+2004-11-03 Tom Yu <tlyu@mit.edu>
+
+ * ftpcmd.y (getline): Merge Athena change to reject MICed
+ password.
+
+ * ftpd.M: Document '-E'.
+
+ * ftpd.c (main): Merge Athena's '-E' changes to prohibit
+ unencrypted passwords.
+
2004-09-22 Tom Yu <tlyu@mit.edu>
* Makefile.in (ftpd): Use UTIL_LIB.
extern int timeout;
extern int maxtimeout;
extern int pdata;
+extern int authlevel;
extern char hostname[], remotehost[];
extern char proctitle[];
extern char *globerr;
}
#endif /* GSSAPI */
/* Other auth types go here ... */
+
+ /* A password should never be MICed, but the CNS ftp
+ * client and the pre-6/98 Krb5 client did this if you
+ * authenticated but didn't encrypt.
+ */
+ if (authlevel && mic && !strncmp(s, "PASS", 4)) {
+ lreply(530, "There is a problem with your ftp client. Password refused.");
+ reply(530, "Enable encryption before logging in, or update your ftp program.");
+ *s = 0;
+ return s;
+ }
+
}
#if defined KRB5_KRB4_COMPAT || defined GSSAPI /* or other auth types */
else { /* !auth_type */
ftpd \- DARPA Internet File Transfer Protocol server
.SH SYNOPSIS
.B ftpd
-[\fB\-A \fP|\fB -a\fP] [\fB\-C\fP] [\fB\-c\fP] [\fB\-d\fP] [\fB\-l\fP]
-[\fB\-v\fP] [\fB\-T\fP \fImaxtimeout\fP] [\fB\-t\fP \fItimeout\fP]
+[\fB\-A \fP|\fB -a\fP] [\fB\-C\fP] [\fB\-c\fP] [\fB\-d\fP] [\fB-E\fP]
+[\fB\-l\fP] [\fB\-v\fP] [\fB\-T\fP \fImaxtimeout\fP] [\fB\-t\fP \fItimeout\fP]
[\fB\-p\fP \fIport\fP] [\fB\-U\fP \fIftpusers-file\fP] [\fB\-u\fP \fIumask\fP]
[\fB\-r\fP \fIrealm-file\fP] [\fB\-s\fP \fIsrvtab\fP]
[\fB\-w\fP{\fBip\fP|\fImaxhostlen\fP[\fB,\fP{\fBstriplocal\fP|\fBnostriplocal\fP}]}]
.B \-d
Debugging information is written to the syslog. (Identical to -v)
.TP
+.B \-E
+Don't allow passwords to be typed across unencrypted connections.
+.TP
.B \-l
Each
.IR ftp (1)
extern char *optarg;
extern int optopt;
#ifdef KRB5_KRB4_COMPAT
- char *option_string = "AaCcdlp:r:s:T:t:U:u:vw:";
+ char *option_string = "AaCcdElp:r:s:T:t:U:u:vw:";
#else /* !KRB5_KRB4_COMPAT */
- char *option_string = "AaCcdlp:r:T:t:U:u:vw:";
+ char *option_string = "AaCcdElp:r:T:t:U:u:vw:";
#endif /* KRB5_KRB4_COMPAT */
ftpusers = _PATH_FTPUSERS_DEFAULT;
debug = 1;
break;
+ case 'E':
+ if (!authlevel)
+ authlevel = AUTHLEVEL_AUTHENTICATE;
+ break;
+
case 'l':
logging ++;
break;