[ftpext] Fwd: Re: ftpext2 review of FTP HOST command?

[Tony Hansen <[e-mail]>]

I received the following review this weekend about the HOST command draft.

     Tony

-------- Original Message --------
Subject: 	Re: ftpext2 review of FTP HOST command?
From: 	Patrik Fältström


I have had a look at the draft, and some of the comments are general that I presume you have looked at.

In no specific order:

1. Denial of service attack

What is people try to do a dictionary attack by repeated HOST commands before the authentication?

I think the server should have the right to "just say no" after a number of failed HOST or failed combinations of host/authentication tries.

2. HOST command required

The text says this:

>     A server-PI that receives a USER command to begin the authentication
>     sequence without having received a HOST command SHOULD NOT reject the
>     USER command.

Is SHOULD NOT good enough?

Should there not be a specific error code if the HOST command is required?

Or should there be always failed authentication if a virtual host is not given?

Hmm...I am thinking of what the situation might look like many years from now. I do not think the HTTP/1.1 solution is good enough where there is a default host that normally is either crap, or worse, disclose data that give hints on low security in the host.

So, is it not better to say for example:

A server-PI that receives a USER command to begin the authentication sequence without having received a HOST command must either reject the USER command with error code XXX or treat the authentication as if the user authenticates towards a default host or the union of all virtual hosts.

3. Syntax of hostname

Is this really correct?

domain        = sub-domain *("." sub-domain)

Should it not be

domain        = sub-domain 1*("." sub-domain)

If my memory of abnf does not fail me, i.e. at least two domain name parts?

4. IDN

Suggestion, replace:

Internationalization of domain names is only supported through the
use of Punycode as described in [RFC3492].

With

Internationalization of domain names is only supported through the use of an A-label as defined in [RFCXXXX] as the hostname parameter.

5. HOST command after authentication

The text says this:

>     As discussed in section 3 of this document, if a HOST command is sent
>     after a user has been authenticated, the server MUST treat the
>     situation as an invalid sequence of commands and return a 503 reply.

Is there no command where the user can return to an unauthenticated state, but still be connected to the host? If so, I think it should be possible to give the HOST command there. So the key is that the HOST command is only allowed in a non-authenticated state, right?


Hope this helps...

    Patrik