wzdftpd / News: Recent posts

wzdftpd 0.8.3 was released a fortnight ago and we now present you with the Windows installer for this release. Changes since wzdftpd 0.8.2 include a security fix which resolves a denial of service issue with the USER command as well as OpenSSL cleanups, improved PASV port selection and an array of other minor bugfixes and tweaks.

Another new maintenance release of wzdftpd is now available. This release fixes a denial of service bug on the USER command (CVE-2007-5300). PASV ports are better selected from the PASV port range. There is a whole bunch of OpenSSL memory leak fixes. Corrections have been made to TLS encryption (GnuTLS/OpenSSL compatibility). Other minor bug fixes have been included as well.

Binaries/packages for Debian and Windows will be available for download shortly. Gentoo users can use the supplied 0.8.3 ebuild (contained within the source package).

wzdftpd 0.8.2 was officially released a few days ago and the Windows binaries have now been prepared for download. Changes from 0.8.2-rc1 include Windows Vista support, improved stability on server shutdown, minor internal documentation improvements and a variety of other minor bugfixes. Your feedback on this release is appreciated, especially with Windows Vista support.

A new version of wzdftpd is available featuring a brand new installer for the windows platform, a SQL backend, and many new features and bugfixes.

A new version of wzdftpd is available for the Windows platform featuring a brand new installer. This is a release candidate build of the upcoming 0.8.2 release and has many new features and bugfixes included.

New features
* SQLite backend has been added
* Brand new Windows installer
* Extra SITE HELP documentation added for various commands
* SQL backends can connect to SQL servers using TLS encryption ... read more

New events have been added (WIPE, PREMKDIR), and the scripts are now able to deny a transfer.
Users and groups management has been rewritten and enhanced. SQL backends support auto-reconnection if interrupted.
Many bugs were fixed, particularly for MLSD and SITE vars commands.
Documentation has been removed from package, and is now located on the wiki.

Allow MySQL backend to auto-reconnect to server, show vfs entries in MLSD, and fix some bugs when changing ip/password/name for users or groups.

Provides a default value for port, fix random characters on server replies and a few other minor problems.

Enable IPv6 and MLSD by default, add new options to reject users at connection time. There were improvements in the Zeroconf support, events, custom commands, unit tests, and several bugs were fixed.
Lots of deprecated or unsafe code was removed, including the support for the previous config file format and for old backends.

Several problems with syslog, SFV module, custom commands and TLS support were fixed, and debug events are no more logged. Some options have been added to disable MySQL/PostgreSQL support during configure.

Major update: config file changed, multiple IPv4 and IPv6 binds, zeroconf support, multiples fixes in GnuTLS, cookies, permissions, and server replies. IPv6 code was also greatly improved.

Security update: SITE command Remote Command Injection Vulnerability (see wzdftpd advisory 2005-01)

Better error logging, new log system based on channels. Important changes on MySQL backend (all tables renamed), see UPGRADING file for instructions.
Problems fixed: GnuTLS errors, uid problems in MySQL backend, thread-safe problems, crontab.

New backend using PostgreSQL to store users. A new site command (SECTIONS) was added to list sections, and several bugs were fixed in the MySQL backend.
UTF-8 support was also improved.

Fixed several problems with mkdir, cwd and custom site commands. Windows installer was also improved, and icons were added.

Fixed problems with configuration (pasv_ip, site_cmd not working, max_ul and max_dl not saved for groups). A memory leak has been fixed after client log out. chown, chgrp and chmod has been added to perl and tcl modules, as well as a log for perl. An incompatibility between OpenSSL and GnuTLS is also probably
solved. Some unit tests have also been added to the project.

Many changes: no more shared memory ! (and associated error messages ), the mysql backend is fully working, no more limitations on numbers of users/groups, big efforts made on security, new authentication library to unify methods:
crypt, md5, pam, SSL certificates, etc, new library to send commands from other programs, perl backend in development, new memory model with hash tables to get faster access to data and improve speed, many new commands: site vars, vars_user, vars_group, killpath, etc, ,GnuTLS support, new commands: SSCN, CPSV,
HELP (secure FXP), new events: file delection, and many, many bugfixes.

Fixed problems with symbolic links, permissions (delete) and LIST command.
Some new variables for server for passive range and speed limits; changing max speed for users/groups/server is now applied immediatly.
The 'perms' field is now effective for users, allowing a finer control on authorized commands.

Things are getting better, but several problems were identified, some of them could crash the server of corrupt data.

You can know join me at #wzdftpd on efnet !

wzdftpd now compiles and run on FreeBSD 5.0 (check the cvs version)

If you try to install / run the server please give me feedback - what you find difficult, what needs to be explained, crashes/bugs, etc