Re: lftp-3.0.4 always tries to issue CPSV command when doing secure FXP with SSCN-enabled server

--- "Alexander V. Lukyanov" <[email protected]> wrote:
> On Wed, Jun 02, 2004 at 02:55:10PM -0700, Roboco
> Sanchez wrote:
> > >    1. FEAT should be allowed before login as it
> > > contains information about
> > >    AUTH command, which is used before login. I
> don't
> > > remember if it is in
> > >    some standard or draft, but it is common
> sense.
> > >    2. The code 500 should not be used to
> indicate
> > > impropriate use of command
> > >    before login. Instead, 530 should be used.
> > 
> > Seems they won't do it. They said it's for
> security
> > reason. I'm inclined to agree with them.
> > 
> >
>
https://forum.raidenftpd.com/showflat.php?Cat=&Board=UBB13&Number=42795
> 
> This won't make much of security anyway. At lest
> they should change the error
> code to mimic some other ftp server, as the code 500
> is only used by Raiden
> and it can be used to determine the server type ;-)
> 
> -- 
>    Alexander.

Ok. Haven't heard from the author team yet since the
security about their unique FEAT reply was pointed
out. But now there has been a new argument.

"... the RFC [2389] explicitly states what the server
reply should be when '...a server-FTP process does not
support the FEAT command, it will respond to the FEAT
command with a 500 or 502 reply.' At the point in
question, before login, RaidenFTPd does not support
FEAT - therefore the response is correct. The only
other code defined is 501 - 'Errors in the command
syntax, such as giving parameters, will result in a
501 reply.' 

The Raiden Team does a good job conforming to RFC's -
this is just another example..."

To me, that means:
1) it's not against the RFC for a server to only
support FEAT after login and to not support it before
login. Is that correct?
2) any server deploys such strategy in 1) that replies
to FEAT with anything other than 500, 501 or 502, this
includes: wuftpd (530), BlackMoon (503), Microsoft FTP
Server (530), doesn't conform to the RFC. Is that
correct?

Any argument to that on this side?

Cheers,
Rob.



	
		
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/