Subject: passive mode and firewalls

From: [email-masked]
Date: Fri, 5 Dec 1997 11:47:26 -0500 (EST)

While recently setting up a firewall I learned about passive mode for
ftp.  It wasn't a happy finding as it would be preferable to keep ftp
services contained to the normal ftp and ftp-data ports.

If passive mode is disabled in the server will most (or all) popular ftp
clients and web browsers revert to using normal mode if an error message
is sent in response to the PASV command?

Is there any way of using ftpaccess to disable the PASV command with
wu-ftpd-2.4.2-beta-15 and if not might this be added in the near future?

Thanks!
Ty

-- 
Tyson D Sawyer                     Real World Interface, Inc.
Senior Systems Engineer            Robots for the Real World
[email-masked]                   http://www.rwii.com/

---

From: Michael Douglass <[email-masked]>
Date: Fri, 5 Dec 1997 10:55:32 -0600

On Fri, Dec 05, 1997 at 11:47:26AM -0500, [email-masked] said:

This is a commonly hit upon 'feature' of the ftp protocol.  I believe
we had this discussion a while back, and I know that there are at least
two patches floating around (check archives) for restricting the range
of ports that PASV connections will use.  In this way you can restrict
the ports to say 32000-32999 and open your firewall for those ports
only; saving you the hassle of a completely open policy.

-- 
Michael Douglass
Texas Networking, Inc.

 "The past is a foreign country; they do things differently there."
      L. P. Hartley, British author. The Go-Between, Prologue (1953).

---

From: [email-masked]
Date: Fri, 5 Dec 1997 12:04:06 -0500 (EST)

>  only; saving you the hassle of a completely open policy.

I found that and tried one of the patches.  There are two problems:

1) I would still prefer no PASV at all if that is practical.  I have
one report from email not related to this list that says you can return
the following and all clients (including Netscape) would revert back to
normal transers:

reply(525, "Can't open passive connection: Undefined error: 0.");

His patch returns this from the top of passive() and then returns from
the function.

2) The port range limiting patch I tried didn't work:

Dec  5 10:08:07 falcon in.ftpd.pasv[10110]: connect from [email-masked]
Dec  5 10:08:32 falcon ftpd[10110]: USER ftp
Dec  5 10:08:38 falcon ftpd[10110]: PASS [email-masked]
Dec  5 10:08:38 falcon ftpd[10110]: ANONYMOUS FTP LOGIN FROM 207.93.81.253 [207.93.81.253], [email-masked]
Dec  5 10:08:39 falcon ftpd[10110]: SYST
Dec  5 10:10:45 falcon ftpd[10110]: CWD /pub/linux/stuff
Dec  5 10:10:51 falcon ftpd[10110]: PASV
Dec  5 10:10:51 falcon ftpd[10110]: PASV trying 3637
Dec  5 10:10:51 falcon ftpd[10110]: PASV got 3637
Dec  5 10:10:52 falcon kernel: IP fw-in acc ppp2 TCP 207.93.81.253:1676 207.22.3.6:13582 L=44 S=0x00 I=57210 F=0x0000 T=46
Dec  5 10:10:52 falcon ftpd[10110]: LIST
Dec  5 10:11:41 falcon ftpd[10110]: TYPE Image
Dec  5 10:11:41 falcon ftpd[10110]: PASV
Dec  5 10:11:41 falcon ftpd[10110]: PASV trying 3655
Dec  5 10:11:41 falcon ftpd[10110]: PASV got 3655
Dec  5 10:11:41 falcon kernel: IP fw-in acc ppp2 TCP 207.93.81.253:1749 207.22.3.6:18190 L=44 S=0x00 I=57402 F=0x0000 T=46
Dec  5 10:11:42 falcon ftpd[10110]: RETR memtest86-1.1.lsm

Note that in each case the patch reports using one port yet connections
show up on an other.  I have no idea why this is.

If disabling PASV isn't a reasonable plan of action then I would like
to at least get port limiting to work.

Thanks!
Ty

---

From: Michael Douglass <[email-masked]>
Date: Fri, 5 Dec 1997 11:19:22 -0600

On Fri, Dec 05, 1997 at 12:04:06PM -0500, [email-masked] said:

If this is the case, can we get this ability placed into the wu-ftpd
server as an option to allow us to flag that we want to disable PASV
mode ftp?

> 2) The port range limiting patch I tried didn't work:

Heh, if you can find mine, I know it works. :)

> show up on an other.  I have no idea why this is.

What architecture are you using?  When assigning ports to the in_addr
structure you must use htons(portnum) because the TCP/IP specs mandate
this bit order in the structure.  I've hit this before when taking code
from a sparc and placing it onto an x86 architecture which has a different
byte order. :)

> to at least get port limiting to work.

My only problem was netscrape seemed to mandate it; but if returning
that error makes it resort back to regular mode, I'd be willing to
disable PASV mode! :)

-- 
Michael Douglass
Texas Networking, Inc.

---

From: [email-masked] (Josef Siemes)
Date: Wed, 10 Dec 1997 18:38:55 +0100 (NFT)

> that error makes it resort back to regular mode, I'd be willing to

My problem with accidentially disabling PASV (not enough devices in /dev,
using Solaris) was a FTP-Proxy somewhere in Australia. They insisted on
PASV-transfers, if these were not possible this proxy didn't get anything.

Netscape was fine, after getting the error it continued without PASV.

Regards,

Josef Siemes,
[email-masked]