[9front] ip/ftpd patch with tls support.

[9front] ip/ftpd patch with tls support.

[james palmer]

hello,

i have added support for ftps to ip/ftpd and tried to clean it up a bit.
old challenge response auth and noworld checks are gone.
if anybody misses these features i can add them and update the patch.

to use tls you will need to generate a certificate, add the key to factotum and
edit /rc/bin/service/tcp21 to have "-c <path to cert>" in the commandline.
if you want to use tls with anonymous login you will need to edit /lib/namespace.ftp
to not bind over the root.

patch is here:
http://okturing.com/src/10937/body

thanks,
- james

Re: [9front] ip/ftpd patch with tls support.

[Lyndon Nerenberg (VE7TFX/VE6BBM)]

james palmer writes:

> old challenge response auth and noworld checks are gone.
> if anybody misses these features i can add them and update the patch.

Can you be a bit more detailed about what this means?

--lyndon

Re: [9front] ip/ftpd patch with tls support.

[sirjofri]

Hey,

23.04.2021 23:29:59 Lyndon Nerenberg (VE7TFX/VE6BBM) <lyndon@orthanc.ca>:
> james palmer writes:
>> old challenge response auth and noworld checks are gone.
>> if anybody misses these features i can add them and update the patch.
>
> Can you be a bit more detailed about what this means?

I don't have the original mail, it seems, but the old challenge-response 
didn't work properly anyways. I tested the tool that generates the 
response from the challenge, and whatever challenge I entered, the 
response was always the same.

Is ftpd with tls support the same as ftps? Then I'd really love this 
patch applied soon (but stable), it would be a better replacement for 
cifsd. That said, I can also test things out and read the code.

sirjofri

Re: [9front] ip/ftpd patch with tls support.

[hiro]

why do you prefer ftp over cifs?

Re: [9front] ip/ftpd patch with tls support.

[Steve Simon]

ftp does not support seek, whereas cifs does.

reading the last block of a large file or, worse, tail -f can be very painful over ftp.

-Steve

Re: [9front] ip/ftpd patch with tls support.

[james palmer]

Quoth sirjofri+ml-9front@sirjofri.de
> I don't have the original mail, it seems, but the old challenge-response 
> didn't work properly anyways.

it worked fine for me. the code changes if a valid challenge is entered.

> Is ftpd with tls support the same as ftps? Then I'd really love this 
> patch applied soon (but stable), it would be a better replacement for 
> cifsd.

yes, this is ftps.
it supports both implicit ftps (over port 990) and
explicit ftps.

- james

Re: [9front] ip/ftpd patch with tls support.

[james palmer]

Quoth steve@quintile.net:
> 
> ftp does not support seek, whereas cifs does.
> 
> reading the last block of a large file or, worse, tail -f can be very 
> painful over ftp.
> 
> -Steve
> 
>

ftp can seek once using the rest command.
reading just the end of a file will work fine
if the client supports it.

Re: [9front] ip/ftpd patch with tls support.

[james palmer]

Quoth lyndon@orthanc.ca:
> james palmer writes:
> 
> > old challenge response auth and noworld checks are gone.
> > if anybody misses these features i can add them and update the patch.
> 
> Can you be a bit more detailed about what this means?
> 
> --lyndon
> 

the challenge response auth would give you a challenge to give to netkey, and you would type the response as the password. i removed this, you now log in with your regular password (only allowed over tls).

the noworld checks allowed users in the noworld group to login with their password, with a restricted set of permissions. the noworld group is id 9999 and does not exist by default on 9front.

Re: [9front] ip/ftpd patch with tls support.

[Lyndon Nerenberg (VE7TFX/VE6BBM)]

sirjofri writes:
> Is ftpd with tls support the same as ftps? Then I'd really love this 
> patch applied soon (but stable), it would be a better replacement for 
> cifsd. That said, I can also test things out and read the code.

No.  ftps just wraps the existing FTP conctions in TLS, the same
way https wraps http.  The other method is defined in RFC 4217; it
adds the AUTH TLS command which acts in a manner similar to SMTP's
STARTTLS, allowing you to upgrade the control connection from plain-
text to encrypted.

--lyndon

Re: [9front] ip/ftpd patch with tls support.

[james palmer]

Quoth lyndon@orthanc.ca:
> sirjofri writes:
> > Is ftpd with tls support the same as ftps? Then I'd really love this 
> > patch applied soon (but stable), it would be a better replacement for 
> > cifsd. That said, I can also test things out and read the code.
> 
> No.  ftps just wraps the existing FTP conctions in TLS, the same
> way https wraps http.  The other method is defined in RFC 4217; it
> adds the AUTH TLS command which acts in a manner similar to SMTP's
> STARTTLS, allowing you to upgrade the control connection from plain-
> text to encrypted.
> 
> --lyndon
>

this patch handles both methods of ftp with tls.

- james.