Dave Roberts wrote:
Niklas Gustavsson wrote:
Dave Roberts wrote:
Niklas Gustavsson wrote:
What would you all think of this, would it be useful?
Sounds useful to me. Sometimes it's the operator of the server that
wants to protect the data, and the client users don't care.
Enforcing this seems a good solution. Whilst there, it'd be useful
to enforce that SSL is running before the client sends the USER
command, to stop passwords being given away.
Since the USER command is sent on the control socket, you can already
enforce this using implicit SSL. Or, am I misunderstanding something=
That's true, I was thinking about ensuring both the USER/PASS and
the data connections were secured.
If a change is made to ensure that SSL is in place for the data
channels only, then the user could end up doing a login in the
clear, resulting in the credentials being revealed.
I'm probably particular thick today :-) Just to make sure I understand
what you mean. What you would like is to have an option that enforces a
client to send the AUTH command before USER/PASS, right? How would this
differ from setting up the listener to always use SSL on the control
socket (with implicit SSL)? If using imlicit SSL, the client would be
forced to, or it could not even get through the SSL handshake and
establish a socket connection.
/niklas
