Cpsv

Tillmann · 11-22-2004, 09:18 AM

Hi,

I checked the ChangeLog, and already under "Beta 4.1.0", it is mentioned that CPSV support was added. Great - I thought.

However, in the current version, CPSV doesn't seem to work (encrypted FXP works, but only if the io is in active mode, and the other site is running glftpd/OpenFTPd/TitanFTPd - it doesn't work between two io's).

Was CPSV support removed again? Why? Will it be back? It's a very useful feature.

bye,
Tillmann

Zer0Racer · 11-22-2004, 03:23 PM

The current ssl site-to-site standard that is available is not really fully encrypted. ioFTPD can receive ssl site-to-site transfers but not initiate them itself. darkone chose to do it this way. So ssl fxp FROM ie. glftpd with CPSV works TO ioFTPD.. but not the other way around.

Keep your eyes open and wait for next generation of ioFTPD.

Tillmann · 11-23-2004, 08:24 AM

Hi,

OK, that's what I suspected. The only thing that had confused me is that the ChangeLog already mentions CPSV support. Was it removed later on? Why?

Considering the "target audience" of ioftpd, I think encrypted FXP is very important. BTW, talking about "target audience" - browsing the forums I found a thread about a user getting his license revoked for leaking ioftpd - that made me laugh real hard, especially considering the type of support scripts for ioftpd that are available, and the type of stuff darkone has written in the past, like project-zs. Come one guys... practice what you preach :-)))). Anyways, getting offtopic, sorry :-)

bye,
Tillmann

neoxed · 11-23-2004, 04:59 PM

CPSV support was originally removed in Beta-5.0 if I remember correctly, since darkone didn't have the time to finish the SSL site-to-site connection stuff for the initial Beta-5.0 release. Once he took some time to look at it later, he realized there was a serious flaw in the current design that didn't verify the SSL certificate's fingerprint. This in turn made the site-to-site transfer (FXP) vulnerable to MTM (man in the middle) attacks. Darkone wrote a few posts on the required changes needed to secure the current design, which unfortunately will not make it into ioFTPD until Beta-6 or so.

http://www.ioftpd.com/~darkone/tmp/secure.txt
http://www.ioftpd.com/board/showthre...&threadid=1967

Edit: Found the article/post links.

Tillmann · 11-23-2004, 05:16 PM

Hi,

great, that answers my question.

I agree that it's better not to have it at all, than a flawed version that gives a false sense of security.

bye,
Tillmann

esmandil · 11-24-2004, 05:44 AM

Well, I don't exactly agree with this reasoning.

Man-in-the-middle attack is pretty specific... *and*, in this particular case, impossible to hide, as the attacker cannot send the data to target server. So, if data shows up on the other server, nobody is listening to it (unless the attacker knows your password on the target server... but then he doesn't need to eavesdrop, does he

).

In other words, CPSV is still better than non-encrypted FXP.

As to false sense of security... anybody who doesn't understand what they are doing deserve their fate ;-)

Or do I get this all wrong?