Subject: Re: passive mode and firewalls

From: [email-masked]
Date: Mon, 8 Dec 1997 09:15:15 -0500 (EST)

On  8 Dec, Alan J Rosenthal wrote:
>  >If passive mode is disabled in the server will most (or all) popular ftp
>  >clients and web browsers revert to using normal mode if an error message
>  >is sent in response to the PASV command?
>  
>  Nope.  I think that people say that netscape uses the passive mode.

I have reports that Netscape will use normal mode if it recieves and
error for PASV.  I will be testing this soon.

>  I agree that this sucks.  So do Cheswick and Bellovin who include this in a
>  recommendation for protocol designers, that fixed port numbers should be used
>  wherever possible.
>  
>  I think that someone produced a patch for wu-ftpd which made it use ports for
>  passive connections only in a restricted range.  So then you could allow those
>  ports through your firewall, consider them to be like ftp-data.
>  It was posted to this mailing list reasonably recently and there are archives
>  somewhere as people periodically note.

That patch doesn't work for me (the version I used).  It was suggested
that and hton?() may be needed for my intel machine.  I will be trying
that also as it looks like a likely solution to be behavior I saw.

Thanks!
Ty

-- 
Tyson D Sawyer                     Real World Interface, Inc.
Senior Systems Engineer            Robots for the Real World
[email-masked]                   http://www.rwii.com/