Re: Security matters: keep thy doors closed!

[Aristotle]

One thing I'd like to mention is that I consider FTP useless for anything but anonymous access, for the same reason Telnet is - they're both unencrypted protocols.

There are also a handful of FTP daemons that have been written explicitly for anonymous access exclusively and will present very little if any vulnerability. (The one I'm thinking (but don't remember the name) of doesn't contain a single file write call in the entire source, runs chrooted and drops root priviledges as soon as it has a connection before it reads a single byte from the connection.)

Even so, making FTP work poses numerous problems to a firewall due to the way the protocol is set up, with the separation between data and control connections. It really is time to let this dinosaur die.

Makeshifts last the longest.

[belden]

...The one I'm thinking of (but don't remember the name)...

There's probably a lot of these- it could be pureftpd that you're thinking of (or it could be something else!)

From their splash page:

Pure-FTPd is actively supported, and it was always designed with security in mind, and the code is always re-audited as new kind of vulnerabilities are discussed. Unlike other popular FTP servers, the number of root exploits found since the very first released version is zero.

blyman
setenv EXINIT 'set noai ts=2'

[Aristotle]

No actually, while pureftpd is good, it wasn't what I meant. This daemon had anon-something or other in its name and didn't facilitate any other than anonymous logins at all. It was explicitly written to run anon-FTP servers only with an absolute minimum amount of code. Can probably be found via freshmeat..

Makeshifts last the longest.

[belden]

Aha - no surprise that also in the ftp-daemon writing community TMTOWTDI :)

blyman