Re: [Proftpd-user] rstatus response
Bob Friesenhahn <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <[email protected]> |
On Sat, 25 Feb 2017, Michael Green wrote: > Yes, I’ve uncommented the directive and “ProFTPD" appearing in the output of STAT is no longer an issue. > But the fixed structure of the verbiage is still a concern for me, albeit not a big one. "Finger-printing" methods may still allow identifying software even without obvious messages. A few bytes difference in protocol handling or timing difference is often enough to make a positive identification. If a user is allowed to log in so that they are able to exercise many operations, I suspect that there are many other ways to tell if ProFTPd is being used vs the few other popular servers. > And while still at this, I don’t want to make it look bigger than it > is, but I tend to disagree with Bob on his assessment "ProFTPd > itself is not known to be a security hazard. The operating system > you are using may be a security hazard.” > > Everything (the OS and the apps) is a potential hazard and the more > I can do to reduce the risks on every level, the better. The fact > that OS may have more bugs and holes than a particular product, > doesn’t sound like a proper justification to me to not address > concerns in the product even if the concerns are few and small. Your concerns are certainly valid. It would be good to disable this feature (even to the point of editing source code) and then try various remote tools which already identify software and operating systems to see if the issue (ability to identify the software) is really resolved. Some tools are remarkably good at identifying software and operating systems, particularly since there are not really all that many choices to select from. Bob -- Bob Friesenhahn [email protected], http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/ ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html