Subject: Re: Passive Mode Xfers

From: [email-masked] (Andy Church)
Date: Wed, 27 Aug 1997 23:05:20 EDT

>Using wu-2.4.2-academ[BETA-13] on a FreeBSD 2.2 system, I have had 
>several users report to me that they are able to upload files using
>passive transfers, but not download them again.
>
>They are using a program called "FXP" which apparently does direct
>data transfers between two FTP servers allowing people to transfer
>files at the speeds the two FTP servers are connected instead of 
>limiting to their connection speed.
>
>In order to achieve this, FXP uses passive transfers and
>(apparently) is happy to transfer up at max. speed
>but if they try to transfer -from- my system it uses their
>connection speed.

     I'd guess you're running into the limitation of wu-ftpd (around since
the Hobbit fix-kit?) which prevents PORT commands from any host other than
the host the source host--look for "refused PORT 0,xxxx" in your syslog.
This is really a double-edged patch:  It prevents things like the so-called
"FTP bounce attack" which can be used to get around certain access
restrictions, and prevents someone from making ftpd connect to reserved
ports (can anyone think of a _real_ DoS [denial of service] attack based on
this?  I can't).  On the other hand, it prevents legitimate use of PORT
commands for hosts other than the one sending the command, and this is at
least the second program I've heard of which takes advantage of this
feature of FTP.  I personally prefer it off; the code is around line 770 in
ftpcmd.y if you want to tinker with it.

     Of course, your problem might be completely different. <shrug>

  --Andy Church                  | If Bell Atlantic really is the heart
    [email-masked]       | of communication, then it desperately
    www.dragonfire.net/~achurch/ | needs a quadruple bypass.