[Proftpd-user] Relaxed AllowForeignAddress option
Dmitry Katsubo <[email protected]>
| Newsgroups | gmane.network.proftpd.user |
|---|---|
| Message-ID | <[email protected]> |
Dear ProFTPd users, I have come across the problem when ProFTPd is configured to use given address (say, 77.10.11.12) for masquerading to be able to serve external users in passive mode, while rejecting users from internal network with message: SECURITY VIOLATION: Passive connection from 77.10.11.12 rejected Actually, in my network setup local users are able to set packages to external IP address, which are looped back by NAT. However ProFTPd considers this a security violation for good reason. On the other side I cannot apply the solution from [1] using e.g. <VirtualHost 10.0.0.5>, as the server which is running ProFTPd is different from NAT/gateway and it doesn't own the external address 77.10.11.12. So the only way out (except forcing the clients to use active connection) is to use AllowForeignAddress on In this respect I would like to suggest to introduce an extra option value: AllowForeignAddress off # All unmatched connections are rejected AllowForeignAddress relaxed # Data connections from the same IP as control connection + from masqueraded IP are accepted AllowForeignAddress strict # Only data connections from the same IP as control connection are accepted Maybe from security perspective the difference between relaxed and strict is minimal... any considerations are welcomed. Thanks! [1] http://www.proftpd.org/docs/howto/NAT.html -- With best regards, Dmitry ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ ProFTPD Users List <[email protected]> Unsubscribe problems? http://www.proftpd.org/list-unsub.html