[Xitami] Xitami, FTP, and Security.

[Brian {Hamilton Kelly}]

In message <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAA2lXp+ObGr0qVg7L1=
TsMG7sKAAAAQAAAAHsqro+gCqECFDg2/SjgEvAEAAAAA@yahoo.com>
   "Chris Jones" writes:
> Jerry,

[snip]

> I purchased a copy of it from Wfshome. As far as there being
> security/encryption of the data being transferred, the FTP protocol does
> not offer that and was never designed to do so. If that is what you
> desire, I'd look into some of the "Blow Fish" encryption technologies.

The above ight be useful if Jerry is looking to encrypt the *file data*
transferred between server and client.

However, I'm not sure that was his main worry...

[Jerry's original query]

> > The following 2 questions are related to any security method with the
> > Xitami (v2.5b4) FTP Server of the data transmitted for USERNAME,=20
> > PASSWORD, and File Data.

There is absolutely no possibility of encrypting the username/password,
used for authentication by FTP.  This is because the protocol was
designed (over twenty years ago) to expect this information to be
transmitted in the clear (just as the same happens with the telnet
protocol for remote login to other machines).

So for his query:

> >    1. Is there a method to secure the actual data being transmitted
> > using the Xitami Server?

the answer might be yes, with third-party encryption of the data file
contents, but absolutely no way for the authentication phase.  The only
way that might be achieved would be through an ssh session to other
software on the server, and for the latter to permit FTP "login" only
from localhost.

FTP has been around a long time: I've never heard of anyone wanting
encryption of the authentication phase.  I suppose it might be
attainable, through one-time passwords: this would require changes to the
FTP server process.

> >       I have found other providers of FTP CLIENT/SERVER processes that
> > provide this
> >       protection. I am just curious if this can be done using Xitami.

I somehow doubt the veracity of this assertion; can you give more detail,
Jerry?

--=20
   fix (vb.): 1. to paper over, obscure, hide from public view; 2. to
   work around, in a way that produces unintended consequences that are
   worse than the original problem.  Usage: "Windows ME fixes many of the
   shortcomings of Windows 98 SE".