[secdir] SECDIR review of draft-ietf-ftpext2-hosts-02

[<[e-mail]>]

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Summary:  The document requires more information in the security considerations section.

Section 3.2:

In terms of the types of changes that may be made, it does state 'more elaborate changes' may be made depending on the environment.  However, for security and the developers reading the specification, I think it would be best to include the high end of the spectrum here and include isolation as one of the explicitly stated examples as the scenario may be used in hosted environments.

Upon receiving the HOST command, before authenticating the user-PI, a
   server-FTP process SHOULD validate that the hostname given represents
   a valid virtual host for that server, and, if it is valid, establish
   the appropriate environment for that virtual host.  The resultant
   actions needed to create that environment are not specified here, and
   may range from doing nothing at all, to performing a simple change of
   working directory, to changing authentication schemes and/or username
   and password lists, to making much more elaborate state changes, as
   necessary.

Section 4: Security Considerations

Please replace the term Confidentiality where you have listed "integrity" in the opening sentence as the protection of privacy related information is described through confidentiality.  The integrity and confidentiality of the data on the servers are both potentially important, but this opening sentence is in context of login parameters.

The second paragraph does address the authentication between virtual hosts, which is good.  I think it is also important to ensure readers are aware of possible concerns with segregation or isolation of the virtual FTP environments.  If there are security concerns that may include different user bases on the same physical host or different levels (sensitivity) of information in different FTP hosts on the same server, the ability to have segregation of the environments will be important (this will happen).  How can segregation/isolation be provided in this model?  Please include information on the options here.  I am assuming that since we are talking about multiple hosts on a single IP, that we may be within a physical host or a virtual environment that has one IP address.  If this is the case, what security options are available - authentication, access controls, etc.?  Please include them in this section.






Thank you,
Kathleen