Re: Encryption.

This is a multipart message in MIME format.
--=_alternative 002E574B80256E92_=
Content-Type: text/plain; charset="US-ASCII"

The first thing is that wu_ftpd only supports encryption as part of 2.8.x. 
 2.6.x doesn't support it (although there are some patches out there).  Be 
wary of anything calling itself 2.7.x which, whilst supporting SSL, isn't 
recommended.

So, assuming you are looking to the latest and greatest CVS snapshot  
ftp://ftp.wu-ftpd.org/private/nocvs/wuftpd-cvs-current.tar.gz this is the 
state of play.

wu_ftpd supports two security schemes  SSL/TLS and GSS.  I will discuss 
SSL/TLS, perhaps somebody else on the list will be kind enough to do the 
same for GSS.  SSH is not integrated into wu_ftpd.

The SSL support is enabled at 'configure' time (--enable-tls) and SSL 
functions are perfromed by the openssl libraries.

The code is embedded in ftpcmd.y and ftpd.c and the additional modules 
tlsutil.c and secutil.c provide the functions required.

SSLv2, v3 and TLSv1 are supported, as are all ciphersuites supported by 
openssl.

Protection is configurable and may be setup to be client-driven or 
server-mandated.  Data connections may be secured (again the server may be 
configured to insist that they must be secured) once the control 
connection is secured.

The references you may wish to look at are RFC2228 and 
draft-murray-auth-ftp-ssl-nn.txt.  These are linked to from my FTP/SSL 
website (http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html).

wu_ftpd specific information is available in the 
doc/HOWTO/ssl_and_tls_ftpd.HOTWO and related files, as well as the ftpd.8 
man page (from the CVS snapshot)

Hope that helps,
Paul

--
Paul Ford-Hutchinson :  eCommerce application security : 
[email protected]
MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926 
462005
http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html




"Andrew Hardy" <[email protected]> 
Sent by: [email protected]
12/05/2004 08:58

To
[email protected]
cc

Subject
Encryption.






Can any one tell me what kind/range of encryptions wu-ftpd supports, for
passwords, data transfer or other?

I am having difficulty finding material on this in manual pages, is it
configurable?

What is a good place to look in the code for the detail?

I know Proftpd supports SSL/TLS & SSH, is wu-ftpd the same ?

Many thanks,

Andrew H




--=_alternative 002E574B80256E92_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2 face="sans-serif">The first thing is that wu_ftpd only
supports encryption as part of 2.8.x. &nbsp;2.6.x doesn't support it (although
there are some patches out there). &nbsp;Be wary of anything calling itself
2.7.x which, whilst supporting SSL, isn't recommended.</font>
<br>
<br><font size=2 face="sans-serif">So, assuming you are looking to the
latest and greatest CVS snapshot &nbsp;</font><font size=2><tt>ftp://ftp.wu-ftpd.org/private/nocvs/wuftpd-cvs-current.tar.gz</tt></font><font size=2 face="sans-serif">
this is the state of play.</font>
<br>
<br><font size=2 face="sans-serif">wu_ftpd supports two security schemes
&nbsp;SSL/TLS and GSS. &nbsp;I will discuss SSL/TLS, perhaps somebody else
on the list will be kind enough to do the same for GSS. &nbsp;SSH is not
integrated into wu_ftpd.</font>
<br>
<br><font size=2 face="sans-serif">The SSL support is enabled at 'configure'
time (--enable-tls) and SSL functions are perfromed by the openssl libraries.</font>
<br>
<br><font size=2 face="sans-serif">The code is embedded in ftpcmd.y and
ftpd.c and the additional modules tlsutil.c and secutil.c provide the functions
required.</font>
<br>
<br><font size=2 face="sans-serif">SSLv2, v3 and TLSv1 are supported, as
are all ciphersuites supported by openssl.</font>
<br>
<br><font size=2 face="sans-serif">Protection is configurable and may be
setup to be client-driven or server-mandated. &nbsp;Data connections may
be secured (again the server may be configured to insist that they must
be secured) once the control connection is secured.</font>
<br>
<br><font size=2 face="sans-serif">The references you may wish to look
at are RFC2228 and draft-murray-auth-ftp-ssl-nn.txt. &nbsp;These are linked
to from my FTP/SSL website (http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html).</font>
<br>
<br><font size=2 face="sans-serif">wu_ftpd specific information is available
in the doc/HOWTO/ssl_and_tls_ftpd.HOTWO and related files, as well as the
ftpd.8 man page (from the CVS snapshot)</font>
<br>
<br><font size=2 face="sans-serif">Hope that helps,</font>
<br><font size=2 face="sans-serif">Paul</font>
<br><font size=2 face="sans-serif"><br>
--<br>
Paul Ford-Hutchinson : &nbsp;eCommerce application security : [email protected]<br>
MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926 462005<br>
http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html<br>
</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>&quot;Andrew Hardy&quot;
&lt;[email protected]&gt;</b> </font>
<br><font size=1 face="sans-serif">Sent by: [email protected]</font>
<p><font size=1 face="sans-serif">12/05/2004 08:58</font>
<td width=59%>
<table width=100%>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td valign=top><font size=1 face="sans-serif">[email protected]</font>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td valign=top>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td valign=top><font size=1 face="sans-serif">Encryption.</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><font size=2><tt>Can any one tell me what kind/range of encryptions
wu-ftpd supports, for<br>
passwords, data transfer or other?<br>
<br>
I am having difficulty finding material on this in manual pages, is it<br>
configurable?<br>
<br>
What is a good place to look in the code for the detail?<br>
<br>
I know Proftpd supports SSL/TLS &amp; SSH, is wu-ftpd the same ?<br>
<br>
Many thanks,<br>
<br>
Andrew H<br>
<br>
<br>
</tt></font>
<br>
--=_alternative 002E574B80256E92_=--