Last Call Review of draft-ietf-ftpext2-hosts-
review-ietf-ftpext2-hosts-secdir-lc-moriarty-2011-06-30-00

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Summary:  The document requires more information in the security considerations
section.

Section 3.2:

In terms of the types of changes that may be made, it does state 'more
elaborate changes' may be made depending on the environment.  However, for
security and the developers reading the specification, I think it would be best
to include the high end of the spectrum here and include isolation as one of
the explicitly stated examples as the scenario may be used in hosted
environments.

Upon receiving the HOST command, before authenticating the user-PI, a
   server-FTP process SHOULD validate that the hostname given represents
   a valid virtual host for that server, and, if it is valid, establish
   the appropriate environment for that virtual host.  The resultant
   actions needed to create that environment are not specified here, and
   may range from doing nothing at all, to performing a simple change of
   working directory, to changing authentication schemes and/or username
   and password lists, to making much more elaborate state changes, as
   necessary.

Section 4: Security Considerations

Please replace the term Confidentiality where you have listed "integrity" in
the opening sentence as the protection of privacy related information is
described through confidentiality.  The integrity and confidentiality of the
data on the servers are both potentially important, but this opening sentence
is in context of login parameters.

The second paragraph does address the authentication between virtual hosts,
which is good.  I think it is also important to ensure readers are aware of
possible concerns with segregation or isolation of the virtual FTP
environments.  If there are security concerns that may include different user
bases on the same physical host or different levels (sensitivity) of
information in different FTP hosts on the same server, the ability to have
segregation of the environments will be important (this will happen).  How can
segregation/isolation be provided in this model?  Please include information on
the options here.  I am assuming that since we are talking about multiple hosts
on a single IP, that we may be within a physical host or a virtual environment
that has one IP address.  If this is the case, what security options are
available - authentication, access controls, etc.?  Please include them in this
section.

Thank you,
Kathleen