OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: ftpd: the advisory version
From: Jim Knoble (jmknoblePINT-STOWP.CX)
Date: Mon Jun 26 2000 - 14:48:22 CDT

Circa 2000-Jun-24 09:17:56 -0000 schrieb Lamagra Argamal:

: Last thing, I've been thinking about the general ftp protocol and there
: is only 1 reason why it should run as root after authentication. Namely
: to bind the dataconnection to port <ftpport - 1> (mostly 20). And we
: all know high ports require root priviledges for binding. Couldn't you
: change it to bind to the port at startup. This would require some other
: changes to prevent DoS etc But it should be possible, after that the
: daemon can just drop all priviledges after authentication. Giving an
: attacker nothing.

D.J. Bernstein's 'publicfile' anonymous FTP server + HTTP server does
exactly this, as well as chrooting to a restricted area. It's here:

  http://cr.yp.to/publicfile.html

If all you need is anonymous FTP, it works fine (for user FTP,
consider ssh/scp as a replacement). 

--
jim knoble | jmknoblejmknoble.cx | http://www.jmknoble.cx/