Subject: FTP via SSL

From: "Thunem, Tom" <[email-masked]>
Date: Mon, 14 Jun 1999 12:30:53 -0700

> Does anyone know of a product that allows FTP to operate under SSL
> encryption?  I have an inquiry from the business wanting this level of
> security for FTP.
> 
Thanks

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 14 Jun 1999 15:46:20 -0400 (EDT)

> encryption?  I have an inquiry from the business wanting this level of

There are a few legal consequences to using SSL in the US.  Mainly you
cannot allow anyone outside the US to have the program in any form.  Also,
the WU-FTPD Development Group cannot help you with coding hints.

Remember, the FTP clients will all need to be SSL-ized or it won't work.

That said: there's an old SSL hack for Beta-13 referenced from the SSLeay
site.  ISTM some company is also offering FTP via SSL .. he usually jumps
in with an ad for his product when someone asks about SSL, so check back
in a few hours or go through the mailing list archives for his last ad.

With these two exceptions I know of noone doing WU-FTPD via SSL.

There are some SSL tunneleing packages out there.  I've heard that if
you're very very careful in how you configure them you can get them to
handle FTP.  That'd mean you'd not need to hack the daemon or the clients.
I tried this once on a lack.  It sorta worked but seemed very fragile.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: David Ross <[email-masked]>
Date: Mon, 21 Jun 1999 16:09:52 +1000 (EST)

> With these two exceptions I know of noone doing WU-FTPD via SSL.

I'm currently adapting 2.5.0 to use strong encryption (but not SSL).

Tim Hudson has a BSD FTP client and server using Eric Young's SSLeay
at ftp://ftp.psy.uq.oz.au/pub/Crypto/
I believe this uses the latest (0.9.0b) version of SSLeay.
He also has a diff for wu-2.4.2-beta11+SSL.diff.gz but I have no idea
what version of SSLeay that was for.

ftp://ftp.average.org/pub/wuftp+SSL/ have patches up to the release
version of wu-ftpd-2.4.2 wu-2.4.2+SSL.diff but once again, I have no
idea what version of SSLeay the are based on (or even if it matters).

> I tried this once on a lack.  It sorta worked but seemed very fragile.

Steve Acheson (Cisco) mentioned something called "ftpsshd" at the FIRST
conference last week.  It can be used to catch ftp and forward it over
ssh.
http://www.docs.uu.se/~pem/hacks/ (Per-Erik Martin)

Regards - Dave Ross.
[email-masked]
[email-masked]

(BTW my crypto version of wu-ftpd-2.5.0 is still ages away from being
public and at the moment it is horribly slow.)