Security Basics mailing list archives
Re: FTP Proxy
From: pablo gietz <pablo.gietz () nuevobersa com ar>
Date: Fri, 30 Jan 2004 10:50:13 -0300
FernandoThe outside FPT server pertains to other company . I do not sure if I’ve expressed correctly my problem. I think this must be a very common problem “ connecting with FTP clients to the outside world through a firewall”.
In our case, the fact of having a departmental firewall and a proxy in the middle may difficult the things. So because we are newbies with linux, iptables, etc. we are a little lost.
Thanks aniway Fernando Gont wrote:
At 11:19 29/01/2004 -0800, David Gillett wrote:> If the client is configured to do passive transfers, the > client will use the connection requests for both the control > and data connections. That means, you won't need to allow > incoming connection requests to hosts inside your network. > I think it's the best option. Which is "best" depends on whether you're looking from the client side or the server side, and what kind of border security you have at each end. If you have stateful firewalls with FTP fixup, they can listen to the FTP control conversation and permit the requested data connections as needed -- and this is true regardless of which direction wants to open the data connection.This requieres more processing in the firewall, though.Because the PORT command must be "patched" in the stream, it may be the case that the firewall not only needs to recalculate TCP's checksum, but may have to "recalculate" the sequence numbers, too. (The "patched" PORT command might be longer or shorter than the original one).If you rely on packet filters, either the client side or the server side has to allow arbitrary data connections to be opened. The only closure of this hole you can implement is that if the server opens the data connection ("active" mode), the source port number will be 20. [In "Hacking Exposed", there's passing reference to doing a pen-test against a network that would permit any connection sourced from port 20; this is why it was configured that way.]Sorry, I didn't understand that part where you said "this is why it was configured that way".It isn't that passive mode is "better" than or "more secure" than (boy, have I heard that one claimed a lot of times!) active mode; it's that if you're not using stateful firewalls that know about FTP, passive mode dumps all the risk on the server instead of the clients.It's probably more easy to configure the FTP server to use some specified port range (and thus allow incoming connections on only those ports) than configure *all* the clients that want to access your FTP site in a similar way.BTW, the FTP server was external to his organization, so... why should *him* take the risk?Best Regards, -- Fernando Gont e-mail: fernando () gont com ar || fgont () acm org .
-- Pablo A. C. Gietz Jefe de Seguridad Informática Nuevo Banco de Entre Ríos S.A. Te.: 0343 - 4201351 Fax: 0343 - 4201329 ---------------------------------------------------------------------------Ethical Hacking at InfoSec Institute. Mention this ad and get $720 off any course! All of our class sizes are guaranteed to be 10 students or less. We provide Ethical Hacking, Advanced Ethical Hacking, Intrusion Prevention, and many other technical hands on courses. Visit us at http://www.infosecinstitute.com/securityfocus to get $720 off any course! ----------------------------------------------------------------------------
Current thread:
- Re: FTP Proxy, (continued)
- Re: FTP Proxy Narendra Prabhu (Jan 27)
- Re: FTP Prox Andrey Ponomarev (Jan 27)
- Re: FTP Proxy Fernando Gont (Jan 28)
- Re: FTP Proxy pablo gietz (Jan 28)
- Re: FTP Proxy Fernando Gont (Jan 29)
- RE: FTP Proxy David Gillett (Jan 29)
- RE: FTP Proxy Fernando Gont (Jan 30)
- RE: FTP Proxy David Gillett (Jan 30)
- RE: FTP Proxy Fernando Gont (Jan 30)
- RE: FTP Proxy David Gillett (Jan 30)
- Re: FTP Proxy pablo gietz (Jan 28)
- Re: FTP Proxy pablo gietz (Jan 30)
- Re: FTP Proxy Fernando Gont (Jan 30)