CCC (Clear Command Channel)

CCC

When the FTP server receives a Clear Command Channel (CCC) subcommand, it first checks whether the current user has the authority to perform the CCC command. If the user has the authority, it then accepts the command by sending a confirmation message back to the FTP client side. Then the FTP server changes the transmission mode in a control connection from the encrypted mode to the clear text mode.

You can secure sensitive information including your user name and password by sending them in the encrypted mode in the control connection. Then, you can use the CCC subcommand to change the transmission mode to the clear text mode, and then send the port and IP information.

Compared with the full encryption of the control connection, some potential security and integrity exposures exist when you use the CCC subcommand:

• This might result in file and directory names on the FTP server to be subject to interception. It is possible that such names themselves contain sensitive or confidential information.

• IP address and port information transferred in the control connection can be easily intercepted by hackers.

• Other direct TCP attacks on an FTP server or using an FTP server to attack other systems are completely eliminated when TLS is used. Some of those attacks are now again possible when the control connection reverts to the clear-text mode.

Because of these concerns, the use of the CCC subcommand is controlled using the i5/OS Function Usage interface. The default setting for the CCC subcommand is *DENIED for the FTP server.

You need to specify *ALLOWED for the QIBM_QTMF_SERVER_REQ_10 function through the Application Administration folder in iSeries™ Navigator or by using the CHGFCNUSG command so that you can allow an individual user logged on to the FTP server to use the CCC subcommand for ending protection of the control connection.

Here is an example of using the CHGFCNUSG command:

CHGFCNUSG FCNID(QIBM_QTMF_SERVER_REQ_10) USER(user) USAGE(*ALLOWED)