[Xitami] Xitami, FTP, and Security.

[xitami@lists.xitami.org]

Hello Michael, Chris, and Magnus,,,,:) :)


THANKS for the Replies.

These confirm that other than the FTP USERNAME and PASSWORD prompts there is no other protection.

And, I apologize that I only asked the 2 questions without describing the details of the situation relative to the Xitami Documentation for USERNAME, PASSWORD, and FILE transfers.

So, here is the detail of what I hope I understand is going on. Please make any corrections to this understanding as you wish. And, I apologize if the wrong terminology is being used.

    From the document description is seems that although the prompts for 
    username and password do provide that level of protection, the 
    actual transmission of the USERNAME and PASSWORD are sent as "CLEAR ASCII TEXT" 
    on the data link.

    If I understand this to be correct, then anyone with a "SNIFFER"  can 
    capture the TCP/IP (or URL) address along with the USERNAME AND PASSWORD 
    from the FTP record for later use. And, it appears that the FTP record is 
    well documented so the code for the SNIFFER should be easy to create.

    And, this includes the transmission of the data contained in files. In this case 
    the files bytes are sent "as is". So, it does not matter if these files are 
    executable files, sensitive database files, text files, or any other type of 
    information, they can be "SNIFFED OUT" and recreated by anyone willing to spend 
    the time to do that sort of stuff.


And, based on most descriptions of FTP packages, if some form of encryption is not available this would be true for those packages and would include the DOS Command Prompt use of FTP.

THANKS for the inputs. The information has provided other things to look at (ftp processes, SSL, VPN stuff, etc.). From these I am sure I can find something that can make available a strong level of security.


Jerry