Date: Thu, 22 Jun 2000 06:50:46 -0700 From: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca> To: cjclark@alum.mit.edu Cc: Jennifer Ulrich <pixie_styxx@hotmail.com>, freebsd-ipfw@FreeBSD.ORG Subject: Re: allowing passive ftp through ipfw Message-ID: <200006221351.e5MDpDN05578@cwsys.cwsent.com> In-Reply-To: Your message of "Wed, 21 Jun 2000 14:52:55 PDT." <20000621145255.I214@dialin-client.earthlink.net>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <20000621145255.I214@dialin-client.earthlink.net>, "Crist J. Clark" writes: > On Wed, Jun 21, 2000 at 04:50:09PM -0400, Jennifer Ulrich wrote: > > Hello all! > > > > I have a FreeBSD 3.4 box which runs ipfw, that is firewalling for a publicl > y > > reachable lan of servers, including FTP servers. When I set up the machine, > > > I made the FTP servers reachable by adding a rule for: > > > > ipfw add 1400 pass all from x.x.x.x/x to any > > ipfw add 2300 pass tcp from any to x.x.x.x 21 > > (x.x.x.x 21 being the address of the ftp server and a default rule allowin > g > > anything from my internal lan out through the firewall) > > > > I initially had some problems with clients on the lan not being able to > > establish FTP connections outbound, so I added this rule : > > > > ipfw 2300 pass tcp from any to x.x.x.x/x established > > [snip] > > > So how do I get passive FTP to work? I certainly would rather not punch a > > hole in the firewall to allow all traffic destined to the higher ports > > through to my FTP server. > > Having a rule like, > > ipfw add 2350 pass tcp from any 20 to x.x.x.x port_high1-port_high2 > > Is not really too much of a risk (I don't remember what the range of > valid ports is). Make sure you don't have anything you are not > comfortable with listening in that range. The rule to allow the > initial ftp connection is much, much more risky than the above. I vehemently disagree. It is a high risk because an attacker can connect to services running on ports >= 1024, e.g. Oracle. Even if you're not running any services >= 1024, it is trivial to scan your network to get a picture of what it looks like to plan a strategy of attack. IMO too much risk. > > > Is there another way to do accomplish this that is > > a bit more secure? > > Actually, this would be a good place for keep-state to work. I'm kinda > surprised that no one has added a keep-state method for FTP. It'd just > be, > > ipfw add 2350 pass tcp from any to x.x.x.x 21 setup keep-state ftp > > Right? Creating a dynamic rule that passes traffic from 20 to > x.x.x.x. From how I understand keep-state to work (and it is minimal, > sorry), it should not be too difficult to do? Agreed, under IPFW this cannot be done. Ideally this functionality should be in natd. It is possible to use IPFW with ipnat for FTP proxy of IP Filter. Of course that incurs the overhead of two firewalls in your kernel. Not an ideal solution but workable. I think that the FTP protocol, needs to be retired. It is old and not firewall friendly. HTTP can do everything that anonymous FTP can do. To replace regular FTP, use SSH. IMO the only place where the use of FTP is acceptable is within the confines of one's own network. Regards, Phone: (250)387-8437 Cy Schubert Fax: (250)387-5766 Team Leader, Sun/DEC Team Internet: Cy.Schubert@osg.gov.bc.ca Open Systems Group, ITSD, ISTA Province of BC To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200006221351.e5MDpDN05578>