Niklas Gustavsson wrote: > What would you all think of this, would it be useful?
Sounds useful to me. Sometimes it's the operator of the server that wants to protect the data, and the client users don't care. Enforcing this seems a good solution. Whilst there, it'd be useful to enforce that SSL is running before the client sends the USER command, to stop passwords being given away. > What would be the > correct error code to send in the case where a client for example > sends a LIST and haven't done a PROT first? RFC 959 states that we could use 450 (Requested file action not taken) but that is a transient error, which the client could choose to try again without making any changes. So we want something in the 5xx range, of which the following are permitted: 500, 501, 502, 530. I would go for 501 (Syntax error in parameters or arguments) and change the message to (Syntax error, SSL must be used) or something similar. 501 can also be used as a return code for the USER command.
