Re: [Proftpd-user] Sftpcipher directive
Geoffrey Myers <[email protected]> Mon, 12 Aug 2024 13:26:26 -0400
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <[email protected]> |
--===============4468306127409636808== Content-Type: multipart/alternative; boundary="Apple-Mail=_4BB18D1A-2014-4096-8B33-3614466CA91D" --Apple-Mail=_4BB18D1A-2014-4096-8B33-3614466CA91D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 thanks Chris, If I recall correctly, map requires root access? I don=E2=80=99t have = root access. Is there any way to determine the altos/ciphers supported = by proftpd that does not require root access? > On Aug 2, 2024, at 10:38 PM, Chris Young <[email protected]> wrote: >=20 > to "visualize" the enabled ciphers for your server, install nmap, and = from a command line, you can run >=20 > ## check for ssh/sftp algos > nmap -Pn --script ssh2-enum-algos -p 22 SFTP.HOST.WHATEVER >=20 > ## check for ssl/tls ciphers > nmap --script ssl-enum-ciphers -p 443 WWW.HOST.WHATEVER >=20 > if your machine is running openssl v3+, you'll get an accurate map of = the enable key exchange and encryption algorithms. >=20 > .. pretty sure ssh will show accurate, even for openssl v1, but modern = tls ciphers will only show if you have openssl v3+ >=20 >=20 > On Fri, Aug 2, 2024 at 1:36=E2=80=AFPM TJ Saunders <[email protected] = <mailto:[email protected]>> wrote: > > TJ, thanks. Quick question. I=E2=80=99m a bit confused. As I = referenced ssh=20 > > you mentioned openssl. Does ssh use OpenSSL? I would expect = openssh.=20 >=20 > The mod_sftp module for ProFTPD implements the SSH and SFTP protocols = using the OpenSSL library for the necessary cryptographic support. It = does not use the OpenSSH implementations in any way. In fact, mod_sftp = implements some parts of the SFTP protocol that OpenSSH does not = implement. >=20 > Cheers, > TJ >=20 >=20 > _______________________________________________ > ProFTPD Users List <[email protected] = <mailto:[email protected]>> > Unsubscribe problems? > http://www.proftpd.org/list-unsub.html = <http://www.proftpd.org/list-unsub.html>__________________________________= _____________ > ProFTPD Users List <[email protected]> > Unsubscribe problems? > http://www.proftpd.org/list-unsub.html -- Until later, Geof --Apple-Mail=_4BB18D1A-2014-4096-8B33-3614466CA91D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" = class=3D"">thanks Chris,<div class=3D""><br class=3D""></div><div = class=3D"">If I recall correctly, map requires root access? I = don=E2=80=99t have root access. Is there any way to determine the = altos/ciphers supported by proftpd that does not require root = access?</div><div class=3D""><br class=3D""><div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On Aug = 2, 2024, at 10:38 PM, Chris Young <<a href=3D"mailto:[email protected]"= class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div dir=3D"ltr" = class=3D""><div class=3D""><div class=3D"">to "visualize" the enabled = ciphers for your server, install nmap, and from a command line, you can = run</div><div style=3D"margin-left:40px" class=3D""><span = style=3D"font-family:monospace" class=3D""><br class=3D"">## check for = ssh/sftp algos<br class=3D""></span></div><div style=3D"margin-left:40px" = class=3D""><span style=3D"font-family:monospace" class=3D"">nmap -Pn = --script ssh2-enum-algos -p 22 SFTP.HOST.WHATEVER<br class=3D""><br = class=3D""></span></div><div style=3D"margin-left:40px" class=3D""><span = style=3D"font-family:monospace" class=3D"">## check for ssl/tls = ciphers<br class=3D""></span></div><div style=3D"margin-left:40px" = class=3D""><span style=3D"font-family:monospace" class=3D"">nmap = --script ssl-enum-ciphers -p 443 <a href=3D"http://WWW.HOST.WHATEVER" = class=3D"">WWW.HOST.WHATEVER</a><br class=3D""></span></div><span = style=3D"font-family:monospace" class=3D""><br = class=3D""></span></div><div class=3D""><span = style=3D"font-family:arial,sans-serif" class=3D"">if your machine is = running openssl v3+, you'll get an accurate map of the enable key = exchange and encryption algorithms.</span></div><br class=3D""><div = class=3D"">.. pretty sure ssh will show accurate, even for openssl v1, = but modern tls ciphers will only show if you have openssl v3+<br = class=3D""></div><div class=3D""><br class=3D""><span = style=3D"font-family:arial,sans-serif" class=3D""></span></div></div><br = class=3D""><div class=3D"gmail_quote"><div dir=3D"ltr" = class=3D"gmail_attr">On Fri, Aug 2, 2024 at 1:36=E2=80=AFPM TJ Saunders = <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:<br class=3D""></div><blockquote= class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px = solid rgb(204,204,204);padding-left:1ex">> TJ, thanks. Quick = question. I=E2=80=99m a bit confused. As I referenced ssh = <br class=3D""> > you mentioned openssl. Does ssh use OpenSSL? I would expect = openssh. <br class=3D""> <br class=3D""> The mod_sftp module for ProFTPD implements the SSH and SFTP protocols = using the OpenSSL library for the necessary cryptographic support. = It does not use the OpenSSH implementations in any way. In fact, = mod_sftp implements some parts of the SFTP protocol that OpenSSH does = not implement.<br class=3D""> <br class=3D""> Cheers,<br class=3D""> TJ<br class=3D""> <br class=3D""> <br class=3D""> _______________________________________________<br class=3D""> ProFTPD Users List <<a = href=3D"mailto:[email protected]" target=3D"_blank" = class=3D"">[email protected]</a>><br class=3D""> Unsubscribe problems?<br class=3D""> <a href=3D"http://www.proftpd.org/list-unsub.html" rel=3D"noreferrer" = target=3D"_blank" = class=3D"">http://www.proftpd.org/list-unsub.html</a></blockquote></div> _______________________________________________<br class=3D"">ProFTPD = Users List <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>><br class=3D"">Unsubscribe = problems?<br class=3D""><a href=3D"http://www.proftpd.org/list-unsub.html"= = class=3D"">http://www.proftpd.org/list-unsub.html</a></div></blockquote></= div><br class=3D""><div class=3D""> <span class=3D"Apple-style-span" style=3D"border-collapse: separate; = color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; = font-variant: normal; font-weight: normal; letter-spacing: normal; = line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; = text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: = 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: = auto; -webkit-text-stroke-width: 0px; "><div class=3D"">--</div><div = class=3D"">Until later, Geof</div><div class=3D""><br = class=3D""></div></span><br class=3D"Apple-interchange-newline"> </div> <br class=3D""></div></body></html>= --Apple-Mail=_4BB18D1A-2014-4096-8B33-3614466CA91D-- --===============4468306127409636808== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============4468306127409636808== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html --===============4468306127409636808==--