From owner-freebsd-security Tue Dec 2 07:26:21 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id HAA07198 for security-outgoing; Tue, 2 Dec 1997 07:26:21 -0800 (PST) (envelope-from owner-freebsd-security) Received: from fledge.watson.org (root@FLEDGE.RES.CMU.EDU [128.2.91.116]) by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id HAA07193 for ; Tue, 2 Dec 1997 07:26:16 -0800 (PST) (envelope-from robert@cyrus.watson.org) Received: from cyrus.watson.org (cyrus.pr.watson.org [192.0.2.4]) by fledge.watson.org (8.8.8/8.6.10) with SMTP id KAA07153 for ; Tue, 2 Dec 1997 10:26:10 -0500 (EST) Date: Tue, 2 Dec 1997 10:26:31 -0500 (EST) From: Robert Watson Reply-To: Robert Watson To: security@FreeBSD.ORG Subject: Re: Possible problem with ftpd 6.00 In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk On Tue, 2 Dec 1997, Petri Riihikallio wrote: > Simon Shapiro wrote: > > >if ( strncmp(login, "ftp, MAX_LOGIN) && > > strncmp(login "anonymous", MAX_LOGIN) ) { > > printf("Password; ") > >} else { > > printf("Your E-Mail Address, please "); > >} > > If you make this kind of change you will break all the graphical clients > which expect "Password:". > > The prompt should be "Use E-Mail Address as Password:". Forgive me, but I am unclear on why the current arrangement is unsatisfactory? % uname -a FreeBSD fledge.watson.org 2.2.5-STABLE FreeBSD 2.2.5-STABLE #0: Mon Dec 1 23:15:18 EST 1997 robert@fledge.watson.org:/home/src/sys/compile/FLEDGE i386 % ftp fledge Connected to fledge.watson.org. 220- Welcome the fledge.watson.org! 220 fledge.watson.org FTP server (Version 6.00) ready. Name (fledge:robert): ftp 331 Guest login ok, send your email address as password. Password: The notice clearly states that one should send ones email address as the password. One of the caveats of having network capability is that users must know when (and when not) to give their passwords. If you cannot trust them to not enter their password when connecting to a remote system using FTP, you really should not be even allowing them near a UNIX account that has network access of any kind. Education is more important here, I think, than making changes that may break existing programs. Robert N Watson Junior, Logic+Computation, Carnegie Mellon University http://www.cmu.edu/ Network Administrator, SafePort Network Services http://www.safeport.com/ robert@fledge.watson.org rwatson@safeport.com http://www.watson.org/~robert/