Re: [secdir] SECDIR review of draft-ietf-ftpext2-hosts-02

[Robert McMurray <[e-mail]>]

Thanks, Kathleen.

At the protocol level I am only concerned that the security environment is reset; how the environment is created and reset is implementation-specific. So my intention was to highlight as a security consideration that an implementer should be aware that they might have work to do in this scenario, but the details are up to them. With that in mind, what do you think of this rewording for that section?

"As discussed in section 3.3 of this document, a server implementation MAY treat a HOST command that was sent after a user has been authenticated as though a REIN command was sent. In this scenario, the server implementation SHOULD reset the authentication environment, as that would allow for segregation between the security environments for each virtual host on an FTP server. The implementation details for security environments may vary greatly based on the requirements of each server implementation and operating system, and those details are outside the scope of the protocol itself. For example, a virtual host "foo.example.com" on an FTP server might use a specific username and password list, while the virtual host "bar.example.com" on the same FTP server might use a different username and password list. In such a scenario, resetting the security environment is necessary for the virtual servers to appear to behave independently from a client perspective, while the actual server implementation details are irrelevant at the protocol level."

Thanks again!
Robert

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] 
Sent: Friday, June 24, 2011 4:53 PM
To: Robert McMurray; [e-mail]; [e-mail]; [e-mail]
Cc: [e-mail]; [e-mail]
Subject: RE: SECDIR review of draft-ietf-ftpext2-hosts-02

Hi, Robert.

Thank you for making the updates.  I think the change for section 3.2 looks good, thanks!

As for the security considerations, the ADs may have an opinion here as well.  My thought process is that if you are concerned about the environment that the user authenticates into, wouldn't the environment itself be a concern as well?  The authentication consideration is to ensure the user gets authenticated into the right environment.  If there is no segregation available between environments, that would be a security consideration.  If that varies between OSes, that would be a consideration as well.  You might not have to detail it out, but it should be stated as a consideration as this may not be a solution possible in a number of use cases.

Thank you,
Kathleen