Subject: Followup on IETF72 discussion of FTP protocol extensions and updates

From: John C Klensin <[email-masked]>
Date: Fri, 31 Oct 2008 15:17:42 -0400

Hi.

Some notes were circulated prior to the Dublin meeting and we
had a brief discussion there about how (or if) to progress a
number of proposals for FTP extensions and clarifications.

The conclusion was that Barry and I should try to get a
preliminary draft charter together.  It is attached.

While I won't try to reprise the information in the charter or
the discussion in July (see archives of this list with "FTP" in
the subject lines), let me give a personal impression of where
things stand at the moment.

I, and I believe Barry, are willing to invest some time in this
if others are interested and willing to work.  With possibly one
exception, we are much less willing to try to twist arms to
persuade anyone that they should be interested.  We also don't
see much point in standardizing anything for which multiple
implementations are unlikely, i.e., for any given one of the
proposals, we would expect any possible WG to determine whether
it is just an interesting idea or whether there is real,
multi-vendor or multi-implementer, interest in it.

On the other hand, if there are going to be multiple
implementations of the same general idea, I believe there is
merit in doing enough work in the IETF --presumably including
standardization-- to increase the odds that those
implementations will be interoperable.  So, at least in my case,
the threshold for an FTP extension effort being worthwhile is
well below a conviction that something is a great idea that
everyone should immediately implement.

The schedule shown in the attached draft charter is very
aggressive, but based on the assumption that there really is a
core group of people who want to make this happen and will make
an investment in it.  If that is not the case, I would
personally argue against getting a WG started -- this impresses
me as something we can either find the energy to do quickly or
cannot do at all.

As a personal comment, I believe that there is a significant
opportunity for IETF to add value to these proposals because
they are not the only way to do what they propose to accomplish.
To take two handy examples, it is not clear to me that a
single-stream FTP is FTP any more -- such a thing, if needed,
might better be modeled on TFTP, HTTP, SMTP with BDAT,or some
other arrangement.  Similarly, when we discovered that we needed
to reduce the number of turnarounds in SMTP, we invented
pipelining, rather than, e.g., a MAILRCPT command that took a
list of addresses.

Anyway, comments welcome.  My hope is to hold a brief discussion
during the Apps Area meeting and, if there is interest (i.e.,
people willing to work), that we organize a bar-BOF, tune the
charter, and get it back in the hands of the ADs before the IETF
week is over.  That implies that anyone who is interested in
participating and willing to work but will not be in
Minneapolis, and anyone who can shed light in the implementation
status of these various proposals, should say so on this list
well before Nov 17.

     john
_______________________________________________
Apps-Discuss mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/apps-discuss

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 31 Oct 2008 14:24:58 -0500

On Fri, Oct 31, 2008 at 03:17:42PM -0400, John C Klensin wrote:
> Streamlined FTP Command Extensions
>    draft-peterson-streamlined-ftp-command-extensions-05.txt

-05 is expired; -06 is available.

> FTP Extension Allowing IP Forwarding (NATs)
>    draft-rosenau-ftp-single-port-04

-05 is available.

---

From: John C Klensin <[email-masked]>
Date: Fri, 31 Oct 2008 16:12:32 -0400

>>    draft-rosenau-ftp-single-port-04

Thanks.  I've updated my working copy of the draft.  Shows how
long I/we have been working on this.

    john

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 31 Oct 2008 13:35:39 -0700

At 3:17 PM -0400 10/31/08, John C Klensin wrote:
>We also don't

That seems like the crux of the question. In your charter you list RFCs 2228, 2640, 2773, and 3659; of those, I am not sure any are implemented in "common" FTP clients and servers.

Given that parts of the world have moved on to SCP and FTPS and SFTP and whatever for moving files using stronger authentication and encryption, I'm not sure if this WG should be spun up unless it deals with security. I am perfectly happy with "FTP over TLS" or "FTP over SSH", but if the IETF is going to make more extensions but doesn't have a standard way for securing files moving around, we're not helping.
_______________________________________________
Apps-Discuss mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/apps-discuss

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 31 Oct 2008 16:00:11 -0500

On Fri, Oct 31, 2008 at 01:35:39PM -0700, Paul Hoffman wrote:
> That seems like the crux of the question. In your charter you list
> RFCs 2228, 2640, 2773, and 3659; of those, I am not sure any are
> implemented in "common" FTP clients and servers.

RFC2228 is certainly supported by multiple implementations, as is
RFC4217 (though often only RFC2228 with the GSS-API Kerberos V
mechanism, or RFC4217, but not both, are found in any given
implementation).  I'd not heard of any of the others though.

> Given that parts of the world have moved on to SCP and FTPS and SFTP
> and whatever for moving files using stronger authentication and
> encryption, I'm not sure if this WG should be spun up unless it deals
> with security. I am perfectly happy with "FTP over TLS" or "FTP over
> SSH", but if the IETF is going to make more extensions but doesn't
> have a standard way for securing files moving around, we're not
> helping.

RFC2228 and RFC4217 work just fine for security, thank you.

Personally, I'd rather see SFTP (or FTP over SSH) improved enough to
make FTP go away.  But I don't think I mind this proposed WG.

Nico
--

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 31 Oct 2008 14:34:57 -0700

At 4:00 PM -0500 10/31/08, Nicolas Williams wrote:
>RFC2228 is certainly supported by multiple implementations,

That's good to hear; I had heard the opposite a few years ago.

> as is
>implementation). 

RFC 4217 would be my preference, but I don't see it in the clients I use. Maybe they call it something else.

>RFC2228 and RFC4217 work just fine for security, thank you.

Fully agree.

>make FTP go away.  But I don't think I mind this proposed WG.

Yep.

---

From: "Douglas J. Papenthien" <[email-masked]>
Date: Fri, 31 Oct 2008 21:10:09 -0500

> That's good to hear; I had heard the opposite a few years ago.

RFC2228 has been implemented in our FTP server and client products since
2002.  I'm quite sure that many of our major competitors included it around
the same time.  The same can be said about RFCs 2640 and 3659.  The addition
of the MLST and MLSD commands were very welcome by us and many others in our
field.

>>make FTP go away.  But I don't think I mind this proposed WG.

I don't know that I particularly agree with this sentiment.  Much like the
"transition" to IPv6, I think you're going to be hard pressed to have much
luck stamping out FTP in favor of anything else regardless of the pros and
cons.

Douglas J. Papenthien - Vice President
http://www.RhinoSoft.com
Voice: +1(262) 560-9627
FAX: +1(262) 560-9628