Subject: Re: Virtual IP

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 18 Jan 1999 06:58:35 -0500 (EST)

[Response to off-list message] On Sun, 17 Jan 1999, zhao shuo wrote:

> Could you tell me some method that Virtual FTP server for many domain
> names to be allocated to a single IP address.

The FTP protocol doesn't allow that, yet, which is the reason the HOST
command is proposed for the updated protocol.  For now, you must use a
different IP address for each FTP site hostname.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Aaron Holtz <[email-masked]>
Date: Mon, 18 Jan 1999 07:48:39 -0500 (EST)

I'm not totally sure this is the case.  I believe on a server I used to
maintain I was using the newvirt code and in the ftpservers file I was
using the full name of the FTP server instead of the IP.  When I did this,
it looked at all of the proper files and ran the proper FTP site.  I know
I ran many sites on that server with only about 5 IP's, so many of them
were being shared and I needed to get around that.  I don't have access to
the machine anymore, but I'm pretty sure I ran across this.  I could be
wrong, but compiling the newvirt code and trying it out would probably be
easier than rewriting the daemon if your need is immediate.

--------------------------------------------------------------------------
Aaron Holtz
ComNet Inc.
Manager, Unix Systems Administration
Email:  [email-masked]
"I'd give my right arm to be ambidextrous."
--------------------------------------------------------------------------

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 18 Jan 1999 09:25:37 -0500 (EST)

On Mon, 18 Jan 1999, Aaron Holtz wrote:

> I'm not totally sure this is the case.  I believe on a server I used
> to maintain I was using the newvirt code and in the ftpservers file I
> was using the full name of the FTP server instead of the IP.  When I
> did this, it looked at all of the proper files and ran the proper FTP
> site.  I know I ran many sites on that server with only about 5 IP's,
> so many of them were being shared and I needed to get around that.  I
> don't have access to the machine anymore, but I'm pretty sure I ran
> across this.  I could be wrong, but compiling the newvirt code and
> trying it out would probably be easier than rewriting the daemon if
> your need is immediate.

I reiterate: the FTP protocol .. that is *ALL* servers and clients, not
just WU-FTPD and derivatives .. *MUST* use a separate IP number for each,
different virtual host.

The base Academ 2.4.2 (beta 18) version uses one method of supporting
multiple IP addressed virtual hosts.  The VR series enhances that method
to some extent.  This is the method I use on my mainline FPT servers.

Kent Landfield's NEWVIRT replaces the multiple IP addressed virtual host
scheme with a different one.  Many people (myself included) believe
NEWVIRT is superior.  BeroFTPD incorporates the NEWVIRT scheme.  This is
the method I recommend unless you have trivial virtual hosting needs.

A widely used third scheme is to use inetd or xinetd and chroot prior to
starting the daemon.  This scheme works with all servers, is strongly
secure, but is a RPITA to set up and get working.  I use this method on my
development and experimental servers since it allows me to have differing
schemes or different versions of the daemon on the same physical machine.

To support multiple hostnames on a single IP address, some scheme is
needed to instruct the server which virtual hosts's area is desired.  As
things currently stand, there is no way for the client to identify to the
server which virtual FTP hostname was used to look up the IP number.
Two methods have been proposed to address this: using CWD after user
authentication, or using HOST prior to authentication.

The CWD scheme has the advantage that it it only changes the client side
specification.  Basically, the idea was to map an FTP URL such as
ftp://site1/dir/file to something akin to ftp://[ip]/site1/dir/file.  
While this would work, and is currently in use at a number of sites, it
creates ambiguous URLs and it does not provide for multiple user
authentication methods based upon the virtual host.  In addition, site
security would be a mess; anyone on any virtual host would be able to jump
to any other virtual host without any additional authentication required.

The HOST scheme requires a change to both the server and the client.
Prior to sending USER/PASS, the client would send HOST to identify which
virtual hostname is to be used for authentication of the user as well as
to determine the FTP area to be accessed.

Proponents of the CWD scheme were more interested in minimum change to the
protocol while those for HOST were pushing for unambiguous syntax and
strong site security.  After a few weeks of discussion, HOST won out.  
The command is now in the experimentation stage where we can see how it
performs in the real world and refine the language of the specification.

--