Subject: 2.4.2 Beta 5: questions/comments

From: Mitch Wright <[email-masked]>
Date: Tue, 10 Oct 1995 23:25:34 -0700

Greetings all.  I've been watching the list for a while now and have pretty
much kept my input to private mail.  Anyway, I have some general comments
and/or questions...

1) The 2.4.2-beta5 has been around for a while now.  Is there active work
   going on to actually create a release?

2) Has anyone created an FAQ with regards to this new strain of ftp server?

3) A fellow generated a very nice patch to distribute the transfer logs.
   My apologies for not remembering who.  Has there been a new release
   of that patch sans the race condition?

Now for more of a comment... HOBBIT apparently contributed patches to
make the server SKey aware.  While I think this is a terrific idea, I
am curious as to why something more generalized was not patched in that
would support SKey and various security tokens.  Three things come to 
mind in this regard:

	a) Support to use the TIS auth server
	b) Support for RADIUS
	c) Support for TACACS+

Each of these has a reasonable programming interface for providing user
authentication.  I intend to implement "a" as well as either "b" or "c"
depending on which I'll have to support for other applications.

I have a couple of other enhancements I intend to implement in the near
future (assuming the funding goes through).  Allow me to take a moment
and explain what I have done, and where I think it should go.

A client of mine wanted to make available documents via FTP -- some are
to be public while others were to be for "members only" (if you will).
The easy thing to do was to make use of the "SITE GROUP" facility and
let members gain additional group access to get to private directories.
Well... since there were/are a large number of "members" and they needed
to accountable for their access as well as making it easy to halt access
upon membership termination I extended the "GROUP" concept and had them
create a seperate group per member, each with it's own password.  Simple
enough (again), but there is a nasty problem with "SITE GROUP" or more
precisely "SITE GPASS" in that the text is not just plain text over the
net, but is echoed back when typed.  So I pulled out my trusty keyboard
again and added what I now consider an ugly hack.  The user logs in
anonymously as in all other cases, but when they want to "increase" their
privledge they issue the "ACCT" command with a specific account code. Given
the correct (and universal) account code, they are notified to issue a new
"USER" command, but this time using their "GROUP" id.  At this point they
are prompted for their group password with the standard non-echo'ing prompt
and all is well.  This has been in operation for a couple years now and
hindsight points out several flaws and some much needed features.  

There are two particularly bad side effects from all of this.  The first is
that users can't seem to follow instructions are are constantly trying to
use their group/member id as the login id.  The second and much more 
annoying is that many FTP clients do not seem to support things like QUOTE
or are so fixed that you can't issue commands.  Netcruiser comes to mind.
The other obvious miss is that web browsers can't deal with the extra
interaction.

Now is where I would appreciate some feedback.  Given some hindsight, I
think what I *should* have done is allowed the "normal" login trigger
not just anonymous user access, but access with extended privledge based
on the id given to gain access.  More simply stated, if the user logs
in as "ftp" and gives something worthwhile as a password everything is
normal.  Now if they prefix their login id with a '+' for example, the
server would assume anonymous access in the "normal" mode, but use the
characters after the '+' as a key into the group access file and the
password required would be.... [drum roll please] the GPASS.

Before you ask, let me answer the most common question I've heard when
I mentioned this thing two years ago.

	Q: Why not just have seperate ftp guest accounts?
	A: The folks maintaining the "member" accounts don't have
	   the access to muck with the password file -- and for
	   good reason.  As a matter of fact, they update it via
	   an E-mail interface.

The one feature that would be particularly useful is the ability to be
added to several groups rather than just one.  This is very applicable
to the "standard" mode as well.

Sooo.... after such a long winded post, I'd be glad to continue discussion
on any of the things I have mentioned.  If I've overlooked something real
obvious, feel free to knock me over the head with it... It is quite possible
I have just made a typo or am not conveying my thoughts very well.

-- 
do svidaniya,

  ~mitch

---

From: Dave Alden <[email-masked]>
Date: Thu, 12 Oct 1995 10:58:51 -0400 (EDT)

Hi,
  I'm sorry to bother you, but I keep seeing references to "RADIUS" -- can you
point me in the right direction to get more information on it?
...thnx,
...dave alden

---

From: Mitch Wright <[email-masked]>
Date: Thu, 12 Oct 1995 09:56:37 -0700

/* Dave Alden [[email-masked]] writes: */

>point me in the right direction to get more information on it?
As a starting point go to ftp://ftp.livingston.com/  Read their white paper
on it and then go get the internet drafts it talks about.  Merit also has
a sample implementation, but I don't have the URL handy.  Probably under
their ftp area somewhere... :-)

-- 
do svidaniya,

  ~mitch