Very Computer

by **Doc Sawbone** » Fri, 01 Sep 2000 14:15:15

One-year newbie Solaris admin here. (And four yrs Linux experience extra,
does
that count extra credit?)

Management thinks they want an internet ftp server for the company.
Whatever,
they're mgt, and 'I serve at their pleasure'.. and paycheck. My questions:

1). why use a package like ProFTP or WU-ftp, instead of Solaris 2.6 ftp,
which
seems to me easy enough to use and cfg? (I'd ask them why, but that'd be
interpreted
as 'a bad thing'.)
2). which FTP is 'better'? I've heard of WU-ftp security holes, but am not
familiar
with Pro-FTP problems.
3). is there a better way to go?

I'm guessing this is for external customer browser convenience, which will
make me
RTFMs soon enough, yet any other comments, suggestions, or insights would be
appreciated. Thank you.

-fgz
(name alias and bogus email adrs to protect the guilty.)

by **Timothy J. L** » Fri, 01 Sep 2000 14:42:24

>Management thinks they want an internet ftp server for the company.
>Whatever,
>they're mgt, and 'I serve at their pleasure'.. and paycheck. My questions:

>1). why use a package like ProFTP or WU-ftp, instead of Solaris 2.6 ftp,
>which
>seems to me easy enough to use and cfg? (I'd ask them why, but that'd be
>interpreted
>as 'a bad thing'.)

They may have more logging options or more capabilities which can
be of use if you are allowing uploads (e.g. uploaded files can be
made not readable for downloading in order to prevent an ftp server
from being used as a trading post for unauthorized copies of copyrighted
software). The downside is more complexity, which can mean more
places for security bugs to hide.

If you only need anonymous read-only ftp, there are some ftp servers
like publicfile at http://cr.yp.to that may be of interest from a
security standpoint.

Of course, any computer exposed to the outside world needs added
security, since Solaris defaults are mostly appropriate for a
friendly local network. Turning off unneeded network services and
unneeded setuid bits, installing security patches, and installing
a local firewall like IP Filter or SunScreen Lite are among the things
to consider.

--
------------------------------------------------------------------------
Timothy J. Lee
Unsolicited bulk or commercial email is not welcome.
No warranty of any kind is provided with this message.

by **Martin Hepwort** » Fri, 01 Sep 2000 17:30:48

> One-year newbie Solaris admin here. (And four yrs Linux experience extra,
> does
> that count extra credit?)

> Management thinks they want an internet ftp server for the company.
> Whatever,
> they're mgt, and 'I serve at their pleasure'.. and paycheck. My questions:

> 1). why use a package like ProFTP or WU-ftp, instead of Solaris 2.6 ftp,
> which
> seems to me easy enough to use and cfg? (I'd ask them why, but that'd be
> interpreted
> as 'a bad thing'.)
> 2). which FTP is 'better'? I've heard of WU-ftp security holes, but am not
> familiar
> with Pro-FTP problems.
> 3). is there a better way to go?

> I'm guessing this is for external customer browser convenience, which will
> make me
> RTFMs soon enough, yet any other comments, suggestions, or insights would be
> appreciated. Thank you.

> -fgz
> (name alias and bogus email adrs to protect the guilty.)

Hi

depends what you want -

wu-ftpd has great logging (audit) features as well as chroot for 'real'
users, but its relative;y difficult to setup. (yes its has a history of
insecurity, but they are always closed quickly).

pro-ftpd has a nice easy setup, chroot for real or virtual users, but
also suffers from holes - again fised quickly

solaris ftpd - very few features, non-annoymous chroot is possible
(just, but very klunky to setup), hardly any logging (auditing).

The world's busiest ftp site (ftp.cdrom.com) runns off a modified
wu-ftpd. But I prefer pro-ftpd as its easier to setup.

Martin

by **Philip Bro** » Sat, 02 Sep 2000 06:17:10

>One-year newbie Solaris admin here. (And four yrs Linux experience extra,
>does
>that count extra credit?)

>Management thinks they want an internet ftp server for the company.
>Whatever,
>they're mgt, and 'I serve at their pleasure'.. and paycheck. My questions:

>1). why use a package like ProFTP or WU-ftp, instead of Solaris 2.6 ftp,
>...

you havent stated the requirements.
If there are no requirements beyond "an ftp server", then there's no reason
to install any third party server.

--
[Trim the no-bots from my address to reply to me by email!]
[ Do NOT email-CC me on posts. Pick one or the other.]

The word of the day is mispergitude

Very Computer

Solaris ftp v Pro-ftp v WU-ftp

Solaris ftp v Pro-ftp v WU-ftp

Solaris ftp v Pro-ftp v WU-ftp

Solaris ftp v Pro-ftp v WU-ftp

Solaris ftp v Pro-ftp v WU-ftp