version 1.x authentication? certificate based? - Page 3

ganymede · 07-20-2005, 03:04 PM

snypeTest ... just out of interest what whole market are you talking about? and... secondly why take functionality that exists in an ftp daemon and remove it? why build a TCL script who cares? build it in.

d1 why not just put up a poll and see who wants what? and what harm is there in putting ip checking? like really come on here... by taking out a feature your opening up your product to competing products doesnt matter what industry you are aiming for... its such a simple thing... why risk loosing users for something so trivial.....

SnypeTEST · 07-20-2005, 03:19 PM

whole market.. as in this FTPD is no longer just going to be targeted to the "scene". Now even companies will start using the FTPD for their win Servers. such as webhosting companies.

Let an external module take care of that. Acouple Reasons:

1) its not like your going to upgrade to v1.0 as soon as it comes out anyway. d1 said himself, all scripts will not work because of the new core.
2) ip@ident is a simple thing. infact an external wrapper can be created to handle this so it doesnt have to rely on ioFTPD versions.

user -> identd wrapper -> (any)FTPD

( thus why d1 says that this method is not secure at all. it can be faked very easly. )

darkone · 07-20-2005, 03:31 PM

Quote:

Originally Posted by ganymede

secondly why take functionality that exists in an ftp daemon and remove it?

Because ioFTPD 1.0 has nothing to do with previous ioftpd's. (except the name) Just wait and see.

darkone · 07-20-2005, 03:35 PM

Also, did I already mention; passive mode (SSL) transfers require certificate based authentication.

ganymede · 07-20-2005, 04:15 PM

darkone throw a dog a bone here and just implement a user ip blocking system!

not to worried about the second point... new functionality is always good.

darkone · 07-20-2005, 04:23 PM

I'll guess I could implement it as example script/module. However, I do not wish to include ip table in database by default.

Harm · 07-20-2005, 05:38 PM

I don't know many things about client certificates. I'm sure there's a way to secure them even if they're stored on some usb stick. Could you enlighten me ?
On another side, how will it work with other ftp daemons ?

Talking about companies that want to restrict the access to their ftp servers, there should still be an ip/host based access control like what we currently have with Host.Rules. Again, could you confirm this darkone ? I must also agree with the fact that ident might be "fun" but is very easy to fake nowadays.

Since tcl will still be there, adding a script to check the ident@host of the user on connect will only take a few lines of code. It will even bring the ability to add advanced regular expressions support or other kind of comparisons you might think of.

ganymede · 07-21-2005, 01:21 AM

back to my earlier point - as long as inicom want to maintain the ip script there isnt a problem. Harm... if you going to use a host.rules file i suggest you use a decent firewall instead.... again this does not solve the problem - you cant limit certain people to certain addresses eg: managers can login from anywhere & peons can login from work only - again a certificate cannot help you there.

ganymede · 07-21-2005, 01:22 AM

dark1 quick question about certificates - will it be like the current io where you force certain users to use them and for example localhost not to?

darkone · 07-21-2005, 07:33 AM

Quote:

Originally Posted by ganymede

dark1 quick question about certificates - will it be like the current io where you force certain users to use them and for example localhost not to?

If user has certificate(s) specified, he is expected to use one. Also note that certificate based authentication only works in SSL mode.

ganymede · 07-22-2005, 08:56 AM

can you run SSL mode without certificates.... AUTH SSL / AUTH TLS