Bugtraq: Re: ftpd: the advisory version

[djb () CR YP TO (D. J. Bernstein)]

Clients should not---and, as far as I know, do not---check the source
TCP port for active connections from the server. See

   http://cr.yp.to/ftp/security.html

for further comments on FTP protocol security issues.

Please note that publicfile isn't just for sites where ``all you need is
anonymous FTP.'' You can run publicfile as your anonymous FTP server,
and run a non-anonymous FTP server on another port or IP address. (Many
of wuftpd's security holes have required the attacker to log in first.)

Similarly, you can use publicfile for static HTTP files, and another
server for dynamic HTTP files.

---Dan