Re: ftp-proxy and active passive

Am Mittwoch, 24. M=E4rz 2004 10:32 schrieb Andreas Meyer:
> Hello!
Hi Andreas,

>
> I tried to use the ftp-proxy but had some problems with active-passive
> mode. I want to use active-mode for the clients to ftp to the proxy.

=46rom the client to the Proxy you can change this in your client ftp progr=
amm. see pasiv command.
=46rom the proxy to the server you dont want to use active ftp. see below.

>
> In the netfilter-log I found this:
> Mar 24 09:34:25 cherry kernel: verw. TCP Paket IN=3D OUT=3Dppp0
> SRC=3D82.139.196.116 DST=3D212.202.67.186 LEN=3D60 TOS=3D0x08 PREC=3D0x00=
 TTL=3D64
> ID=3D42628 DF PROTO=3DTCP SPT=3D3806 DPT=3D32896 WINDOW=3D5664 RES=3D0x00=
 SYN URGP=3D0
>
> It seems passive-mode is used.

it looks like this is the proxy to server comunication. right ?

>
> So I had to explicitly open all high-ports on the firewall:
> iptables -A OUTPUT -p TCP --sport 1024: --dport 1024: -m state --state
> ESTABLISHED,RELATED -j ACCEPT
>
> Is there a way to force active-mode with the ftp-proxy?

right you have to open the ports for outgoing.
in active mode you had to open the > 1023 for incomming. belive me - you do=
nt want this.
So your firewall will pass all incomming connections. This is a big hole in=
 your security.

for understanding ftp:
A command socket is opend
client (> 1023)   ------->  (21) Server

If files or listings are transfered:
In Passiv (most default mode)
client (> 1023)   <-------  (20 or > 1023) Server

in passiv Mode
client (> 1023)   ------->  (> 1023) Server
So here the direction of the socket is equal to that of the command channel.

>
> Thanks in advance!

Hope this helps

Dirk


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]