Hi people! I found the anon-ftpd from Bernstein, and I like very that we now have only anonymous ftp. Great! The problem now is that no web browser is able to understand the response of this ftp daemon. This means, we are not able to access the ftp server through a web browser. Does some one of you know this problem? Is there a work around for it? If not, which ftp server would you recommend? Thanks in advance, JLT
On Wed, Sep 06, 2000 at 19:55 +0200, Jose Tinoco wrote:
I found the anon-ftpd from Bernstein, and I like very that we now have only anonymous ftp. Great!
The problem now is that no web browser is able to understand the response of this ftp daemon. This means, we are not able to access the ftp server through a web browser.
Are you trying to say that the ftpd's answers don't comply to the rules? That's not what DJB is known for. :) What exactly is the point that breaks those browsers? Have you read the ftpd.html document online at http://cr.yp.to/ ? ----- http://cr.yp.to/publicfile/ftpd.html ---------------------- ... Normally ftpd is run under tcpserver to handle FTP connections from hosts around the Internet. Note that ftpd does not print the standard FTP greeting message; the greeting message is handled by tcpserver. ... ----------------------------------------------------------------- And why do you call it "anon-ftp" when you recently found out about this software? You do know the citation below, don't you? ----- http://cr.yp.to/anonftpd.html ----------------------------- ... anonftpd is a fast, read-only, anonymous FTP server. It has been rendered obsolete by publicfile. ... ----------------------------------------------------------------- I guess you should better check the authoritive sources. I even doubt this is a SuSE security topic. virtually yours 82D1 9B9C 01DC 4FB4 D7B4 61BE 3F49 4F77 72DE DA76 Gerhard Sittig true | mail -s "get gpg key" Gerhard.Sittig@gmx.net -- If you don't understand or are scared by any of the above ask your parents or an adult to help you.
On Wed, 6 Sep 2000, Gerhard Sittig wrote:
I found the anon-ftpd from Bernstein, and I like very that we now have only anonymous ftp. Great!
The problem now is that no web browser is able to understand the response of this ftp daemon. This means, we are not able to access the ftp server through a web browser.
Are you trying to say that the ftpd's answers don't comply to the rules? That's not what DJB is known for. :) What exactly is the point that breaks those browsers? Have you read the ftpd.html document online at http://cr.yp.to/ ?
From security point of view, the server is kept as short and simple as
Just FYI ... this message was posted to the security-audit ML: --- begin quote --- Hello, I'm announcing the availability of new release of Libra FTP server. What is new: - Added command line length limit. - Miscellaneous changes in documentation and source inspired by Solar Designer from security-audit@ferret.lmh.ox.ac.uk Libra FTP server is indented for anonymous access only. It was written from scratch with the main priorities being security and compatibility with standards and existing clients. possible and every line of code was considered for possible security impacts, including DoS ones. The server doesn't have "features" of wu-ftpd and proftpd, and, because of the smaller code base, should be much more reliable.Probably, the spirit of the server is more close to Dan Bernstein's one. When it comes to standards, the following ones were considered: RFC959, RFC1123, RFC854, RFC1579, RFC2389. As other server advantages I'd like to mention: - Internal LIST implementation - Ability to work well inside chroot's (no external programs, /dev/null or anything else is necessary) - Absence of configuration file - The code being written specially for Linux. The server is available from http://libraftp.narod.ru Best regards Maxim Shesterikov --- end quote --- best regards, Rainer Link -- Rainer Link, SuSE GmbH, eMail: link@suse.de, Web: www.suse.de Developer of A Mail Virus Scanner (AMaViS): http://amavis.org/ Founder of Linux AntiVirus Project: http://lavp.sourceforge.net/
Gerhard Sittig wrote:
Are you trying to say that the ftpd's answers don't comply to the rules? That's not what DJB is known for. :) What exactly is the point that breaks those browsers? Have you read the ftpd.html
Try ftp://cr.yp.to and you will see the problem. With an ftp client it's possible to navigate although still strange, but not with netscape although it's possible to get ftp://cr.yp.to/index.html. $ ncftp cr.yp.to NcFTP 3.0.0 (March 20, 2000) by Mike Gleason (ncftp@ncftp.com). Connecting to 131.193.178.181... Features: a p . Logging in... Hi. No need to log in; I'm an anonymous ftp server. Logged in to cr.yp.to. ncftp / > ls +i0.236453,m967043536,r,s2379, index.html +i0.631874,m951789705,/, 1998-100 +i0.718174,m951789707,/, 1999-275 +i0.236496,m957763516,r,s933, 1999-275.html +i0.236247,m957763626,r,s322, 1998-401.html +i0.689416,m951789707,/, 1998-401 +i0.714380,m951789705,/, 1997-275 +i0.236426,m957763705,r,s277, 1998-515.html +i0.236324,m957764203,r,s325, 2000-436.html +i0.576113,m951789707,/, 1997-494 +i0.236425,m957764344,r,s610, 1995-514.html +i0.2012,m951789707,/, 1999-541 +i0.11567,m951789707,/, 1995-514 +i0.716165,m951789705,/, 1999-180 +i0.236427,m957763712,r,s274, 2000-515.html +i0.687522,m951789707,/, 1998-515 +i0.412995,m951789707,/, 2000-515 +i0.213334,m958117573,/, zpfft +i0.295901,m958719666,/, psibound +i0.236429,m951789711,r,s398, anonftpd.html [...] etc
And why do you call it "anon-ftp" when you recently found out about this software? You do know the citation below, don't you?
Publicfile is a webserver and anonymous ftp server but there is no possibility for user-ftp. -- \ J. Dollinger Uni Ulm | zeitnot@irc | http://www.home.pages.de/~zeitnot/ \ "What're quantum mechanics?" -- "I don't know. People who / \ repair quantums, I suppose." (Terry Pratchett, Eric) /
participants (4)
-
Gerhard Sittig
-
Jose Tinoco
-
Jürgen Dollinger
-
Rainer Link