Re: ftp-proxy and active passive

Hi!

Dirk Roloff <[email protected]> wrote:

> > I tried to use the ftp-proxy but had some problems with active-passive
> > mode. I want to use active-mode for the clients to ftp to the proxy.
> 
> From the client to the Proxy you can change this in your client ftp programm. see pasiv command.
> From the proxy to the server you dont want to use active ftp. see below.

From the client to the Proxy I am using active ftp. Also I configured
ftp-proxy to use the same method for connecting to the serer as the
client (default).

The server sits in a private LAN and outgoing traffic is masquerated.


> > In the netfilter-log I found this:
> > Mar 24 09:34:25 cherry kernel: verw. TCP Paket IN= OUT=ppp0
> > SRC=82.139.196.116 DST=212.202.67.186 LEN=60 TOS=0x08 PREC=0x00 TTL=64
> > ID=42628 DF PROTO=TCP SPT=3806 DPT=32896 WINDOW=5664 RES=0x00 SYN URGP=0
> >
> > It seems passive-mode is used.
> 
> it looks like this is the proxy to server comunication. right ?

This is the communication from the firewall running the ftp-proxy after
the remote client initiated a controll-conntection to the ftp-proxy.
82.139.196.116 = firewall
212.202.67.186 = remote client (dynamic)
I really dont understand why high-ports are used.


> > So I had to explicitly open all high-ports on the firewall:
> > iptables -A OUTPUT -p TCP --sport 1024: --dport 1024: -m state --state
> > ESTABLISHED,RELATED -j ACCEPT
> >
> > Is there a way to force active-mode with the ftp-proxy?
> 
> right you have to open the ports for outgoing.
> in active mode you had to open the > 1023 for incomming. belive me - you dont want this.
> So your firewall will pass all incomming connections. This is a big hole in your security.

I thought if I want the client to use active mode, the client opens
a controll-connection to port 21 and then the server opens a data-connection
from port 20 to a high-port of the client. Am I wrong?

So in my case I thought the server would contact the ftp-proxy from
port 20 to a high-port of the ftp-proxy .... and then?
hm, and the ftp-proxy connects from a high-port to the client on a high-port?

 
> for understanding ftp:
> A command socket is opend
> client (> 1023)   ------->  (21) Server
> 
> If files or listings are transfered:
> In Passiv (most default mode)
> client (> 1023)   <-------  (20 or > 1023) Server
> 
> in passiv Mode
> client (> 1023)   ------->  (> 1023) Server
> So here the direction of the socket is equal to that of the command channel.

hm, I wonder what port are used in this scenario:

client(dynamic-remote) -> ftp-proxy(firewall) -> Server(LAN)
and then
Server(LAN) -> ftp-proxy(firewall) -> client

I dont want to use passive-mode because I thought I had to open
all related high-ports. I thougth active-mode was a good idea
because I can control the data-connection.


-- 
   Andreas Meyer

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]