Some Closing Thoughts about FTP Host Names

robert_mcmurray — Tue, 28 Aug 2007 23:25:44 GMT

Here are a couple of items that I thought needed mentioning as well:

Having an FTP HOST command does lead to strange protocol quirks that HTTP is also subject to - an HTTP or FTP client can connect to an IP address using a specific DNS name and then pass a different host name after connecting to the IP address. This isn't a security vulnerability - it's just the way that HTTP and FTP work; logically-speaking the client should be passing the same name for the connection and host name, but that's not necessarily required.
Someone responded to my earlier blog post and asked if reverse DNS could have been used as another option, but reverse DNS is out of the question because as I mentioned earlier in this blog post the server is not aware of the host name and therefore cannot perform a reverse lookup by host name. Likewise, if you have several host names that are registered to the same IP address, the server can perform a lookup on the IP address, but when the name server contains multiple registrations for the IP address, which host name should it map to? Since FTP packets from a client cannot pass a host name by default, the FTP server would have no way of knowing which host name to use from the list provided by a name server. But then again, if FTP provided a means to specify the host name the whole issue would be moot and a reverse lookup would not be needed, which is why we researched adding a HOST commend for FTP.

I hope this helps!

re: Virtual Hosts and Host Names in FTP7

colinbo — Sat, 02 Feb 2008 00:16:34 GMT

How does FTPS (SSL) impact the virtual host scenario?