Re: Passive mode FTP under Solaris 10?

On Fri, 08 Dec 2006 05:43:08 -0500
Kevyn Ford <kbford@xxxxxxxxxxxx> wrote:

After spending a bit of time learning more about Active .vs Passive
mode FTP - more than this software developer ever wanted to learn -
I've come to understand that I need to specify a range of high ports
to be used in Passive mode...no problem there.

But how do I configure the out-of-the-box Solaris 10 ftpd to specify
that range? I need to be able to setup the corresponding port
forwarding range in my Linksys router but I can't seem to find
information on specifying that range for ftpd.

There seems to be alternate ftp server software that's easy to
configure...but I'd rather not replace the default unless absolutlely
necessary...

Any suggestions?

Read the ftpaccess(4) man page, where you will find the following:

passive address externalip cidr

Allow control of the address reported in response to a
passive command. When any control connection matching
cidr requests a passive data connection (PASV), the
externalip address is reported. This does not change the
address that the daemon actually listens on, only the
address reported to the client. This feature allows the
daemon to operate correctly behind IP renumbering
firewalls. For example:

passive address 10.0.1.15 10.0.0.0/8
passive address 192.168.1.5 0.0.0.0/0

Clients connecting from the class-A network 10 will be
told the passive connection is listening on IP address
10.0.1.15 while all others will be told the connection
is listening on 192.168.1.5. Multiple passive addresses
may be specified to handle complex, or multi-gatewayed,
networks.

passive ports cidr min max

Allows control of the TCP port numbers which may be used
for a passive data connection. If the control connection
matches the cidr, a port in the range min to max will be
randomly selected for the daemon to listen on. This
feature allows firewalls to limit the ports that remote
clients may use to connect into the protected network.

cidr is shorthand for an IP address followed by a slash
and the number of left-most bits that represent the net-
work address, as opposed to the machine address. For
example, if you are using the reserved class-A network
10, instead of a netmask of 255.0.0.0, use a CIDR of /8,
as in 10.0.0.0/8, to represent your network.
When min and max are both 0, the kernel rather than the
FTP server selects the TCP port to listen on. Kernel
port selection is usually not desirable if the kernel
allocates TCP ports sequentially. If in doubt, let the
FTP server do the port selection.

Take care,

--
Stefaan A Eeckels
--
Isn't it amazing how a large number of evil morons can give the
appearance of being a single evil genius? --Mel Rimmer
.

Relevant Pages

  • RE: Telnet/ftp problems SBS2000
    ... Please make sure your client computers are configured as both Firewall ... will find two options "Enable folder view for FTP sites" and "Use Passive ... that the control connection has been successfully established, ... (other than port 21) ...
    (microsoft.public.windows.server.sbs)
  • Re: IPSwitch, Inc. WS_FTP Server
    ... > bounce attack as well as PASV connection hijacking. ... > The FTP bounce vulnerability allows a remote attacker to cause the ... > anonymously along with any internal addresses that the FTP server has ... That means it's got to handle a PORT ...
    (Bugtraq)
  • RE: FTP Window of opportunity?
    ... target on the line when in reality it was just a firewall lying to them. ... The connection connects and then immediately ... Subject: FTP Window of opportunity? ... the FTP port shows up. ...
    (Pen-Test)
  • Re: Iptables FTP question
    ... think all other related would be from specific modules,the FTP and IRC ... Keep in mind that connection ... source port of 20 if it is for port mode data connections(for a standard ... I would also break down your rules into chains instead of appending such ...
    (comp.security.firewalls)
  • Re: Passive means what during FTP?
    ... :227 Entering Passive Mode ... :ftp: connect: No route to host ... The FTP data transfer uses a connection that is separate from the ... address and port number to connect to for the data transfer. ...
    (comp.os.linux.setup)