Subject: RE: normal ftp works, browser ftp dont

From: [email-masked]
Date: Thu, 3 Dec 1998 15:54:31 -0500

Running ANS firewall version 41M
.
---------------------- Forwarded by Jim Mowrer/Lex/Lexmark on 12/03/98 03:53 PM
---------------------------

[email-masked] on 12/03/98 03:23:16 PM

To:   [email-masked], Jim Mowrer@LEXMARK
cc:
Subject:  RE: normal ftp works, browser ftp dont

I believe that this could be a firewall probelm.  Are you running
a firewall, and if so, what version?

> ----------
> From:   [email-masked][SMTP:[email-masked]]
> Reply To:    [email-masked]
> Sent:   Thursday, December 03, 1998 12:11 PM
> To:     [email-masked]
> Subject:     normal ftp works, browser ftp dont
>
>
>
> Running beta 15 on an AIX box and getting this problem..  when normal ftp
> into
> box as a user,
> all is well. VIA any browser, I get logged on and put in my home
> directory, but
> I can not click on a file and have it ftp'd to me.  Get following error:
>
> FTP Transfer Failed
> The requested file or directory /C316-B3-981202.trim.gz could not be
> retrieved
> from ftp.lexmark.com
>
> It appears that we are chroot to our home directory and then the browser
> or
> WU_FTP looks in root (/) for file and of course does not find it.
>
> Proper premission are set and owned by right ID.. this has worked in past>
> any help out there ?    Jim
>
>
>
>
>
>

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 3 Dec 1998 16:19:35 -0500 (EST)

> > into box as a user, all is well. VIA any browser, I get logged on
> > and put in my home directory, but I can not click on a file and have
> > it ftp'd to me.  Get following error:

It does sound like you've got a firewall problem.  Most web browsers use
PASV to retrieve files (including directory listings).  In PASV mode, the
daemon opens a random non-privileged port (1024-65535) and awaits a
connection from the remote client (also from a non-privileged port).  The
problem is, this is very tough to handle with firewalls.

You could open the entire non-privileged port range on your firewall to
allow incoming connections.  In fact, without changing the daemon
software, that is the only way you'll get it to work.  It's best if you do
this that you assign an IP number solely for the FTP server so you can
open the smallest hole needed.

The VR series offers some help with this.  There are added configuration
commands which limit the port ranges chosen by the daemon, making the hole
in the firewall smaller yet.  Also, some networks use Network Address
Translation when passing through the firewall.  this gives FTP all sorts
of grief.  The VR series has additional options to assist with this
problem as well.

The current version of the VR series is VR11 and is available at:

  ftp://ftp.vr.net/pub/wu-ftpd/

in both patch, pre-patched tarball, and pre-compiled binary forms.

If your site is also in need of multiple virtual hosts, you will probably
also want to check out BeroFTPD (also available from my FTP site).
BeroFTPD has a much improved virtual hosting scheme (Kent Landfield's
NEWVIRT-050) and has most of the VR series changes as well.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Brett Goldstock <[email-masked]>
Date: Thu, 3 Dec 1998 18:11:02 -0500

I just loaded VR10 the other day and I _believe_ it might be the cause of
an upload problem. I've got an anonymous area with an "incoming" directory
set up as a blind dropoff area (chmod'd 1733). It used to be you could drop
files off in this directory but not see them there. Now I can't upload to
there logging in as anonymous. Changing the protection to 777 doesn't make
any difference.

I haven't changed anything with this setup recently and nothing is syslog
isn't reporting anything. Downloads still work fine. Can anyone confirm
this or maybe tell me what I'm doing wrong?

-Brett

|Brett M. Goldstock                               [email-masked]|
|Senior Technical Analyst/Sys Admin          http://www.tvdata.com|
|TVData                                               800/833-9581|
|                "We tell the world what's on TV."                |

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 3 Dec 1998 19:18:48 -0500 (EST)

On Thu, 3 Dec 1998, Brett Goldstock wrote:

> I just loaded VR10 the other day and I _believe_ it might be the cause
> of an upload problem. I've got an anonymous area with an "incoming"
> directory set up as a blind dropoff area (chmod'd 1733). It used to be
> you could drop files off in this directory but not see them there. Now
> I can't upload to there logging in as anonymous. Changing the
> protection to 777 doesn't make any difference.
> 
> I haven't changed anything with this setup recently and nothing is
> syslog isn't reporting anything. Downloads still work fine. Can anyone
> confirm this or maybe tell me what I'm doing wrong?

Probably the upload statement you had never worked and your didn't notice.
The VR series fixed a lot of problems with the upload clause.  I'd have to
see yours to tell what's wrong.

--

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 3 Dec 1998 19:32:16 -0500 (EST)

> see yours to tell what's wrong.

One change with the VR series recently was the permissions for anonymous
access changed from a default of "yes, you may" to "no, you may not" so if
your upload clause was never being used on the old software, the upload
appeared to work anyway and you probably protected the rest of the site
with permissions rather than the ftp configuration (I know I had to do it
that way).  Now, in VR10, you cannot upload as anonymous unless you match
an upload clause.

--