[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: telnetd vulnerability from BUGTRAQ



On Mon, Sep 27, 2004 at 04:08:38PM -0400, Greg Folkert wrote:
> On Mon, 2004-09-27 at 09:24 +0200, Dariush Pietrzak wrote:
> > > > The point remains that while telnet/ftp should be treated as deprecated
> >  Why is that exactly?
> > There is no replacement for ftp, and I don't know of any problems with it?
> >  Please enlighten me.
> 
> ftp == good enough for public upload and download in a chroot
> environment.

Pure ftp isn't suitable for this.  MIM-attacks and data-corruption en
route.  There's no need for a chroot, though, as long as you're using a
sane ftpd.

> scp == the preferred method for data transfer between machines. Nearly
> as fast on semi-modern machines. pscp == the windows equivalent for
> regault *NIXX scp.

Unfortunately, scp requires a shell access, doesn't play well with
caching proxies, and is in fact quite resource-hungry.  But the main
objection is, ssh provides the presentation layer functionality on the
application layer.  Which is why you really should not preach it as a
panacea.

Cheers,
-- 
Jan

Attachment: pgpKURzKQ2Tqo.pgp
Description: PGP signature


Reply to: