Subject: Re: SSH tunneling vs. wu-ftpd

From: James McMahon <[email-masked]>
Date: Thu, 22 Jul 1999 14:27:01 +1000

Gary,

I believe that this was discussed in the list not so long ago, so the
archives will probably provide more complete information than me.

Gary Casterline wrote:
> 
> Hello,
> 
> I'm trying to use port forwarding in Data Fellows F-secure SSH to hide
> the password exchange when connecting to wuftp-2.5.0 on a solaris 2.6
> server.
> The authentication succeeds, but the directory listing fails.
> The same setup works when connecting to a server running NcFTPd Server.
> 

I believe that this is caused by a "feature" that Gregory Lundberg put
into wu-ftpd in order to make it harder to "hi-jack" a passive ftp
session by connecting to the chosen hi port after it has been decided
and before the real machine can connect to it.

This feature requires that the data connection be established from the
same machine as the control connection.  Hence if you are using SSH port
forwarding, the data and control connections will be coming from
different ports and hence the data connections will be rejected by the
ftp server.

[client log transcript deleted]

> Has anyone else gotten this to work with wu-2.5.0?
> Any pointers on what I might change in a config file or even in
> the code to enable this tunneling?  What are the securtity implications?
> Maybe I should just use the guest features and simplify my life.
> 
> Thanks,
> 
>  _Gary

Hope this helps,

James

-- 
***************************************************************************
*     James McMahon                  *     When all else fails
...        *
*     Secure Gateway Environment     *     Read the
destructions.         *
*     [email-masked]          *             --
(unknown)           *
***************************************************************************

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 22 Jul 1999 02:58:26 -0400

On Thu, Jul 22, 1999 at 02:27:01PM +1000, James McMahon wrote:

> > server.  The authentication succeeds, but the directory listing fails.
> session by connecting to the chosen hi port after it has been decided and
> before the real machine can connect to it.
> 
> > Has anyone else gotten this to work with wu-2.5.0?  Any pointers on
> > what I might change in a config file or even in the code to enable this
> > tunneling?  What are the securtity implications?  Maybe I should just
> > use the guest features and simplify my life.

Yes, this was discussed.  In 2.5.0 this is not possible.  In 2.6.0 it will
be configurable in the ftpaccess file.  Here's the manpage section which
will be in 2.6.0:

       pasv-allow <class> [<addrglob> ...]

       port-allow <class> [<addrglob> ...]

	    Normally, the daemon does not allow a PORT command to specify
	    an address different than that of the control connection.  And
	    it does not allow a PASV connection from another address.

	    The port-allow clause provides a list of addresses which the
	    specified class of user may give on a PORT command.  These
	    addresses will be allowed even if they do not match the
	    IP-address of the client-side of the control connection.

	    The pasv-allow clause provides a list of addresses which the
	    specified class of user may make data connections from.  These
	    addresses will be allowed even if they do not match the
	    IP-address of the client-side of the control connection.

An example:

    # SSH-tunnelled users appear from localhost (yuck!)
    class sshuser real,guest 127.0.0.0/8

    # SSH-tunnelled users are only on the LAN using internal IP numbers
    # (yea!)
    pasv-allow sshuser 10.0.0.0/8
    port-allow sshuser 10.0.0.0/8

2.6.0 is currently in active development.  I am making this change
available to those who wish to test it by emailing a request directly to
me.

-- 

Gregory A Lundberg              WU-FTPD Development Group
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195