RE: A note about firewalls and ftp servers.

From: Mark Boddington (mark.boddington@net800.co.uk)
Date: 09/28/01 

From: "Mark Boddington" <mark.boddington@net800.co.uk>
To: "Bugtraq - Focus Linux" <focus-linux@securityfocus.com>
Subject: RE: A note about firewalls and ftp servers.
Date: Fri, 28 Sep 2001 12:10:05 +0100
Message-ID: <NFBBIGCCBMKGMIBILGDGKEJLCEAA.mark.boddington@net800.co.uk>

Hi,

> Solution: Either set up iptables to accept traffic on port 20, or set up
> connection tracking and allow iptables to accept related and established
> connections.

Be careful. Port 20 could be at either end of the connection depending on
how the passive flag is set within the ftp session. The danger with setting
you firewall to allow packets in from and out to port 20 is it allows people
to portscan your hosts by using port 20 as their source port for every probe
(nmap has this ability). The only solution I would personally use is the
later one, but dont forget to insmod ipt_ftp_conntrack, the standard
connection tracking module doesn't cover ftp data.

Mark Boddington
Unix Systems Administrator

Relevant Pages

  • Re: Ive been hacked, found mldonkey running
    ... General Schvantzkoph writes: ... ]>> Does anyone know if Linksys routers are adequate firewalls? ... I had the FTP ... ]>> as the internet port. ...
    (comp.os.linux.security)
  • Re: For Lance
    ... Port 21 isn't the only one that's used for FTP. ... I suggest temprarily dropping firewalls on your LAN and try FTP'ing back and forth using just your LAN computers. ... Once you get FTP working without firewalls, raise the firewalls, make firewall exceptions and troubleshoot it again. ...
    (microsoft.public.inetserver.iis.ftp)
  • Re: How safe are FTP servers?
    ... Partly because it's a PITA when firewalls are involved. ... The FTP protocol is a little bizarre in its use of ports. ... the data traffic flows on another port. ... control session to tell it which port to use. ...
    (comp.os.linux.security)
  • Re: Ive been hacked, found mldonkey running
    ... >> Does anyone know if Linksys routers are adequate firewalls? ... I had the FTP ... >> as the internet port. ... This is a home office network. ...
    (comp.os.linux.security)
  • Re: Firewall config 2
    ... I'm not familiar with configuring the Alcatel, but in general with firewalls ... you can try a connection and then check your logs to see what port or ports ... on whether passive or active FTP are being used by the client and server. ...
    (comp.security.firewalls)