Subject: Ftp-WG: still much call for `proxy ftp' support

From: Jeffrey Altman <[email-masked]>
Date: Tue, 18 Jul 2000 15:36:57 -0500

> > hi people.
> > 
> > i was curious to know if people think there's any real need to
> > continue to support the `three way proxy ftp' stuff that traditional
> > BSD ftp clients provide with the `proxy' command?
> > 
> > as the maintainer of NetBSD's ftp client (www.netbsd.org), which i've
> > ported to other operating systems under autoconf and released as
> > `lukemftp':
> > 	ftp://ftp.netbsd.org/pub/NetBSD/misc/lukemftp/lukemftp-1.4.tar.gz
> > i'm considering simplifying a chunk of the code by ripping out support
> > for what i consider to be fairly useless functionality, but i'm
> > curious to know what other ftp server & client implementers feel.
> 
> i think this feature is very useful and must exist in the file transfer 
> protocol. my FTP client http://www.geocities.com/filesteward supports it but 
> it is undocumented because i found that most of running FTP servers have 
> disabled it.
> 
> ----------------------------------------
> Teodor Angeloff
> 
> 

Any FTP server that implements FTP Proxy should be checked to ensure
it is not susceptible to being used as a means for attacking other
hosts as per RFC 2577.

                  Jeffrey Altman * Sr.Software Designer
                 The Kermit Project * Columbia University
               612 West 115th St * New York, NY * 10025 * USA
     http://www.kermit-project.org/ * [email-masked]

---

From: "Teodor Angeloff" <[email-masked]>
Date: Tue, 18 Jul 2000 15:49:50 -0500

> it is not susceptible to being used as a means for attacking other

what is the problem for attacks - if ports below 1024 are protected and
the feature is allowed for non-anonymous users? what other attacks are 
possible? maybe to cause incoming directory full? or eat all possible 
traffic?

---

From: Alun Jones <[email-masked]>
Date: Tue, 18 Jul 2000 16:15:20 -0500

>possible? maybe to cause incoming directory full? or eat all possible

Servers run on ports above 1024, as well, and may need protection the same 
as ports below 1024.

Alun.
~~~~

--
Texas Imperial Software | Try WFTPD, the Windows FTP Server. Find us
1602 Harvest Moon Place | at web site http://www.wftpd.com or email
Cedar Park TX 78613     | us at [email-masked].  VISA / MC accepted.
Fax +1 (512) 378 3246   | NT-based ISPs, be sure to read details of
Phone +1 (512) 378 3246 | WFTPD Pro, NT service version - $100.