Subject: ssh tunneling ftp unix -> unix

From: John McDermon <[email-masked]>
Date: Fri, 24 Jul 1998 15:32:07 -0600

Hi all,
I've been using a Mac/PC ssh client to setup secure tunnels for ftp traffic
between my Mac (or PC) and my UNIX server. Now I need to do it from UNIX to
UNIX. It seems that the Mac/PC clients are doing something to handle the
DATA port negotiation that I will have to do on my own here.

These are my steps:

As root on my UNIX machine I type
    ssh 21:ftpserver:21 ftpserver

When I've coompleted logging in my tunnel is ready. I then go to another
window as a regular user and type:
    ftp localhost

The tunnel picks up the traffic and forwards it securely to ftpserver where
I login as that user.

I know I need to be in passive mode of the FTP client so I type:
  quote

Then PASV to enter passive mode and I get acknowledgement that I'm in
passive mode. Now here's the trouble.

when I try an FTP command like "ls" I get the following error:
  500 Illegal PORT Command
  500 Can't build data connection: no PORT specified

So what do I need to do with the PORT command to specify a dataport and
does this need to be done on the server of client?

TIA,
--John

+-------------------------------------------------+
| John McDermon,    voice mail 7-7315  Fax 5-1002 |
| CIC-2, MS B215     cell 699-4910, page 104-8665 |
+-------------------------------------------------+

---

From: Gregory A Lundberg <[email-masked]>
Date: Sat, 25 Jul 1998 09:59:33 -0400 (EDT)

> does this need to be done on the server of client?

First, it looks like the client you're using sends a PORT before LIST or
NLST with the 'ls' command.  Try using QUOTE LIST and telnetting to the
passive data port by hand.

Second, it looks like the IP address being sent by the client with PORT
does not match the IP address the daemon sees the control connection as
coming from.  By default, wu-ftpd does not allow this (valid) use of the
protocol.  To re-enable it, you'll need to hack the source to remove the
check.  Think carefully about doing that, though, since it opens your ftp
server up to being used for all kinds of interesting stuff by warez and
hacker kiddies.

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195