FTP daemons

newer
Re: [suse-security] Firewall

older
SuSE Security Announcement: xntp...

Morsal Roudbay

3 Apr 2001 3 Apr '01

17:52

Which FTP daemon for Linux is currently the one with least security holes? Morsal

Show replies by date

Roman Drahtmueller

3 Apr 3 Apr

17:58

New subject: [suse-security] FTP daemons

...

Which FTP daemon for Linux is currently the one with least security holes?

wuftpd-2.4.2, which is installed as /usr/sbin/wu.ftpd in the SuSE wuftpd.rpm package. After Thomas' audit a long while ago, it hasn't had any security related problem any more.

...

Morsal

Roman. -- - - | Roman Drahtmüller // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

Gerd Bitzer

4 Apr 4 Apr

06:09

New subject: [suse-security] FTP daemons

Pardon me for jumping in, but I cannot believe that you really recommend using wuftpd, have a look at http://www.heise.de/newsticker/result.xhtml?url=/newsticker/data/ju-26.06.00..., IMHO wuftpd is the ftp daemon with the most security holes in it's long history. Personally I would not use it on a new install, I'd prefer Proftpd (which is also deliverd with Suse Linux). Roman Drahtmueller wrote:

...

...
Which FTP daemon for Linux is currently the one with least security holes?

wuftpd-2.4.2, which is installed as /usr/sbin/wu.ftpd in the SuSE wuftpd.rpm package. After Thomas' audit a long while ago, it hasn't had any security related problem any more.

...
Morsal

Roman. -- - - | Roman Drahtmüller // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Kurt Seifried

06:36

New subject: [suse-security] FTP daemons

ProFTPD also has a lot of root hacks. It desperately needs to stop and audit itself. If you want secuerity I'd reccomend vsftpd. It was designed to be secure. Kurt Seifried, seifried@securityportal.com Securityportal - your focal point for security on the 'net ----- Original Message ----- From: "Gerd Bitzer" To: "Roman Drahtmueller" Cc: "Morsal Roudbay" ; Sent: Wednesday, April 04, 2001 12:09 AM Subject: Re: [suse-security] FTP daemons

Morsal Roudbay

13:00

New subject: [suse-security] FTP daemons

Kurt, do u have a link to the vsftpd site? Thanks. ----- Original Message ----- From: "Kurt Seifried" To: "Gerd Bitzer" ; "Roman Drahtmueller" Cc: "Morsal Roudbay" ; Sent: Wednesday, April 04, 2001 8:36 AM Subject: Re: [suse-security] FTP daemons

...

ProFTPD also has a lot of root hacks. It desperately needs to stop and audit itself. If you want secuerity I'd reccomend vsftpd. It was designed to be secure.

Kurt Seifried, seifried@securityportal.com Securityportal - your focal point for security on the 'net

----- Original Message ----- From: "Gerd Bitzer" To: "Roman Drahtmueller" Cc: "Morsal Roudbay" ; Sent: Wednesday, April 04, 2001 12:09 AM Subject: Re: [suse-security] FTP daemons

Rainer Link

13:04

New subject: [suse-security] FTP daemons

On Wed, 4 Apr 2001, Morsal Roudbay wrote:

...

Kurt, do u have a link to the vsftpd site? Thanks. vsftpd from Chris can be found at ftp://ferret.lmh.ox.ac.uk/pub/linux/

best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link@suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org)

Bjoern Engels

13:05

New subject: [suse-security] FTP daemons

ftp://ferret.lmh.ox.ac.uk/pub/linux/vsftpd-0.0.15.tar.gz I installed it on our server this morning during a break in the training I'm doing - very easy to install and configure product :) ---------------------------------- E-Mail: Bjoern Engels Date: 04-Apr-01 Time: 15:04:33 This message was sent by XFMail ----------------------------------

Anibal Vasquez

6 Apr 6 Apr

20:42

New subject: [suse-security] FTP daemons

On Wed, Apr 04, 2001 at 12:36:51AM -0600, Kurt Seifried wrote:

...

ProFTPD also has a lot of root hacks. It desperately needs to stop and audit itself. If you want secuerity I'd reccomend vsftpd. It was designed to be secure.

:-) Someone of you who uses the libra ftpd? http://libraftp.narod.ru Is it to be considered secure? Thanks, Anibal

Bjoern Engels

4 Apr 4 Apr

06:40

New subject: [suse-security] FTP daemons

On 04-Apr-01 Gerd Bitzer wrote:

...

Personally I would not use it on a new install, I'd prefer Proftpd (which is also deliverd with Suse Linux).

But I wouldn't use the package that is shipped with SuSE Linux, try a "ls */../*/../*/../*/../*/../*/../*/../*", switch to a second console and watch your memory going ->> 0 bytes if you don't kill -9 the proftpd process... proftpd-1.2.2rc2 (I hope I got the right version in mind) fixed that. ---------------------------------- E-Mail: Bjoern Engels Date: 04-Apr-01 Time: 08:36:28 This message was sent by XFMail ----------------------------------

Thomas Michael Wanka

07:56

New subject: [suse-security] FTP daemons

On 4 Apr 2001, at 8:40, Bjoern Engels wrote:

...

But I wouldn't use the package that is shipped with SuSE Linux, try a "ls */../*/../*/../*/../*/../*/../*/../*", switch to a second console and watch your memory going ->> 0 bytes if you don't kill -9 the proftpd process... proftpd-1.2.2rc2 (I hope I got the right version in mind) fixed that.

Hi, that specific problem can be solved by maskeradind some characters in proftpd.conf. It was mentioned on the proftpd ML and can be found in the archives. HTH mike

Yuri Robbers

08:41

New subject: [suse-security] FTP daemons

...

but I cannot believe that you really recommend using wuftpd, have a look at http://www.heise.de/newsticker/result.xhtml?url=/newsticker/data/ju-26.06.00..., IMHO wuftpd is the ftp daemon with the most security holes in it's long history. Personally I would not use it on a new install, I'd prefer Proftpd (which is also deliverd with Suse Linux).

Although we must learn from the past, I still think that the CURRENT security issues of a package are more important than the amount or severity of security holes that have already been fixed over the past couple of years. As Roman said:

...

...
After Thomas' audit a long while ago, it hasn't had any security related problem any more.

If you want a secure system today, then take whatever software is the best in that respect today. Cheers! Yuri.

Morsal Roudbay

12:58

New subject: [suse-security] FTP daemons

Thanks for your opinion Gerd. I was actually also thinking that Wu-FTPd would have many security holes considering it's dark history. I personally use ProFTPd and I read it's supposed to be one of the most secure. ----- Original Message ----- From: "Gerd Bitzer" To: "Roman Drahtmueller" Cc: "Morsal Roudbay" ; Sent: Wednesday, April 04, 2001 8:09 AM Subject: Re: [suse-security] FTP daemons

...

Pardon me for jumping in,

but I cannot believe that you really recommend using wuftpd, have a look at

http://www.heise.de/newsticker/result.xhtml?url=/newsticker/data/ju-26.06.00 -000,

...

IMHO wuftpd is the ftp daemon with the most security holes in it's long history. Personally I would not use it on a new install, I'd prefer Proftpd (which is also deliverd with Suse Linux).

Roman Drahtmueller wrote:

...
...
Which FTP daemon for Linux is currently the one with least security

holes?

wuftpd-2.4.2, which is installed as /usr/sbin/wu.ftpd in the SuSE wuftpd.rpm package. After Thomas' audit a long while ago, it hasn't had any security related problem any more.

...
Morsal

Roman. --

...

...
| Roman Drahtmüller // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) |

...

...
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Gerd Bitzer

13:02

New subject: [suse-security] FTP daemons

Or you have a look at the vsftpd, which was recommended by Kurt Seifried. I think his judgement could be trusted, I dont know it, have never read about it. Morsal Roudbay wrote:

...

Thanks for your opinion Gerd. I was actually also thinking that Wu-FTPd would have many security holes considering it's dark history. I personally use ProFTPd and I read it's supposed to be one of the most secure.

----- Original Message ----- From: "Gerd Bitzer" To: "Roman Drahtmueller" Cc: "Morsal Roudbay" ; Sent: Wednesday, April 04, 2001 8:09 AM Subject: Re: [suse-security] FTP daemons

...
Pardon me for jumping in,

but I cannot believe that you really recommend using wuftpd, have a look at

http://www.heise.de/newsticker/result.xhtml?url=/newsticker/data/ju-26.06.00 -000,

...
IMHO wuftpd is the ftp daemon with the most security holes in it's long history. Personally I would not use it on a new install, I'd prefer Proftpd (which is also deliverd with Suse Linux).

Roman Drahtmueller wrote:

...
...
Which FTP daemon for Linux is currently the one with least security

holes?

wuftpd-2.4.2, which is installed as /usr/sbin/wu.ftpd in the SuSE wuftpd.rpm package. After Thomas' audit a long while ago, it hasn't had any security related problem any more.

...
Morsal

Roman. --

-

...
...
| Roman Drahtmüller // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) |

-

...
...
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Roman Drahtmueller

15:35

New subject: [suse-security] FTP daemons

On Wed, 4 Apr 2001, Morsal Roudbay wrote:

...

From: Morsal Roudbay To: Gerd Bitzer , Roman Drahtmueller Cc: suse-security@suse.com Date: Wed, 4 Apr 2001 14:58:53 +0200 Subject: Re: [suse-security] FTP daemons

Hi Morsal,

...

Thanks for your opinion Gerd. I was actually also thinking that Wu-FTPd would have many security holes considering it's dark history. I personally use ProFTPd and I read it's supposed to be one of the most secure.

I'd be grateful if you could point me to the source where you got that information from. We've been running proftpd on ftp.suse.com. This server counts as a high volume ftp server in both the transferred data, the number of sessions/day and the number of bytes transferred per session. We've come to the conclusion that proftpd doesn't scale above a limit of about 300 concurrent users and that the memory leaks make the daemon unuseable in standalone mode. The lack of scalability is caused by an enormous system call overhead that is a result of every deamon checking the health of _all_ other daemons by killing _all_ of them using signal SIGCONT. I've fixed this, along with some format string parsing bugs and another performance issue, but it didn't help, it's still too hungry. One of the primary reasons that made us try proftpd was the feature that limits the number of connections per IP. Basically, we wanted the rate-limiting stuff as well, but the resulting syscall overhead would have killed the fastest machine. We've now gone back to wuftpd in combination with xinetd. The one that you find in the wuftpd.rpm package, residing in /usr/sbin/wu.ftpd, is the good old 2.4 release that comes with a set of patches against all known vulerabilites (/usr/sbin/wu.ftpd-2.6 is the new one). Some of these patches are a result of an extensive audit by Thomas Biege back in 1999 (IIRC), and no problem has turned up ever since. I've enhanced the daemon that we use right now with a rate limiter. It's only a few lines of code, if you want to take a look at it go to ftp://ftp.suse.com/pub/people/draht/7.0/, get the source rpm and take a look at the patch there, called something like "bwlimit". At full load with currently 650 users the server's (a single processor machine) load is below 1.0, the machine is 75% idle after 14 days of rock solid uptime. Regards, Roman. -- - - | Roman Drahtmüller "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

Morsal Roudbay

16:42

New subject: [suse-security] FTP daemons

Hello Roman, I cant really remember when I read it but there were actually several sources. I guess things can change fast. :-) Nice of you to point out all this and I take your word. Right now I use ProFTPd and it's been working well but my load is around 6 connections, nothing compared to the SuSE ftp server. My server has been running very smoothly (SuSE 7.0) and has now been up for 62 days straight. I will try out the latest wu-ftpd tarball next week and see how that goes, but for me security comes first, not performance. I was wondering, would it be more secure to use qmail for my SMTP server or is sendmail ok? Again I read from several sources so it's hard to tell which one is right, I'm sure u understand what I mean. :) /Morsal ----- Original Message ----- From: "Roman Drahtmueller" To: "Morsal Roudbay" Cc: Sent: Wednesday, April 04, 2001 5:35 PM Subject: Re: [suse-security] FTP daemons On Wed, 4 Apr 2001, Morsal Roudbay wrote:

...

From: Morsal Roudbay To: Gerd Bitzer , Roman Drahtmueller Cc: suse-security@suse.com Date: Wed, 4 Apr 2001 14:58:53 +0200 Subject: Re: [suse-security] FTP daemons

Hi Morsal,

...

Thanks for your opinion Gerd. I was actually also thinking that Wu-FTPd would have many security holes considering it's dark history. I personally use ProFTPd and I read it's supposed to be one of the most secure.

Pascal J. Bourguignon

19:07

New subject: [suse-security] FTP daemons

"Morsal Roudbay" wrote:

...

[...] I was wondering, would it be more secure to use qmail for my SMTP server or is sendmail ok? Again I read from several sources so it's hard to tell which one is right, I'm sure u understand what I mean. :)

Have a look at postfix (http://www.postfix.org). Probably the most secure of them three. -- __Pascal_Bourguignon__ (o_ Software patents are endangering () ASCII ribbon against html email //\ the computer industry all around /\ and Microsoft attachments. V_/ the world http://lpf.ai.mit.edu/ 1962:DO20I=1.100 2001:my($f)=`fortune`; http://petition.eurolinux.org/

Jason P. Stanford

20:32

New subject: [suse-security] FTP daemons

I wouldn't agree that Postfix is more secure than Qmail. In fact, Mr. Bernstein (the creator of qmail has a bit about just that on his web site at http://cr.yp.to/qmail/warfield.html). I originally ran sendmail, then switched to postfix. It was nice, I personally had no problems with it and found it quite simple to set up and maintain (my uses are not that complex). When I went to implement the ArsDigita Community System (http://www.arsdigita.com/products), the recommended the use of qmail, esp. to use their webmail package. So I switched. Qmail may be slightly more complex than Postfix to set up, but I have found it to be extremely stable, and I have not found any documented evidence of any security problems. You may read over the http://cr.yp.to web site at bit. --- "Pascal J. Bourguignon" wrote:

...

"Morsal Roudbay" wrote:

...
[...] I was wondering, would it be more secure to use qmail for my SMTP server or is sendmail ok? Again I read from several sources so it's hard to tell which one is right, I'm sure u understand what I mean. :)

Have a look at postfix (http://www.postfix.org). Probably the most secure of them three.

-- __Pascal_Bourguignon__ (o_ Software patents are endangering () ASCII ribbon against html email //\ the computer industry all around /\ and Microsoft attachments. V_/ the world http://lpf.ai.mit.edu/ 1962:DO20I=1.100 2001:my($f)=`fortune`; http://petition.eurolinux.org/

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

__________________________________________________ Do You Yahoo!? Get email at your own domain with Yahoo! Mail. http://personal.mail.yahoo.com/

rise

22:05

New subject: [suse-security] FTP daemons

On Wed, 4 Apr 2001, Jason P. Stanford wrote:

...

I wouldn't agree that Postfix is more secure than Qmail. In fact, Mr. Bernstein (the creator of qmail has a bit about just that on his web site at http://cr.yp.to/qmail/warfield.html).

Please note that despite Mr. Bernstein's coding skills his paranoia and reliance on personal attacks instead of logic make him a less then trustworthy reviewer of other people's work. Qmail may or may not be more secure than Postfix, but I wouldn't trust his opinion on the topic as far as I could throw the printed copies of all the mail the two packages have delivered - he's simply incapable of being fair on this topic. Both Postfix and Qmail are currently thought to be secure, both are good choices for an SMTP server regardless of what Mr. Bernstein would like to believe. Jonathan Conway rise@knavery.net

marsaro＠interearth.com

22:27

New subject: [suse-security] FTP daemons

And Sendmail is insecure or is that the _thought_? Regards, Jon On Wed, 4 Apr 2001, rise wrote:

...

On Wed, 4 Apr 2001, Jason P. Stanford wrote:

...
I wouldn't agree that Postfix is more secure than Qmail. In fact, Mr. Bernstein (the creator of qmail has a bit about just that on his web site at http://cr.yp.to/qmail/warfield.html).

Please note that despite Mr. Bernstein's coding skills his paranoia and reliance on personal attacks instead of logic make him a less then trustworthy reviewer of other people's work. Qmail may or may not be more secure than Postfix, but I wouldn't trust his opinion on the topic as far as I could throw the printed copies of all the mail the two packages have delivered - he's simply incapable of being fair on this topic. Both Postfix and Qmail are currently thought to be secure, both are good choices for an SMTP server regardless of what Mr. Bernstein would like to believe.

Jonathan Conway rise@knavery.net

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

rise

22:59

New subject: [suse-security] FTP daemons

On Wed, 4 Apr 2001 marsaro@interearth.com wrote:

...

And Sendmail is insecure or is that the _thought_?

Actually I run sendmail and believe it to be reasonably secure. Since the message I replied to was in regards to Qmail vs. Postfix I only addressed that issue. At this point I recommend Postfix to friends who're setting up a low volume/low maintanence mail server and lack experience with any of the three - mainly for it's ease of use. I run sendmail because I have more experience with it, it's better integrated into SuSE 7.0, and I happen to like Turing-complete configuration languages*. Of course I also thought it was fun to implement a Turing machine in T-SQL so my view of reality is known to be skewed. Jonathan Conway rise@knavery.net * For all I know Postfix and Qmail also have Turing-complete configuration - it just doesn't look like it to a cursory inspection.

marsaro＠interearth.com

23:26

New subject: [suse-security] FTP daemons

Yes, I felt that Sendmail too was difficult to setup but then just learned it and with m4 macros, come on, it is really easy. Simple uses at home/small server, yes, SuSE has all that in Yast and this just sets the m4's anyway. The new Sendmail 8.11 really has feature for large scale.....but hey...I am using PostFIX too...just thought that there is an awful lot of Sendmail bad vibes.... Regards, Jon On Wed, 4 Apr 2001, rise wrote:

...

On Wed, 4 Apr 2001 marsaro@interearth.com wrote:

...
And Sendmail is insecure or is that the _thought_?

Actually I run sendmail and believe it to be reasonably secure. Since the message I replied to was in regards to Qmail vs. Postfix I only addressed that issue. At this point I recommend Postfix to friends who're setting up a low volume/low maintanence mail server and lack experience with any of the three - mainly for it's ease of use. I run sendmail because I have more experience with it, it's better integrated into SuSE 7.0, and I happen to like Turing-complete configuration languages*. Of course I also thought it was fun to implement a Turing machine in T-SQL so my view of reality is known to be skewed.

Jonathan Conway rise@knavery.net

* For all I know Postfix and Qmail also have Turing-complete configuration - it just doesn't look like it to a cursory inspection.

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Pascal J. Bourguignon

5 Apr 5 Apr

04:27

New subject: [suse-security] FTP daemons

"Jason P. Stanford" wrote:

...

I wouldn't agree that Postfix is more secure than Qmail. In fact, Mr. Bernstein (the creator of qmail has a bit about just that on his web site at http://cr.yp.to/qmail/warfield.html).

I originally ran sendmail, then switched to postfix. It was nice, I personally had no problems with it and found it quite simple to set up and maintain (my uses are not that complex). When I went to implement the ArsDigita Community System (http://www.arsdigita.com/products), the recommended the use of qmail, esp. to use their webmail package. So I switched. Qmail may be slightly more complex than Postfix to set up, but I have found it to be extremely stable, and I have not found any documented evidence of any security problems. You may read over the http://cr.yp.to web site at bit.

Thank you for the pointers. An objective comparison of the current state of these MTA is probably in order.

...

--- "Pascal J. Bourguignon" wrote:

...
"Morsal Roudbay" wrote:

...
[...] I was wondering, would it be more secure to use qmail for my SMTP server or is sendmail ok? Again I read from several sources so it's hard to tell which one is right, I'm sure u understand what I mean. :)

Have a look at postfix (http://www.postfix.org). Probably the most secure of them three.

-- __Pascal_Bourguignon__ (o_ Software patents are endangering () ASCII ribbon against html email //\ the computer industry all around /\ and Microsoft attachments. V_/ the world http://lpf.ai.mit.edu/ 1962:DO20I=1.100 2001:my($f)=`fortune`; http://petition.eurolinux.org/

Ralf Koch

4 Apr 4 Apr

20:37

New subject: [suse-security] FTP daemons

Hi Pascal, I know we had the discossion some times ago. Do you know anything about actual (!) security flaws of sendmail? And if not - why should postfix be more secure? (See discussion of "secure" FTP daemons) Regards Ralf

...

"Morsal Roudbay" wrote:

...
[...] I was wondering, would it be more secure to use qmail for my SMTP server or is sendmail ok? Again I read from several sources so it's hard to tell which one is right, I'm sure u understand what I mean. :)

Have a look at postfix (http://www.postfix.org). Probably the most secure of them three.

-- __Pascal_Bourguignon__ (o_ Software patents are endangering () ASCII ribbon against html email //\ the computer industry all around /\ and Microsoft attachments. V_/ the world http://lpf.ai.mit.edu/ 1962:DO20I=1.100 2001:my($f)=`fortune`; http://petition.eurolinux.org/

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

* * Ralf 'coko' Koch * mailto:info@formel4.de * --- Gute Nachricht: Windows 2000 ist 100% kompatibel. Die weltweit besten Forscher suchen nur noch, womit.

marsaro＠interearth.com

20:08

New subject: [suse-security] FTP daemons

Hi, My 2cents....it is true Sendmail (like others) had security fixes in the past....but I would say the product is the most extensible mailer out there...in fact the features on 8.11 are incredible IMHO....have a good look at sendmail.org. If you are doing very high volume and need multi-queues....crypto and stuff Sendmail has all this and the large install base keeps the theme of opensource pays for security accountability. Regards, Jon On Wed, 4 Apr 2001, Ralf Koch wrote:

...

Hi Pascal,

I know we had the discossion some times ago. Do you know anything about actual (!) security flaws of sendmail? And if not - why should postfix be more secure? (See discussion of "secure" FTP daemons)

Regards

Ralf

...
"Morsal Roudbay" wrote:

...
[...] I was wondering, would it be more secure to use qmail for my SMTP server or is sendmail ok? Again I read from several sources so it's hard to tell which one is right, I'm sure u understand what I mean. :)

Have a look at postfix (http://www.postfix.org). Probably the most secure of them three.

-- __Pascal_Bourguignon__ (o_ Software patents are endangering () ASCII ribbon against html email //\ the computer industry all around /\ and Microsoft attachments. V_/ the world http://lpf.ai.mit.edu/ 1962:DO20I=1.100 2001:my($f)=`fortune`; http://petition.eurolinux.org/

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

* * Ralf 'coko' Koch * mailto:info@formel4.de * --- Gute Nachricht: Windows 2000 ist 100% kompatibel. Die weltweit besten Forscher suchen nur noch, womit.

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Pascal J. Bourguignon

5 Apr 5 Apr

04:19

New subject: [suse-security] FTP daemons

Ralf Koch wrote:

...

I know we had the discossion some times ago. Do you know anything about actual (!) security flaws of sendmail? And if not - why should postfix be more secure? (See discussion of "secure" FTP daemons)

Well, I'm not up to date with the latest releases of sendmail (when I left it for postfix, two years ago, a buffer-overflow bug had been discovered in its then current version), but while the probability to encounter a buffer-overflow bug in general C software such as sendmail is quite high (2/3 ?), postfix has been programmed from the start with special considerations to all these kind of security-related problems, and while I've only browsed lightly the code of postfix, it's programmed in a way that make the probability of one of these dreadfull buffer overflow bug very low. The fact that it's very modula, with several subprocesses, neither of them running as root (postfix would refuse to run as root), implies that if ever there should be a problem, it would be confined to a small part of postfix. Each processes (and even some internal functions) do constantly validate the data it gets from the other parts of postfix or from the exterior world. -- __Pascal_Bourguignon__ (o_ Software patents are endangering () ASCII ribbon against html email //\ the computer industry all around /\ and Microsoft attachments. V_/ the world http://lpf.ai.mit.edu/ 1962:DO20I=1.100 2001:my($f)=`fortune`; http://petition.eurolinux.org/

David Benfell

9 Apr 9 Apr

22:17

New subject: MTAs

On Wed, Apr 04, 2001 at 09:37:52PM +0100, Ralf Koch wrote:

...

Hi Pascal,

I know we had the discossion some times ago. Do you know anything about actual (!) security flaws of sendmail? And if not - why should postfix be more secure? (See discussion of "secure" FTP daemons)

No, probably there aren't any actual known sendmail security problems with the most recent versions. There was a serious effort to clean up the code and it might actually be secure now. But, it is a large, complicated program with a lengthy and lousy security history. And it runs as root. These are all bad signs. There's simply no way to know when a given fix will be the last one needed, so if, as I suspect, you're insisting on hard evidence, you're not going to find it until it's too late, i.e. an exploit has been found. It has often been the case that the security history of a program has been useful in predicting the likelihood of future security problems. BIND-8 is a classic example. On the other hand, Dan Bernstein puts his money where his mouth is, offering a $500 reward to anyone who can find a vulnerability in qmail (or djbdns). To my knowledge, this has never been collected. I find this very comforting. -- David Benfell benfell@parts-unknown.org --- SuSE, qmail, ezmlm, and much much more... Hire me!

Roman Drahtmueller

5 Apr 5 Apr

10:05

New subject: [suse-security] FTP daemons

...

Hello Roman, I cant really remember when I read it but there were actually several sources. I guess things can change fast. :-)

Nice of you to point out all this and I take your word. Right now I use ProFTPd and it's been working well but my load is around 6 connections, nothing compared to the SuSE ftp server. My server has been running very smoothly (SuSE 7.0) and has now been up for 62 days straight. I will try out the latest wu-ftpd tarball next week and see how that goes, but for me security comes first, not performance.

Well, 6 is nothing... :-) 600 is mid-range, and you notice the overhead at around 60-100, depending on your hardware. Basically, I find that a PII-350 should do the job sufficiently, provided that there's enough RAM (384-1G) and disks with extremely fast seek times. Just as a reminder: in the SuSE package, the /usr/sbin/wu.ftpd is the old one, _not_ the 2.6 version. I'm not really sure if I can (security-wise) recommend the 2.6 version...

...

I was wondering, would it be more secure to use qmail for my SMTP server or is sendmail ok? Again I read from several sources so it's hard to tell which one is right, I'm sure u understand what I mean. :)

/Morsal We should open a different thread.

Roman. -- - - | Roman Drahtmüller "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

Gerd Bitzer

11:20

New subject: [suse-security] FTP daemons

Hello Roman, do you (or anybody else in this list) know what kind of ftp Serversoftware is running on ftp.cdrom.com ? It's told that this site is the biggest ftp Server worldwide (3000 simultan connections on a machine with one CPU) Gerd Roman Drahtmueller wrote:

...

...
Hello Roman, I cant really remember when I read it but there were actually several sources. I guess things can change fast. :-)

Nice of you to point out all this and I take your word. Right now I use ProFTPd and it's been working well but my load is around 6 connections, nothing compared to the SuSE ftp server. My server has been running very smoothly (SuSE 7.0) and has now been up for 62 days straight. I will try out the latest wu-ftpd tarball next week and see how that goes, but for me security comes first, not performance.

Well, 6 is nothing... :-) 600 is mid-range, and you notice the overhead at around 60-100, depending on your hardware. Basically, I find that a PII-350 should do the job sufficiently, provided that there's enough RAM (384-1G) and disks with extremely fast seek times.

Just as a reminder: in the SuSE package, the /usr/sbin/wu.ftpd is the old one, _not_ the 2.6 version. I'm not really sure if I can (security-wise) recommend the 2.6 version...

...
I was wondering, would it be more secure to use qmail for my SMTP server or is sendmail ok? Again I read from several sources so it's hard to tell which one is right, I'm sure u understand what I mean. :)

/Morsal We should open a different thread.

Roman. -- - - | Roman Drahtmüller "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Morsal Roudbay

11:36

New subject: [suse-security] FTP daemons

...

Hello Roman,

do you (or anybody else in this list) know what kind of ftp Serversoftware is running on ftp.cdrom.com ? It's told that this site is the biggest ftp Server worldwide (3000 simultan connections on a machine with one CPU)

Gerd

Roman Drahtmueller wrote:

...
...
Hello Roman, I cant really remember when I read it but there were actually several sources. I guess things can change fast. :-)

Nice of you to point out all this and I take your word. Right now I use ProFTPd and it's been working well but my load is around 6 connections, nothing compared to the SuSE ftp server. My server has been running very smoothly (SuSE 7.0) and has now been up for 62 days straight. I will

...

...
...
the latest wu-ftpd tarball next week and see how that goes, but for me security comes first, not performance.

Well, 6 is nothing... :-) 600 is mid-range, and you notice the overhead at around 60-100, depending on your hardware. Basically, I find that a PII-350 should do the job sufficiently, provided that there's enough RAM (384-1G) and disks with extremely fast seek times.

Just as a reminder: in the SuSE package, the /usr/sbin/wu.ftpd is the

I dont know which software they run but when it comes to hardware they use Intel NICs. :) ----- Original Message ----- From: "Gerd Bitzer" To: "Roman Drahtmueller" Cc: "Morsal Roudbay" ; Sent: Thursday, April 05, 2001 1:20 PM Subject: Re: [suse-security] FTP daemons try out old

...

...
one, _not_ the 2.6 version. I'm not really sure if I can (security-wise) recommend the 2.6 version...

...
I was wondering, would it be more secure to use qmail for my SMTP server or is sendmail ok? Again I read from several sources so it's hard to tell which one is right, I'm sure u understand what I mean. :)

/Morsal We should open a different thread.

Roman. -- - - | Roman Drahtmüller "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

Steffen Moser

12:38

New subject: [suse-security] FTP daemons

Hello, Gerd Bitzer wrote:

...

do you (or anybody else in this list) know what kind of ftp Serversoftware is running on ftp.cdrom.com ?

The server "ftp.cdrom.com" announces itself as: | Connected to 216.17.74.242. | 220 wcarchive.cdrom.com FTP server (Version DG-4.1.73 983302105) | ready. | Name (ftp.cdrom.com:steffen): ftp | 331 Guest login ok, send your email address as password. | Password: | 230-Welcome to ftp.cdrom.com, a service of Digital River, Inc. | 230-There are currently 546 users out of 3000 possible. | 230- | 230-This machine is a Xeon/500 with 4GB of memory & 1/2 terabyte of | RAID 5. | 230-The operating system is FreeBSD. Should you wish to get your own | copy of | 230-FreeBSD, please visit http://www.freebsd.org for more | information. "DG-4.1.73" seems to be a special "ftp-daemon" made by David Greenman which is AFAIK not released to the public. You can find further information here: http://www.bsdtoday.com/2000/October/News296.html Best regards, Steffen

8420

Age (days ago)

8426

Last active (days ago)

List overview

Download

29 comments

16 participants

participants (16)

Anibal Vasquez
Bjoern Engels
David Benfell
Gerd Bitzer
Jason P. Stanford
Kurt Seifried
marsaro＠interearth.com
Morsal Roudbay
Pascal J. Bourguignon
Rainer Link
Ralf Koch
rise
Roman Drahtmueller
Steffen Moser
Thomas Michael Wanka
Yuri Robbers

FTP daemons

Morsal Roudbay

Roman Drahtmueller

Gerd Bitzer

Kurt Seifried

Morsal Roudbay

Rainer Link

Bjoern Engels

Anibal Vasquez

Bjoern Engels

Thomas Michael Wanka

Yuri Robbers

Morsal Roudbay

Gerd Bitzer

Roman Drahtmueller

Morsal Roudbay

Pascal J. Bourguignon

Jason P. Stanford

rise

marsaro＠interearth.com

rise

marsaro＠interearth.com

Pascal J. Bourguignon

Ralf Koch

marsaro＠interearth.com

Pascal J. Bourguignon

David Benfell

Roman Drahtmueller

Gerd Bitzer

Morsal Roudbay

Steffen Moser

tags

participants (16)