Re: [Proftpd-user] rstatus response

Well, my users are anonymous. So no, I don’t trust them.
I agree that this is not a huge security hole, but a way to customize that message to disguise the product identity would still be much appreciated.

Thanks.

> On Feb 24, 2017, at 4:30 PM, TJ Saunders <[email protected]> wrote:
> 
> 
> 
>> What you response also made me realize is that the line that contains
>> “ProFTPD” is also hardcoded as well as probably the rest of the response
>> to ‘rstatus’. My concern now is that this whole response is  a “giveaway”
>> to a potential intruder because if a string (Status of “ServerName”) with
>> specific structure appears in a particular place in the response to known
>> command, one can deduce the product because only this product prints this
>> in response to STAT. Unless RFC dictates that STAT is responded with this
>> particular verbiage. 
>> 
>> What do you think?
> 
> ProFTPD will respond to a STAT command only if the client has
> authenticated, so it's a "giveaway" of information to users that you
> have already allowed.  (If you don't trust your users, then you have
> other issues.)
> 
> This, combined with the ability to change that information via
> ServerName, to me suggests that the "leak", if construed as such, is not
> that large.
> 
> TJ
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> ProFTPD Users List   <[email protected]>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html