How to compile lftp with openssl?

Wed, 11/16/2011 - 05:15 - augustin

ldd /usr/bin/lftp
        linux-vdso.so.1 =>  (0x00007ffff4720000)
        libgnutls.so.26 => /usr/lib/x86_64-linux-gnu/libgnutls.so.26 (0x00007fc68cf20000)
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007fc68cd18000)
        libreadline.so.6 => /lib/libreadline.so.6 (0x00007fc68cad5000)
        libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x00007fc68c8d2000)
        libncurses.so.5 => /lib/libncurses.so.5 (0x00007fc68c68e000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fc68c489000)
        libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007fc68c273000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fc68bedf000)
        /lib64/ld-linux-x86-64.so.2 (0x00007fc68d1f6000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fc68bcc0000)
        libtasn1.so.3 => /usr/lib/x86_64-linux-gnu/libtasn1.so.3 (0x00007fc68baaf000)
        libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007fc68b897000)
        libgcrypt.so.11 => /lib/x86_64-linux-gnu/libgcrypt.so.11 (0x00007fc68b61c000)
        libgpg-error.so.0 => /lib/x86_64-linux-gnu/libgpg-error.so.0 (0x00007fc68b418000)

I compiled from source using:
./configure --with-openssl=/usr/lib
and I get:

$ ldd /usr/local/bin/lftp
        linux-vdso.so.1 =>  (0x00007fff195ff000)
        libexpat.so.1 => /lib/x86_64-linux-gnu/libexpat.so.1 (0x00007f96070e9000)
        libssl.so.0.9.8 => /lib/libssl.so.0.9.8 (0x00007f9606e96000)
        libcrypto.so.0.9.8 => /lib/libcrypto.so.0.9.8 (0x00007f9606b06000)
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f96068fe000)
        libreadline.so.6 => /lib/libreadline.so.6 (0x00007f96066bc000)
        libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x00007f96064b8000)
        libncurses.so.5 => /lib/libncurses.so.5 (0x00007f9606274000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f9606070000)
        libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f9605e59000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f9605ac5000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f9607348000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f96058a7000)
        libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f960568e000)

The second is linked against libssl while the former is not.

However, even though in my .lftprc I have set ftp:ssl-force on, it allowed me to connect with a remote server.

So two questions:
1) Is the distro's packaged version of lftp really not compiled with SSL support? Are we obligated to re-compile from source to use lftp with SSL encryption?

2) If it is not, why did it let me connect to the remote server without SSL encryption??

Comments

#2

augustin - 11/16/2011 - 05:41

I set debug = 5, and made a diff of the output of /usr/bin/lft (the version packaged by the distro) and /usr/local/bin/lftp (the version I compiled with SSL support) and here is what I got:

-/usr/bin/lftp bookmark
+$ /usr/local/bin/lftp bookmark
 ---- Resolving host address...
 ---- 1 address found: xxx.36.166.xxx
 ---- Connecting to ftp.xxx.net (xxx.36.166.xxx) port 21
@@ -10,6 +10,8 @@
 ---> AUTH TLS
 <--- 234 AUTH TLS OK.
 ---> USER admin
+Certificate depth: 1; subject: /O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=supportatcacertorg; issuer: /O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=supportatcacertorg
+Certificate depth: 0; subject: /CN=*.ocsa-data.net; issuer: /O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=supportatcacertorg
 <--- 331 User admin OK. Password required
 ---> PASS XXXX
 <--- 230-User admin has group access to:  clients

The only difference in output is the following which is only found in the second version:

Certificate depth: 1; subject: /O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=supportatcacertorg; issuer: /O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=supportatcacertorg
Certificate depth: 0; subject: /CN=*.ocsa-data.net; issuer: /O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=supportatcacertorg

However, both have:

---> AUTH TLS
<--- 234 AUTH TLS OK.

What does it all mean?
Does it mean the connection is secured with the packaged version?

Why doesn't the ssl linkage show with ldd with it?
What is the significance of the extra output with the self-compiled version??

Ok, here is my mistake:
OpenSSL is an implementation of the the SSL and TLS protocols.
http://en.wikipedia.org/wiki/OpenSSL
http://en.wikipedia.org/wiki/Transport_Layer_Security
GnuTLS is another implementation of the same protocol:
http://en.wikipedia.org/wiki/GnuTLS
For the licensing issues discussed on the OpenSSL wikipedia article, linux distros prefer to use GnuTLS instead of OpenSSL.

So, the packaged lftp versions are secure in the way that they do implement the SSL and TLS protocols.

I attach a patch showing the differences in debug output between lftp compiled with OpenSSL and one compiled with GnuTLS.

Todo: improve the documentation.

Attachment	Size
lftp_tls_sun.patch	4.38 KB

#4

jinhao - 09/26/2012 - 03:03

hi, I found descrtiption as following at http://linux.about.com/od/commands/l/blcmdl1_lftp.htm.

ftp:ssl-force (bool)
if trus, refuse to send password in clear when server does not support SSL. Default is false. This setting is only available if lftp was compiled with openssl.

it seems "set ftp:ssl-force on" does not works.
How does lftp connect to server use ssl protocol if it is not compiled with openssl?