Re: ftp-proxy and active passive

Am Mittwoch, 24. M=E4rz 2004 17:51 schrieb Andreas Meyer:
> Hi!
Hi Andreas

ok i missunderstand you - you will use the proxy exactly the other way we d=
o.
So you want to use it for incomming ftp sessions.

=46irst you can use:
# Specify the FTP transfer mode to be used from the proxy to
# the server. TransferMode can be active, passive, or client.
# The default is "client" which means to use the same as the
# client.
#
DestinationTransferMode       active

Maybe this is the point you are looking for:

# The following entries select a port range for client DTP
# ports in active mode, i.e. when the client sends a PORT
# command. The default is port 20 as per RFC 959.
#
ActiveMinDataPort       40000
ActiveMaxDataPort       40999

But be careful - port 20 is a root privileged port. I am not sure if it is =
handled if the
proxy is running under non root - f.e. in inetd mode.
Which are you using ? What dose you use in the config ?

This is also the reason why some servers don't use port 20 for dataconnecti=
ons but ports > 1023.
So its right that you had to open some or all ports > 1023 for outgoing on =
ippp0.


I highly recomend to use the ipt_ftp (i think this was the name) for statef=
ull inspection of ftp.
So the firewall will have a look in the ftp-protokoll looking for a PORT co=
mmand and open only
this port for the data-connection.
If you have other servers in you private lan you would like to protect - th=
ink about a DMZ. Just put another
network card in your "firewall". Put Servers to comunicate with the interne=
t in ther.=20
I wouldn't allow a socket connection ingoing in the private lan.

private lan ----|firewall|-----{internet}
                         |
                         |
                     DMZ with ftp, http  server

or

private lan ----| inner wall | ----- DMZ with servers ----- |outer wall| --=
=2D- {internet}

Just have in mind a server that has contact could be hacked - A second wall=
 to protect other systems may be helpfull.
Ok for private use this might be overdressed :-)
But i think this is not the right list for this diskussion :-)

>
> Dirk Roloff <[email protected]> wrote:
> > > I tried to use the ftp-proxy but had some problems with active-passive
> > > mode. I want to use active-mode for the clients to ftp to the proxy.
> >
> > From the client to the Proxy you can change this in your client ftp
> > programm. see pasiv command. From the proxy to the server you dont want
> > to use active ftp. see below.
>
> From the client to the Proxy I am using active ftp. Also I configured
> ftp-proxy to use the same method for connecting to the serer as the
> client (default).

Use active here too !!! You dont want the proxy to open sockets in your pri=
vate lan,

>
> The server sits in a private LAN and outgoing traffic is masquerated.
>
> > > In the netfilter-log I found this:
> > > Mar 24 09:34:25 cherry kernel: verw. TCP Paket IN=3D OUT=3Dppp0
> > > SRC=3D82.139.196.116 DST=3D212.202.67.186 LEN=3D60 TOS=3D0x08 PREC=3D=
0x00 TTL=3D64
> > > ID=3D42628 DF PROTO=3DTCP SPT=3D3806 DPT=3D32896 WINDOW=3D5664 RES=3D=
0x00 SYN
> > > URGP=3D0
> > >
> > > It seems passive-mode is used.
> >
> > it looks like this is the proxy to server comunication. right ?

Yes - looks like dataconnection from proxy to client.

>
> This is the communication from the firewall running the ftp-proxy after
> the remote client initiated a controll-conntection to the ftp-proxy.
> 82.139.196.116 =3D firewall
> 212.202.67.186 =3D remote client (dynamic)
> I really dont understand why high-ports are used.

just in mind also al LIST opens a dataconnection.
client side port > 1023 is clear.
proxy use it if non root or configured.

> > right you have to open the ports for outgoing.
> > in active mode you had to open the > 1023 for incomming. belive me - you
> > dont want this. So your firewall will pass all incomming connections.
> > This is a big hole in your security.
>
> I thought if I want the client to use active mode, the client opens
> a controll-connection to port 21 and then the server opens a
> data-connection from port 20 to a high-port of the client. Am I wrong?

No you are right - this is what RFC  959 is talking about.
But again port 20 is only for root - and you aren't running it under root -=
 do you ?=20

>
> So in my case I thought the server would contact the ftp-proxy from
> port 20 to a high-port of the ftp-proxy .... and then?

This could be right and maybe not ... because the ftp server has the same p=
roblem with port 20.
Normaly after login the server is running in user contect .... so no port 2=
0 :-)

> hm, and the ftp-proxy connects from a high-port to the client on a
> high-port?

should be clear now ?

>
> > for understanding ftp:
> > A command socket is opend
> > client (> 1023)   ------->  (21) Server
> >
> > If files or listings are transfered:
> > In Passiv (most default mode)
          ^^^^^^^
          active i mean - sorry ..

> > client (> 1023)   <-------  (20 or > 1023) Server
> >
> > in passiv Mode
> > client (> 1023)   ------->  (> 1023) Server
> > So here the direction of the socket is equal to that of the command
> > channel.
>
> hm, I wonder what port are used in this scenario:
>
> client(dynamic-remote) -> ftp-proxy(firewall) -> Server(LAN)
client( > 1023 ) to proxy( 21 ) and proxy(>1023) to Server(21)
=20
> and then
> Server(LAN) -> ftp-proxy(firewall) -> client
Dataconnection active:
Server( > 1023) to proxy( > 1023) and poxy (>1023) to client( >1023)

>
> I dont want to use passive-mode because I thought I had to open
> all related high-ports. I thougth active-mode was a good idea
> because I can control the data-connection.

You are right to use active - passive is just usefull for the other way -=20
if you want to use the proxy to go out of your private LAN

hope this helps,
if any more questions - send your config please.

Dirk


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]