Date: Tue, 23 Jul 2002 10:33:26 -0700 From: "Crist J. Clark" <crist.clark@attbi.com> To: Scott Lambert <lambert@lambertfam.org> Cc: freebsd-stable@FreeBSD.ORG Subject: Re: Enabling passive FTP on FreeBSD 4.5? Message-ID: <20020723173326.GA56146@blossom.cjclark.org> In-Reply-To: <20020720053558.GA3487@laptop.lambertfam.org> References: <p05111b1db95cfe538574@[192.168.254.205]> <016701c22edb$fcc0e250$0600a8c0@P1200n> <3D37A0A7.6070809@quack.kfu.com> <20020719122614.O21507@staff.msen.com> <20020720053558.GA3487@laptop.lambertfam.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Jul 20, 2002 at 01:35:59AM -0400, Scott Lambert wrote:
> On Fri, Jul 19, 2002 at 12:26:14PM -0400, Michael R. Wayne wrote:
> > Having recently fought IPFW on this, and having a hard time finding
> > actual firewall rules to make FTP work right on a server that
> > provides FTP access to the world, here is what we ended up with
> > which appears to properly permit active and passive FTP.
> >
> > # FTP/ftp
> > $fwcmd add 12501 pass tcp from any to ${ip} 20 setup # FTP-data
> > $fwcmd add 12505 pass tcp from any to ${ip} 21 setup keep-state
> > $fwcmd add 12507 pass tcp from any to ${ip} 49152-65535 setup # Passive FTP
> >
> > Watching the logs, people are managing to successfully ftp regularly.
> >
> > Yes, it's a hole. No, we don't like that last rule as someone
> > could remotely spawn a shell on one of those ports. But we see no
> > way around it as ftp access is a required service for the machine.
>
> Doesn't ipf with ipnat have the ability to watch the FTP control channel
> and figure out when and what port to allow through for a passive FTP
> data channel? It's been a while since I looked at this so I could be
> smoking crack.
ipf(8) wasn't originally designed to support an ftp _server_ behind
NAT. IIRC, it still doesn't... but not a 100%. Take it to the IPF
list, ipfilter@coombs.anu.edu.au, if you have questions about that.
As for ipfw(8), you can try to use natd(8) to proxy your ftp
connections, see punch_fw.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020723173326.GA56146>