Fetch Softworks

Incorrect WARNING when using s/key (4 posts)

• Started 22 years ago by seiz
• Latest reply 22 years ago from Jim Matthews

• seiz Member

  Hi,
  i managed to compile s/key support for wu-ftpd on macOS X Server 1.2.

  The FTP Server sends the challenge correctly and FETCH does also respond correctly - everything works nice EXCEPT:
  I set Preferences->Security to:
  "Warn before sending password insecurely" so i get a warning in case my server doesn't send any challenge or i mix up servers.
  BUT the resulting WARNING MESSAGE ("if you do not disconnect, your password...") IS ALWAYS displayed when i log in to my server - even if it presents a challenge...
  This is quite annoying. Or did i misunderstand the purpose of the warning and it was meant to always be displayed???

  Thanks
  Stefan

  Posted 22 years ago #

• Jim Matthews Administrator

  Could you post the contents of the Fetch Transcript window? Fetch is not supposed to put up that warning when you're responding to an S/Key challenge, so I'd like to figure out why it is in your case.

  Thanks,

  Jim Matthews
  Fetch Softworks

  Posted 22 years ago #

• seiz Member

  Originally posted by JimMatthews:

  Could you post the contents of the Fetch Transcript window? Fetch is not supposed to put up that warning when you're responding to an S/Key challenge, so I'd like to figure out why it is in your case.

  Here we go:
  System Version = 0x1010
  Connecting to server.dom port 21 (16.10.2001 22:24:34 Uhr)
  220 x FTP server (Version 1.2 (617) Mon Oct 15 19:15:14 CEST 2001) ready.
  USER myname
  331 s/key 92 x allowed for myname.
  Generated S/Key (MD4) Response: 741E4BF5FF4EB336
  PASS
  230 User myname logged in.
  SYST
  215 UNIX Type: L8 Version: BSD-199506
  PWD
  257 "/Local/Users/myname" is current directory.

  If you need, i can give ou a test account on my server as well.

  Stefan

  Posted 22 years ago #

• Jim Matthews Administrator

  Thanks for the transcript, and the original report. It turns out that there's a bug that keeps the code in question from working. I will fix it for a future release, but in the meantime the only workaround is to turn off that warning.

  Thanks again,

  Jim Matthews
  Fetch Softworks

  Posted 22 years ago #