[Xitami] Xitami, FTP, and Security.

[xitami@lists.xitami.org]

Hello Brian,   :) :)

[SNIPPED STUFF]

> There is absolutely no possibility of encrypting the username/password,
> used for authentication by FTP.  This is because the protocol was
> designed (over twenty years ago) to expect this information to be
> transmitted in the clear (just as the same happens with the telnet
> protocol for remote login to other machines).

Yep, and during that time (over tenty years ago) I remember that a lot of folks, companies, committies, etc. suggested that the username and password for both FTP and TELNET be consealed by some method. If KERMIT is still around I think even KERMIT tranmits this in the "CLEAR". I would have thought by now with all the CRAP going on with HACKERS this would have been provided. It would at leawt provide for not a 100% protection, but a very powerful layer of protection if the USERNAME and PASSWORD was not sent in the "CLEAR". At least with any number of bits of encryption and 128 bit encryption seems good. And, I am finding stuff that does provide this by some means or another. If that involves other processes use of standards such as SSL, if that is the proper use of the term (Secure Sockets Layer) in this context, Tunneling stuff, also any provider's method for VPN stuff, etc. All of which I have not read or studied yet. But, the easy part is to read about these. 

> So for his query:
> 
> > >    1. Is there a method to secure the actual data being transmitted
> > > using the Xitami Server?
> 
> the answer might be yes, with third-party encryption of the data file
> contents, but absolutely no way for the authentication phase.  The only
> way that might be achieved would be through an ssh session to other
> software on the server, and for the latter to permit FTP "login" only
> from localhost.
> 
> FTP has been around a long time: I've never heard of anyone wanting
> encryption of the authentication phase.  I suppose it might be
> attainable, through one-time passwords: this would require changes to the
> FTP server process.

Seems there are many applications available that can secure the data file transfer, so this is a "NO BRAINER" to secure data file transmission. 

However, for the security of USERNAME and PASSWORD I do not care if it is FTP or not. The use of FTP was just a starting point!

> 
> > >       I have found other providers of FTP CLIENT/SERVER processes that
> > > provide this
> > >       protection. I am just curious if this can be done using Xitami.
> 
> I somehow doubt the veracity of this assertion; can you give more detail,
> Jerry?
> 

And, for FTP this may be true, but there seems to be other processes avialable that do provide a secure authentication procedure within their code structure,,,,,I probably should not have used FTP in this context,,,,,I simply used FTP as a starting point for conversation. And, if a provider has taken the FTP standard and wrappped around that standard a method to secure the authetication that that would be acceptable. All this means is that provider's FTP CLIENT as well as their SERVER process would have to be used. I think I remember at least one that did this, but I am sorry that I did not save the link to that discussion. It has been a few days ago that I took a quick look at what may be available and I did not save any to bookmarks. I cannot remember the details in their discussions, but there was a lot of discussion within these that was related to encryption, authetication, and data file transfer.

You can find some if you search for any combination of the words: FTP SECURE AUTHETICATION, VPN, CLIENT, SERVER, etc. Or, maybe some combination of these as exact phrases. These are the words I used for the search and GOOGLE was used. 

When I get the chance I will give this a try and see what I find again. Since this is what I am looking for I will bookmark'em! :) :)

Regards,

Jerry :) :)