Secure FTP support for IANA downloads
Hello, I am writing to inquire about your site's use of FTP and the possibility of migrating over to Secure FTP in order to comply with our company's security compliance requirements. Does your site offer Secure FTP for your IANA downloads and if not, what would it take to enable this protocol so our company could securely download your files? Currently, we use this URL to download the IANA time zone files which is not secure: ftp://ftp.iana.org/tz/ Thank you in advance for your help. Regards, Peter Bassey Peter A. Bassey Enterprise Business Intelligence UPS 340 MacArthur Blvd Mahwah, NJ 07430 Phone: 201-828-7847 Mobile: 845-662-3743 pbassey@ups.com<mailto:pbassey@ups.com>
Hello, On 06/05/2018 04:29 PM, pbassey--- via tz wrote:
I am writing to inquire about your site’s use of FTP and the possibility of migrating over to Secure FTP in order to comply with our company’s security compliance requirements.
Does your site offer Secure FTP for your IANA downloads and if not, what would it take to enable this protocol so our company could securely download your files? Currently, we use this URL to download the IANA time zone files which is not secure: ftp://ftp.iana.org/tz/
Check the website? https://www.iana.org/time-zones Or the release announcements? http://mm.icann.org/pipermail/tz-announce/2018-May/000050.html With TLS, SHA-2 hashes, OpenPGP signatures and everything... Andreas -- Andreas Stieger <astieger@suse.com> Head of Product Security SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
pbassey--- via tz wrote:
Does your site offer Secure FTP for your IANA downloads and if not, what would it take to enable this protocol so our company could securely download your files? Currently, we use this URL to download the IANA time zone files which is not secure:ftp://ftp.iana.org/tz/
As far as I know iana.org does not offer SFTP access to tzdb, I suppose due to the relative complexity and configuration hassle associated with that protocol. Instead, you can access tzdb via HTTPS. This is recommended nowadays and should be just as secure as SFTP for downloads. You can also verify each release via a GPG signature for added security; this is especially recommended if you still must use plain FTP or HTTP for some reason. For details, please see: https://mm.icann.org/pipermail/tz-announce/2018-May/000050.html
Joe, How hard would it be for you to switch to an https download rather than FTP? Vijay - would this (https download) satisfy the new security requirements? -Peter -----Original Message----- From: Paul Eggert [mailto:eggert@cs.ucla.edu] Sent: Wednesday, June 06, 2018 04:47 AM To: Bassey Peter (YSS1PXB) <pbassey@ups.com> Cc: Time zone mailing list <tz@iana.org>; Caggiano Joseph (CLK7FFW) <josephcaggiano@ups.com>; Taylor Matt (MGT9MXT) <mxtaylor@ups.com>; Vedanabhatla Vijay (RVY4NPL) <vvedanabhatla@ups.com>; Ryabtsov Andrey (dbm1aar) <aryabtsov@ups.com>; Aronowitz Meryl (dwh1mxa) <maronowitz@ups.com> Subject: [EXTERNAL] Re: [tz] Secure FTP support for IANA downloads pbassey--- via tz wrote:
Does your site offer Secure FTP for your IANA downloads and if not, what would it take to enable this protocol so our company could securely download your files? Currently, we use this URL to download the IANA time zone files which is not secure:ftp://ftp.iana.org/tz/
As far as I know iana.org does not offer SFTP access to tzdb, I suppose due to the relative complexity and configuration hassle associated with that protocol. Instead, you can access tzdb via HTTPS. This is recommended nowadays and should be just as secure as SFTP for downloads. You can also verify each release via a GPG signature for added security; this is especially recommended if you still must use plain FTP or HTTP for some reason. For details, please see: https://mm.icann.org/pipermail/tz-announce/2018-May/000050.html
Date: Wed, 6 Jun 2018 12:11:47 +0000 From: pbassey--- via tz <tz@iana.org> Message-ID: <96177a6b007e41c0bc32c10c034cb447@SVRP0004CB3B.us.ups.com> | Vijay - would this (https download) satisfy the new security requirements? Unless the need is to hide from others the fact that tz*gz files are being downloaded (rather than lists of port number assignments, or ...) then the download method should really make no difference. That provides no security against data havnig been (somehow) altered while on the server (or before it was even uploaded), nor against them being altered after they have arrived at your system, before they are unpacked. The signatures that accompany the files, along with the announcement of their fingerprints when new versions are announced are much better as a security mechanism - that validates that the data you're about to use is the exact same data as was originally packaged and distributed from before it was uploaded (and is totally independent of the path that it took to get to you, which is really irrelevant, including the possibility that someone has hacked the DNS, or routing, and the site you end up fetching from is not the actual IANA site). What's more, you can retain the .gz files, and verify the signature as often as you want, and then unpack and compare against the actual data files that you're using, to verify that nothing (malicious or accidental) has altered any of the data you're using between tz* releases. And you can save the entire thing (signatures, fingerprints, and .gz files) on write-once media as an audit trail, so you can have a (fairly) permanent record of what was used, and validate its authenticity years later, should that be needed. Using secure ftp/http is needed if sensitive (private) data is being transferred (for which they work well, incuding verifying that that is going to or from the site you intended) or when there is no other protection, and you want what minimal protection they offer that you're fetching the correct data. None of that should apply to tz data or code - it is not secret (no-one is going to attempt to find out the timezone of Bolivia by observing the tzdata download en route from the server to your system...), as long as tiy get the correct data, it should not matter where it came from, and the signatures are a much better validation method that simply knowning that the data was not altered on the wire. If some of you work for organisations which have half baked security policies that don't understand all of this, you'd be much better to attempt to teach them what really matters, what risks exist, and what techniques are best, in each case, to overcome those risks, rather than attempting to get others to modify their systems to accomodate nonsense. kre ps: all that said, I totally understand the desire to use some form of FTP rather than HTTP, it is a much better designed protocol all around, though considerably more complex.
Robert Elz said:
If some of you work for organisations which have half baked security policies that don't understand all of this, you'd be much better to attempt to teach them what really matters, what risks exist, and what techniques are best, in each case, to overcome those risks, rather than attempting to get others to modify their systems to accomodate nonsense.
<FX>Hollow laughter</FX> While I'm not affected by this particular issue, I have too many scars from trying to get company policies changed to "something obviously more sensible". -- Clive D.W. Feather | If you lie to the compiler, Email: clive@davros.org | it will get its revenge. Web: http://www.davros.org | - Henry Spencer Mobile: +44 7973 377646
Quoting pbassey--- via tz on Tuesday June 05, 2018:
Hello, I am writing to inquire about your site's use of FTP and the possibility of migrating over to Secure FTP in order to comply with our company's security compliance requirements.
Does your site offer Secure FTP for your IANA downloads and if not, what would it take to enable this protocol so our company could securely download your files? Currently, we use this URL to download the IANA time zone files which is not secure: ftp://ftp.iana.org/tz/
We don't currently have any plans to offer Secure FTP, but as others have noted, there are other secure options, as well as alternate ways to verify authenticity through FTP. Here are some secure URLs to get you started: https://data.iana.org/time-zones/tzcode-latest.tar.gz https://data.iana.org/time-zones/tzdata-latest.tar.gz https://data.iana.org/time-zones/tzdb-latest.tar.lz kim
participants (6)
-
Andreas Stieger -
Clive D.W. Feather -
Kim Davies -
Paul Eggert -
pbassey@ups.com -
Robert Elz