Re: Encryption.
"Andrew Hardy" <[email protected]> Wed, 12 May 2004 10:45:36 +0100
| Newsgroups | gmane.network.ftp.wuftpd.devel |
|---|---|
| Message-ID | <[email protected]> |
Paul, Thanks for your response (not included here) I have no vers.c file (and am having difficulty find a const / define vers.c idf that's what you mean by string), BUT I also have no tlsutil.c, which is good for 'we don't support encryption'. However, having said all this, I now see some things in the source which look to my untrained eye very much like they may have something to do with some sort of encryption. There are some structure members with names such as fg_encrypt, fd_encrypt etc (possibly indirectly connected with password names), and there are sections of code which may be compiled if we define things like HPUX, SecureWare, NetBSD etc, all of which look suspiciously like something to do with encryption/security. Am I just barking up the wrong tree here? I realise this open source and the developers have no responsibility, but I have a disclosure responsibility and I'm just trying to be as sure as is reasonable. Many thanks again, If your busy, but could point me in the direction of any other help, that would be great. Andrew H. ----- Forwarded by Andrew Hardy/MAIN/MC1 on 12/05/2004 10:27 ----- |---------+----------------------------> | | Andrew Hardy | | | | | | 12/05/2004 10:13 | | | | |---------+----------------------------> >--------------------------------------------------------------------------------------------------------------------------------------------------| | | | To: Paul V Ford-Hutchinson <[email protected]>@MCEXT | | cc: | | Subject: Re: Encryption.(Document link: Andrew Hardy) | >--------------------------------------------------------------------------------------------------------------------------------------------------| Thanks Paul, That's great. It's more a disclosure issue, than a need for functionality. I'm pretty sure we have 2.6.x and so therefore do NOT support encryption. The README certainly has: ================= = RELEASE NOTES = ================= WU-FTP SERVER, RELEASE 2.6.1 - June, 2000 We haven't installed any encryption patches and I'm assuming the readme and the source are in step. Going with, we haven't installed any patches, do you know what the bottom line is in the source to see what version it is, eg a version.h or something ? Thanks again for your help. Andrew. P.S. I seem to be getting duplicates of some list submissions, do you think I may be on the list twice or something? |---------+----------------------------> | | Paul V | | | Ford-Hutchinson | | | <[email protected]| | | .com> | | | | | | 12/05/2004 09:28 | | | | |---------+----------------------------> >--------------------------------------------------------------------------------------------------------------------------------------------------| | | | To: "Andrew Hardy" <[email protected]> | | cc: [email protected] | | Subject: Re: Encryption. | >--------------------------------------------------------------------------------------------------------------------------------------------------| The first thing is that wu_ftpd only supports encryption as part of 2.8.x. 2.6.x doesn't support it (although there are some patches out there). Be wary of anything calling itself 2.7.x which, whilst supporting SSL, isn't recommended. So, assuming you are looking to the latest and greatest CVS snapshot ftp://ftp.wu-ftpd.org/private/nocvs/wuftpd-cvs-current.tar.gz this is the state of play. wu_ftpd supports two security schemes SSL/TLS and GSS. I will discuss SSL/TLS, perhaps somebody else on the list will be kind enough to do the same for GSS. SSH is not integrated into wu_ftpd. The SSL support is enabled at 'configure' time (--enable-tls) and SSL functions are perfromed by the openssl libraries. The code is embedded in ftpcmd.y and ftpd.c and the additional modules tlsutil.c and secutil.c provide the functions required. SSLv2, v3 and TLSv1 are supported, as are all ciphersuites supported by openssl. Protection is configurable and may be setup to be client-driven or server-mandated. Data connections may be secured (again the server may be configured to insist that they must be secured) once the control connection is secured. The references you may wish to look at are RFC2228 and draft-murray-auth-ftp-ssl-nn.txt. These are linked to from my FTP/SSL website (http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html). wu_ftpd specific information is available in the doc/HOWTO/ssl_and_tls_ftpd.HOTWO and related files, as well as the ftpd.8 man page (from the CVS snapshot) Hope that helps, Paul -- Paul Ford-Hutchinson : eCommerce application security : [email protected] MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926 462005 http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html "Andrew Hardy" <[email protected]> Sent by: [email protected] To 12/05/2004 08:58 wuftpd-dev @wu-ftpd.o rg cc Subject Encryption . Can any one tell me what kind/range of encryptions wu-ftpd supports, for passwords, data transfer or other? I am having difficulty finding material on this in manual pages, is it configurable? What is a good place to look in the code for the detail? I know Proftpd supports SSL/TLS & SSH, is wu-ftpd the same ? Many thanks, Andrew H