Re: OpenSSH/scp ->> F-Secure SSH server Problems

[Thor Lancelot Simon <tls%rek.tjls.com@localhost>]

On Mon, Mar 12, 2001 at 02:40:35PM +0100, Markus Friedl wrote:
> On Mon, Mar 12, 2001 at 08:31:48AM -0500, Jeffrey Altman wrote:
> > > In this case (i.e. in the case of wanting to "ftp" over SSH) the issue
> > > is with the stupid user interface.  Naive users are looking for some SSH
> > > file copying tool that works just like their FTP clients, i.e. where
> > > they can see a list of files on the server and click/drag/whatever them
> > > to effect the copy.
> > 
> > Why do you need to use FTP over SSH when FTP is "securable" using any
> > number of methods?  The most common methods are
> > 
> >   SSL/TLS
> > 
> >   GSSAPI 
> > 
> >   Kerberos
> > 
> >   SRP
> > 
> > 
> > When using any of these methods both the command and data channels
> > used by FTP are authenticated, encrypted and integrity checked.  In
> > other words, they are secure.  
> 
> so does SFTP. so what's the point?

I think the point is that the development of the SSH protocol has
involved a great deal of reinvention of wheels.  Some people think
that this is regrettable and wish that the SSH working group paid a
bit more attention to integration with other IETF protocols rather
than rampaging ahead inventing new ones.

I personally think that the SFTP protocol is a pretty gratuitous
addition; a whole lot of complexity, and it really doesn't buy you
much.  But then again, I think that reinventing most of what TLS
does for the SSHv2 transport layer instead of politely asking the
TLS folks for a record-oriented interface was rather silly, too.

We have those things now; there's not much point thinking about what
we _could_ have done.  However, it's a valid question to ask what the
point of implementing something like SFTP in _any particular 
implementation of other bits of the SSH suite_ is; I don't really think
that the "anonymous" bits of its function are well served by its design,
worse served, in fact, than by simply using FTP secured with TLS, GSSAPI,
or other standard methods, and it's massive overkill compared to the
simple BSD-rcp protocol used by the old "scp" application, when that's
going to be 99% of what it's used for in the real world, ISTM.

Ergo, a small, lightweight SSH implementation, even one that did v2,
might quite reasonably choose to *not* implement SFTP; to me, at least,
it sure seems to bring very little to the table in return for a lot
of increase in code size and maintenance.  But that's just my point
of view; clearly some people have put a lot of work into advancing
SFTP and they must have a more substantial use for it than I do.

-- 
Thor Lancelot Simon	                                      tls%rek.tjls.com@localhost
    And now he couldn't remember when this passion had flown, leaving him so
  foolish and bewildered and astray: can any man?
						   William Styron