Index Journeys
RFC 697 UNKNOWN FTP · SECURITY

CWD command of FTP

Should FTP allow password-protected directory access?

On rfc-editor.org ↗
PUBLISHED
July 1975
AUTHORS
J. Lieb
STREAM
Legacy
CURRENT FTP BEHAVIOR
No login to files-only directories
CWD CURRENT FUNCTION
Change working directory (no ownership)
DOI
10.17487/RFC0697

RFC text

Contents
Original text · RFC Editor View on rfc-editor.org ↗ 
Network Working Group                                      Jim Lieb
RFC # 697                                                  SUMEX-AIM
NIC # 32963                                                July 14, 1975


                           CWD Command of FTP


Introduction

The Tenex file system support a "files only" directory.  This type of
directory cannot be "logged in" but it can be "connected to".  A login
gives directory "owner" access to the job generated by the system and an
address space in which the user can execute programs.   A connect allows
an existing job and its associated user "owner" access to a directory
but creates no address space.  The words "owner", "group", and
"universal" or "public" determine which field of the protection
specification is to be used to check the legality of a file access
request.


Problem

The Tenex FTP server does not allow an FTP Login to a "files only"
directory.  The current protocol contains the CWD (Change Working
Directory) command which gets part of the "connect" functions but it
does not grant "owner" access to the user.  Therefore, there is no way a
user can access a "files only" directory as the "owner" (i.e. he can
supply the password).  This is undesirable for private directories of
this type since it is uneconomical to define a user - directory "group"
for so few directories and unrestricted "public" access may be
undesirable.


Solution

There are two approach we can take.  Either we remove the distinction
"files only" from the FTP login, or we create a command that does the
"connect" function.  The restriction placed on "files only" directories
is based on how we define a user of FTP to the server.  If we say that
any net user who knows the password to a directory has ownership of that
directory as far as FTP is concerned, then we have a solution.  If we
want an FTP login to be as restrictive as a user login, then we need the
second alternative.

Proposal

Change the protocol in one of the following ways:

1.  Remove the restriction on "files only" directories for FTP logins or

2.  Add an optional argument to the CWD (Change Working Directory)
    command to specify the password string for the directory.  If the
    password check is successful the user is granted ownership rights to
    that directory.  If the password is not present or the check fails,
    the command functions as it presently does and access is controlled
    by the current protection mechanism.  Anonymous users should not be
    allowed to use this mechanism to change their access to the file
    system.











       [ This RFC was put into machine readable form for entry ]
       [ into the online RFC archives by Alex McKenzie with    ]
       [ support from GTE, formerly BBN Corp.            10/99 ]

AI ELI5

On this page
PROBLEMTENEX FTP servers do not allow FTP login to "files only" directories. Users cannot access private file directories with owner privileges because CWD (Change Working Directory) does not grant owner access.
MECHANISMThe proposal is to either allow FTP logins to files-only directories, or add an optional password argument to the CWD command that grants ownership rights if the password matches.
THE DESIGN CHOICEThe note outlines the trade-off: allowing FTP logins requires accepting that any network user knowing the password has ownership status in FTP, or adding a CWD password mechanism to maintain restriction.

§1Directory Access in TENEX FTP

TENEX has two types of directories: normal directories that can be "logged into" with owner access, and "files only" directories that can be "connected to" but not logged into. Logging into a directory gives the user (the job and its address space) owner access under TENEX's protection model. Connecting to a directory allows access to files without creating a new address space.

The TENEX FTP server currently allows login to normal directories but not to files-only directories. This means a user cannot access a files-only directory with owner privileges using FTP, only with the public or group protection levels that TENEX assigns by default.

Some folders on TENEX are set up so you cannot "log in" to them through the file transfer program, even if you know the password.

§2The Problem and Two Approaches

For private files-only directories, users either need to rely on restrictive group protection (which is cumbersome if only a few directories need it) or accept unrestricted public access (which is undesirable for private data). The note identifies two ways to solve this:

Option 1: Remove the restriction. Allow FTP login to files-only directories. This treats any network user who knows the password as an owner of that directory within FTP.

Option 2: Add a password mechanism to CWD. Extend the CWD command with an optional password argument. If the password is provided and matches, the user gains owner access. If no password is given or the password fails, CWD works as it currently does with standard protection rules.

Either let people log in to locked folders with a password, or add a special command that opens them. The choice depends on how strict you want security to be.

§3Trade-offs

Option 1 is simpler but less secure: it assumes that knowing the directory password is equivalent to being the directory owner. Option 2 is more restrictive: it gives users access to the directory's contents via CWD but does not change their ownership status in the broader system. The note notes that anonymous users should not be allowed to use a password mechanism to elevate their access.

Option 1 is easy but trusts the network. Option 2 is more careful but more complex to implement.