Re: wu-ftps potential to support encryption

Thanks Bob,

I'm now convinced encryption is not supported.

Re: The patches you suggest, I don't think that'll be a problem given the
way we are using the server and the adaptations we have made.

Thanks again,

Andrew H.

----- Forwarded by Andrew Hardy/MAIN/MC1 on 14/05/2004 09:16 -----
|---------+---------------------------->
|         |           Bob Luckin       |
|         |           <[email protected]>     |
|         |           Sent by:         |
|         |           owner-wuftpd-dev@|
|         |           wu-ftpd.org      |
|         |                            |
|         |                            |
|         |           13/05/2004 17:39 |
|         |           Please respond to|
|         |           Bob Luckin       |
|         |                            |
|---------+---------------------------->
  >--------------------------------------------------------------------------------------------------------------------------------------------------|
  |                                                                                                                                                  |
  |       To:       Andrew Hardy <[email protected]>                                                                                          |
  |       cc:       [email protected]                                                                                                           |
  |       Subject:  Re: wu-ftps potential to support encryption                                                                                      |
  >--------------------------------------------------------------------------------------------------------------------------------------------------|




Andrew,

I think you'll find that fg_encrypt/fd_encrypt etc. are all part of the
password handling for login to the server, which varies according to the
login/password system supported by the OS on the box running the server -
Kerberos, HP-UX C2 (I think that's what it was known as) etc..  They
are nothing to do with encryption of the data or commands sent between the
client and the server; these are not encrypted in 2.6.1.  But the user
password stored on the server's network is of course encrypted, and that's
what this code is dealing with.

Please also note that 2.6.1 had a number of known security issues...

At the time 2.6.2 was released, it was essentially equivalent to 2.6.1 with
all the patches then available applied.  However unless my memory deceives
me,
further security patches for 2.6.2 have subsequently been issued.  So
unless
your 2.6.1 has been patched up to the level of 2.6.2, and then the newer
patches added on top, it may have some vulnerabilities.  (I don't remember
the precise details, but the change logs in the patch files on the FTP site
should presumably give some indication.)

Cheers, Bob

On Thu, May 13, 2004 at 02:42:00PM +0100, Andrew Hardy wrote:
>
> I am running wu-ftpd 2.6.1 and the source has no tlutil.c, also we have
> installed no encryption related patches.  So I am assuming this version
> does not support encryption.
>
> However, I see some things in the source which look to my untrained eye
> very much like they may have something to do with some sort of
encryption.
>
> There are some structure members with names such as fg_encrypt,
fd_encrypt
> etc (possibly indirectly connected with password names), and there are
> sections of code which may be compiled if we define things like HPUX,
> SecureWare, NetBSD etc, all of which look suspiciously like something to
do
> with encryption/security.
>
> I have a disclosure responsibility and I'm just trying to be as sure as
is
> reasonable that encryption is not potentially supported.
>
> Does any one know what this source code might be about, to put my mind at
> rest.
>
> Many thanks,
>
> Andrew H.
>
>

--
Bob Luckin      [email protected]      "Coder, adapt; FTP Ada, redo C"