part of the current
release.

Would I/Could I do the same for a "commercial version"?
Er, no, I couldn't.  That is, in fact, why I used the wustl
version.  Sun wasn't going to do it with lots of $$$$ and the
didn't have the access control we needed anyway.

Big companies?  Where I am I think of Wall St.  I might mention
JPMorgan, Morgan Stanley (ms.com) or other Wall St firms using
it, but you could just ftp there and see for yourself.
UU.NET might be using it (billions of users/week) as might PSI,
ANS, the Well, Interport.net  and a billion ISP's who RELY on it
for their business.
BSDi definitely does (though 4.0 will use the 4.4 server).
Ripe.net does (you know, the IP address folks?).
Linux uses it, so that's 5-10 million right there (including
ftp-eng.cisco.com)
Veritas.Com, Adobe and the Quicken site (ftp.quicken.com).
The Big 3 car folks?  They don't have ftp server (but they're
trying to weld them together now).

Need I continue?

But yeah, it's probably not as good as the OS's server.  You don't
want upload control, strong access controls, responses to bugs
(if I core dump your OS's server (likely in the ~ftp directory),
I likely get the password file in the core, readable by me.
oops).  I haven't found vendors quick to fix this, er, little
problems.

chuck

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 18 May 1998 14:54:04 -0400 (EDT)

Not to mention a recent CERT advisory recommending use of wu-ftpd beta 16
for system security issues.  Or that CERT's ftp site itself uses it:

Connected to ps2.cert.org.
220 ps2.cert.org FTP server (Version wu-2.4.2-academ[BETA-16](1) Wed Mar
25 08:47:01 EST 1998) ready.

On Mon, 18 May 1998, chuck wrote:

> Date: Mon, 18 May 1998 14:31:07 -0400 (EDT)
> From: chuck <[email-masked]>
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: References
> 

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Dan Kegel <[email-masked]>
Date: Mon, 18 May 1998 20:09:15 -0700

At 11:24 AM 5/18/98 -0500, Steve wrote:
>rather stringent security requirements.

I personally consider wu-ftp to have too many features to
be considered secure by construction.  (What's that
crazy site exec command for, anyway?)

If you can live with fewer features, you might find 
other ftpd's to be more secure.  A few I've looked
at briefly are Proftpd (http://www.proftpd.org),
ncftpd (http://www.probe.net/~mgleason/ncftpd/),
and Troll ftpd (http://www.troll.no/freebies/ftpd.html).
None of these meet my particular needs, so I'm still looking;
I'll add links to any more I find at my summary page,
http://www.alumni.caltech.edu/~dank/fixing-overloaded-web-server.html

- Dan

---

From: chuck <[email-masked]>
Date: Tue, 19 May 1998 17:37:07 -0400 (EDT)

We could also toss in Venema's ftpd from the logdaemon
package (with a VERY useful login replacement that supports
SKey or Challenge response devices).

It too goes on the minimal is best mode.

Realistically, if it's a paranoid site, I chroot wufp in
inetd.conf (via a wrapper) and have the data on a r/w partition
and the rest on a R/O partition.  FTP's home is "/" (after
chroot) and the password file is about as valid as any anon-ftp
password file (you can get it, but will what's the message after
you crack those passwords and do I care?)