Subject: passv ftp

From: [email-masked]
Date: Mon, 18 Nov 1996 15:19:50 -0500 (EST)

folks,
Is there a way to limit the possible ports that can be negotiated too
while doing passv ftp from a browser. I am assuming that from a
security standpoint, you have to open up all the ports above 1024
when allowing for passv mode. Is this true? Also, when doing regular
ftp after the connection request comes in on port 21, does all the
rest of the data travel on port 20 or are is there a random port
also set up for standard ftp connections.

Thanks

Doug Courtney

---

From: Alain Magloire <[email-masked]>
Date: Mon, 18 Nov 1996 18:09:45 -0500 (EST)

> also set up for standard ftp connections.

FTP works on two channels:
a contol channel --> 21/tcp
and a data channel --> 20/tcp

When you do :

ls
get
put
etc...

The client and the wu-ftpd will negotiate on a port were the DATA will flow
This will be done via the PORT or PASV commands.

ex: ftp -d
....
ftp> ls
---> PORT 132,206,63,203,6,11
200 PORT command successful.
---> NLST
150 Opening ASCII mode data connection for file list.
....

Server|                           |Client
------         data               -------
port (21) -------------------------> port (1547)

the port is find by doing this:
6*256 +11

The PASV command works the same but you ask
wu-ftpd to listen on another data port then 21

Usually(it's not a rule) _ALL_ commands will issue the PORT|PASV directives
to negotiate a new port(avoiding 2 MSL for TCP)

They was a lot of dust last year about this feature
Because some malicous user could do:

PORT a,b,c,d,0,25
RETR fake_mail

ftpd will not check further and the result will be download
in sendmail(SMTP) on a.b.c.d machine.

They are various toolkits to exploit this for port_scanning
fake_mail etc ...

wu-ftpd-...-beta-11 is `aware' of this, it will not allow
port lower than 1024 and data connection from PORT other
then the client. 
It will also permit one passive port at a time to guard
against malicious users asking for 1000 ports !!
via the PASV command.

Now be aware that some ftp kits can rely on this behaviour
to provide some sort of Proxy connections between 3 machines.
(you're on machine `a' retreiving file form machine `b' to store
on machine `c').

ouf !!! enough, let me catch my breath

--
a` la prochaine, alain

P.S:
Hey !!!
[email-masked]
              ^^^^^^^^^^^
I've been receiving some junk mail from this domain ... 
any relations ?