Comments on proftp vs. wuftp

[Jared Westgate_1]

Hello Everyone,

I'm considering installing proftpd on my HP-UX 11.0 system. I'm looking for a way to gain more control over who/when user are ftping to the system as well as what they can do when they get there. My impressions from reading about ftp security is that proftpd is more secure than wuftp. Am I correct in this?

Also, are there any hp-ux porting websites where I could find pre-compiled things like this. All I've been able to find on the proftp website is the source. I would prefer if I could get proftp or wuftp in a depot.

Thank you for all your help,

Jared

[James R. Ferguson]

Hi Jared:

As for porting centers, here's one:

http://hpux.cs.utah.edu/

With regard to comparing "proftpd" to "wuftp", I have no direct experience. However, the Washington University ftp is the basis of ftp as seen in HP-UX 11.x, for whatever that's worth to you.

...JRF...

[Mike Hassell · Accepted solution]

Jared,

I am running proftpd on my production servers and prefer it over the default wu-ftpd any day. As far as security is concerned, both ftp daemons have a few exploits. These have been corrected with patches, be sure to get the latest CVS updates to ensure you're up to date:

http://www.proftpd.org/cvs.html

You can download a precompiled version of proftpd here:

http://hpux.connect.org.uk/hppd/hpux/Networking/FTP/proftpd-1.2.0pre9/

I prefer to compile my own and run the latest versions, which can be found here:

ftp://ftp.proftpd.org/distrib/proftpd-1.2.1.tar.gz

The reason I swapped out wu-ftpd for proftpd is the extensive logging features that it offers as well as its ease of configuration. It does everything wu-ftpd does and adds more configurability. I also use webalizer which will take the default format from your typical xferlog and create very nice html output that managers just love. Be sure to take a look at it as well:

http://www.webalizer.com/

A precompiled version can be found here:

http://hpux.connect.org.uk/hppd/hpux/Networking/WWW/webalizer-2.01.05/

Hope that helps.

- Mike

[Ralf Hildebrandt]

Yep, WU_FTP is a piece of crap -- security wise. So if you decide to use it, be sure to ALWAYS run the latest version. That means, since the porting center always lags behind, that you'll have to build yourself.