Re: ftp-proxy and active passive

Hi!

Dirk Roloff <[email protected]> wrote:

> ok i missunderstand you - you will use the proxy exactly the other way we do.
> So you want to use it for incomming ftp sessions.
> 
> First you can use:
> # Specify the FTP transfer mode to be used from the proxy to
> # the server. TransferMode can be active, passive, or client.
> # The default is "client" which means to use the same as the
> # client.
> #
> DestinationTransferMode       active

Did that.
 
> Maybe this is the point you are looking for:
> 
> # The following entries select a port range for client DTP
> # ports in active mode, i.e. when the client sends a PORT
> # command. The default is port 20 as per RFC 959.
> #
> ActiveMinDataPort       40000
> ActiveMaxDataPort       40999

Alright, restricted this range to a few numbers and also for established
connections in the netfilter and it seems to work!
 
> But be careful - port 20 is a root privileged port. I am not sure if it is handled if the
> proxy is running under non root - f.e. in inetd mode.
> Which are you using ? What dose you use in the config ?

The proxy is running as user nobody and group nogroup, standalone.
I didn't know that it must run as root to use port 20.
If I get the time I'll do some more tests.
 
> This is also the reason why some servers don't use port 20 for dataconnections but ports > 1023.
> So its right that you had to open some or all ports > 1023 for outgoing on ippp0.

I thought in active-mode the proxy uses port 20 too.

> I highly recomend to use the ipt_ftp (i think this was the name) for statefull inspection of ftp.
> So the firewall will have a look in the ftp-protokoll looking for a PORT command and open only
> this port for the data-connection.

ipt_LOG                 3376   3  (autoclean)
ipt_MASQUERADE          1392   1  (autoclean)
ipt_state                640  57  (autoclean)
iptable_filter          1792   1  (autoclean)
ip_conntrack_ftp        3824   1  (autoclean)
ip_nat_ftp              2944   0  (unused)
iptable_nat            15920   2  [ipt_MASQUERADE ip_nat_ftp]
ip_tables              11072   8  [iptable_mangle ipt_LOG ipt_MASQUERADE ipt_state iptable_filter iptable_nat]
ip_conntrack           17952   3  [ipt_MASQUERADE ipt_state ip_conntrack_ftp ip_nat_ftp iptable_nat]

I don't know why ip_nat_ftp is unused.


> If you have other servers in you private lan you would like to protect - think about a DMZ. Just put another
> network card in your "firewall". Put Servers to comunicate with the internet in ther. 
> I wouldn't allow a socket connection ingoing in the private lan.
> 
> private lan ----|firewall|-----{internet}
>                          |
>                          |
>                      DMZ with ftp, http  server
> 
> or
> 
> private lan ----| inner wall | ----- DMZ with servers ----- |outer wall| ---- {internet}

Yes the servers are in a DMZ, like you describe it above. Iptables can be very
difficult to understand and setup ...

> Just have in mind a server that has contact could be hacked - A second wall to protect other systems may be helpfull.
> Ok for private use this might be overdressed :-)
> But i think this is not the right list for this diskussion :-)

Thank you for your patience! You helped a lot!

-- 
   Andreas Meyer

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]