Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4186 > unrolled thread

Need help with iptables and ftp

Back to article view | Back to comp.os.linux.networking

Contents

  Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 15:39 -0700
    Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-24 16:11 -0700
    Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-25 07:23 +0000
      Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-25 23:13 -0700
        Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-08-26 11:35 +0200
          Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 14:05 -0700
            Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 00:02 +0000
              Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:11 -0700
                Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 02:00 +0000
                  Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 19:37 -0700
                  Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-26 22:59 -0400
                    Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 20:42 -0700
                      Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 00:29 -0400
                        Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 22:06 -0700
                          Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:47 +0000
                            Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:47 +0200
                    Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-27 09:44 +0000
                      Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-27 06:17 -0400
                      Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:21 -0700
                        Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-03 20:55 +0200
                    Re: Need help with iptables and ftp Scott Hemphill <hemphill@hemphills.net> - 2018-08-27 11:22 -0400
                    Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-27 12:18 -0700
            Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:44 -0700
        Re: Need help with iptables and ftp T <T@invalid.invalid> - 2018-08-26 17:43 -0700
    Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-28 11:28 +0000
      Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-29 05:38 +0000
        Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-08-29 10:13 +0300
        Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 09:52 +0000
          Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-29 12:13 +0000
            Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-29 12:27 +0000
              Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-29 11:14 -0400
                Re: Need help with iptables and ftp Aragorn <thorongil@telenet.be> - 2018-08-29 23:15 +0200
                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 10:35 +0200
                  Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-30 13:16 +0000
                    Re: Need help with iptables and ftp Richard Kettlewell <invalid@invalid.invalid> - 2018-08-30 16:15 +0100
                    Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-30 18:42 +0200
                      Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:31 +0000
                        Re: Need help with iptables and ftp Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-08-31 05:49 +0000
                        Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:48 +0200
                          Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 22:11 +0000
                            Re: Need help with iptables and ftp Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-09-01 09:56 +0300
                              Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 16:14 +0200
                                Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:00 +0200
                                  Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-04 20:36 +0200
                                    Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-05 10:25 +0200
                                      Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-05 20:30 +0200
                                        Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-06 00:03 +0200
                      Re: Need help with iptables and ftp Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-01 15:56 +0200
                        Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-09-01 19:18 +0000
                          Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-09-04 18:01 +0200
                  Re: Need help with iptables and ftp William Unruh <unruh@invalid.ca> - 2018-08-31 00:25 +0000
                    Re: Need help with iptables and ftp "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2018-08-30 20:34 -0400
                    Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 09:25 +0000
                      Re: Need help with iptables and ftp Wouter Verhelst <w@uter.be> - 2018-08-31 12:50 +0200
                        Re: Need help with iptables and ftp Dan Purgert <dan@djph.net> - 2018-08-31 11:13 +0000
                      Re: Need help with iptables and ftp Allodoxaphobia <knock_yourself_out@example.net> - 2018-08-31 12:30 +0000

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

#4206

"David W. Hodgins" <dwhodgins@nomail.afraid.org> writes:

[snip]

> I've intentionally set sshd to run on a high number port to avoid having
> script kiddies fill my logs with failed attempts (It's set to allow
> login with a key only, not a password).

Alternatively, or in addition to this, you might want to run knockd.
You can keep all ports closed, but when a particular sequence of ports
is accessed, you can dynamically open a particular port for your ssh
connection.

The default configuration file looks like:

------------------------------------------------------------------------
[OPTIONS]
	UseSyslog

[opencloseSSH]
	sequence      = 2222:udp,3333:tcp,4444:udp
	seq_timeout   = 15
	tcpflags      = syn,ack
	start_command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport ssh -j ACCEPT
	cmd_timeout   = 10
	stop_command  = /sbin/iptables -D INPUT -s %IP% -p tcp --dport ssh -j ACCEPT

------------------------------------------------------------------------

In my case, I have separate open and close sequences, with knockd
calling a script to run iptables with commands for port forwarding.  I
then use the PortKnock app on my iPhone when I want to ssh in.

Scott
-- 
Scott Hemphill	hemphill@alumni.caltech.edu
"This isn't flying.  This is falling, with style."  -- Buzz Lightyear

[toc] | [prev] | [next] | [standalone]

#4207

On 08/26/2018 07:59 PM, David W. Hodgins wrote:
> I've intentionally set sshd to run on a high number port to avoid having
> script kiddies fill my logs with failed attempts (It's set to allow
> login with a key only, not a password).

I do the same thing.  When I am running an Internet facing
service, I change the port number to cause confusion for the
script kiddies.

:-)

[toc] | [prev] | [next] | [standalone]

#4196

On 08/26/2018 02:05 PM, T wrote:
> 
>> On a server or router
>> iptables -t raw -A PREROUTING -p tcp --dport 21 -j CT --helper ftp
>>
>>> 3) in /etc/modprobe.d/iptables.conf add
>>>
>>>       nf_conntrack_ftp ports=21
>>
>> Syntax error. You must prepend "options" to the line.
>>
>> Port 21 is already the default, so you do not have to specify it.
> 
> Googling it told me otherwise.
> 
> Got no error massages about the syntax.
> 
> What is the proper syntax (write it out).
> 

My actual file had it in but my notes somehow dropped it.


 > 3) in /etc/modprobe.d/iptables.conf add
 >
 >       nf_conntrack_ftp ports=21
options nf_conntrack_ftp ports=21

[toc] | [prev] | [next] | [standalone]

#4195

 > 3) in /etc/modprobe.d/iptables.conf add
 >
 >       nf_conntrack_ftp ports=21

options nf_conntrack_ftp ports=21

[toc] | [prev] | [next] | [standalone]

#4210

T wrote:
> Hi All,
>
> Fedora 28
>
> # uname -r
> 4.17.12-200.fc28.x86_64
>
> Since switching from RHEL to Fedora 28, my iptables
> no longer tracks the high ports used by ftp.

I hope I didn't simply miss the discussion on it ... but why FTP in the
first place?  

It's not like anything's encrypted (unless you're using FTP/SSL?), so
even if you're moving ports around and whatnot, it's not like someone
can't simply be watching everything that gets transferred anyway --
inclusive of username/password.


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#4215

On Tue, 2018-08-28, Dan Purgert wrote:
> T wrote:
>> Hi All,
>>
>> Fedora 28
>>
>> # uname -r
>> 4.17.12-200.fc28.x86_64
>>
>> Since switching from RHEL to Fedora 28, my iptables
>> no longer tracks the high ports used by ftp.
>
> I hope I didn't simply miss the discussion on it ... but why FTP in the
> first place?  

I asked basically "why is something still using active FTP on your
systems, when mine haven't for a decade or so?" and I still wonder
about that.

> It's not like anything's encrypted (unless you're using FTP/SSL?), so
> even if you're moving ports around and whatnot, it's not like someone
> can't simply be watching everything that gets transferred anyway --
> inclusive of username/password.

There's anonymous FTP.  Hard to tell if some software on some system
of yours will want to use it.

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#4216

On 29.8.18 08:38, Jorgen Grahn wrote:
> On Tue, 2018-08-28, Dan Purgert wrote:
>> T wrote:
>>> Hi All,
>>>
>>> Fedora 28
>>>
>>> # uname -r
>>> 4.17.12-200.fc28.x86_64
>>>
>>> Since switching from RHEL to Fedora 28, my iptables
>>> no longer tracks the high ports used by ftp.
>>
>> I hope I didn't simply miss the discussion on it ... but why FTP in the
>> first place?
> 
> I asked basically "why is something still using active FTP on your
> systems, when mine haven't for a decade or so?" and I still wonder
> about that.
> 
>> It's not like anything's encrypted (unless you're using FTP/SSL?), so
>> even if you're moving ports around and whatnot, it's not like someone
>> can't simply be watching everything that gets transferred anyway --
>> inclusive of username/password.
> 
> There's anonymous FTP.  Hard to tell if some software on some system
> of yours will want to use it.
> 
> /Jorgen


For secure transfers, there is scp in the SSH suite. Plain old
FTP is pretty obsolete.

-- 

-TV

[toc] | [prev] | [next] | [standalone]

#4217

Jorgen Grahn wrote:
> On Tue, 2018-08-28, Dan Purgert wrote:
>> T wrote:
>>> Hi All,
>>>
>>> Fedora 28
>>>
>>> # uname -r
>>> 4.17.12-200.fc28.x86_64
>>>
>>> Since switching from RHEL to Fedora 28, my iptables
>>> no longer tracks the high ports used by ftp.
>>
>> I hope I didn't simply miss the discussion on it ... but why FTP in the
>> first place?  
>
> I asked basically "why is something still using active FTP on your
> systems, when mine haven't for a decade or so?" and I still wonder
> about that.
>
>> It's not like anything's encrypted (unless you're using FTP/SSL?), so
>> even if you're moving ports around and whatnot, it's not like someone
>> can't simply be watching everything that gets transferred anyway --
>> inclusive of username/password.
>
> There's anonymous FTP.  Hard to tell if some software on some system
> of yours will want to use it.

Sure, but until we get the answer of "why FTP", we're just making
assumptions, and (at least in my case) hoping we're making the wrong
ones.


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#4218

On 2018-08-29, Dan Purgert <dan@djph.net> wrote:
> Jorgen Grahn wrote:
>> On Tue, 2018-08-28, Dan Purgert wrote:
>>> T wrote:
>>>> Hi All,
>>>>
>>>> Fedora 28
>>>>
>>>> # uname -r
>>>> 4.17.12-200.fc28.x86_64
>>>>
>>>> Since switching from RHEL to Fedora 28, my iptables
>>>> no longer tracks the high ports used by ftp.
>>>
>>> I hope I didn't simply miss the discussion on it ... but why FTP in the
>>> first place?  
>>
>> I asked basically "why is something still using active FTP on your
>> systems, when mine haven't for a decade or so?" and I still wonder
>> about that.
>>
>>> It's not like anything's encrypted (unless you're using FTP/SSL?), so
>>> even if you're moving ports around and whatnot, it's not like someone
>>> can't simply be watching everything that gets transferred anyway --
>>> inclusive of username/password.
>>
>> There's anonymous FTP.  Hard to tell if some software on some system
>> of yours will want to use it.
>
> Sure, but until we get the answer of "why FTP", we're just making
> assumptions, and (at least in my case) hoping we're making the wrong
> ones.

It sounds to me like he has put a firewall ban on all higher ports. But
that also bans all passive ftp connections. So he wants to track his
machine's ftp responses on higher ports, so as not to ban all ftp (eg he
may be allowing annonymous ftp)


>
>

[toc] | [prev] | [next] | [standalone]

#4219

William Unruh wrote:
> On 2018-08-29, Dan Purgert <dan@djph.net> wrote:
>> Jorgen Grahn wrote:
>>> On Tue, 2018-08-28, Dan Purgert wrote:
>>>> T wrote:
>>>>> Hi All,
>>>>>
>>>>> Fedora 28
>>>>>
>>>>> # uname -r
>>>>> 4.17.12-200.fc28.x86_64
>>>>>
>>>>> Since switching from RHEL to Fedora 28, my iptables
>>>>> no longer tracks the high ports used by ftp.
>>>>
>>>> I hope I didn't simply miss the discussion on it ... but why FTP in the
>>>> first place?  
>>>
>>> I asked basically "why is something still using active FTP on your
>>> systems, when mine haven't for a decade or so?" and I still wonder
>>> about that.
>>>
>>>> It's not like anything's encrypted (unless you're using FTP/SSL?), so
>>>> even if you're moving ports around and whatnot, it's not like someone
>>>> can't simply be watching everything that gets transferred anyway --
>>>> inclusive of username/password.
>>>
>>> There's anonymous FTP.  Hard to tell if some software on some system
>>> of yours will want to use it.
>>
>> Sure, but until we get the answer of "why FTP", we're just making
>> assumptions, and (at least in my case) hoping we're making the wrong
>> ones.
>
> It sounds to me like he has put a firewall ban on all higher ports. But
> that also bans all passive ftp connections. So he wants to track his
> machine's ftp responses on higher ports, so as not to ban all ftp (eg he
> may be allowing annonymous ftp)

And that's what the enquiries were about -- "what's the usecase for this
FTP server in the first place?"


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#4220

On Wed, 29 Aug 2018 08:27:19 -0400, Dan Purgert <dan@djph.net> wrote:

> William Unruh wrote:
>> It sounds to me like he has put a firewall ban on all higher ports. But
>> that also bans all passive ftp connections. So he wants to track his
>> machine's ftp responses on higher ports, so as not to ban all ftp (eg he
>> may be allowing annonymous ftp)

> And that's what the enquiries were about -- "what's the usecase for this
> FTP server in the first place?"

I agree that is the question. As to the questions of why use ftp instead
of something secure, there are many times where publicly shared files
have no need for security, so ftp is the lowest overhead option for
those transfers. For example, ftp://mirror.cedia.org.ec/

Regards, Dave Hodgins

-- 
Change dwhodgins@nomail.afraid.org to davidwhodgins@teksavvy.com for
email replies.

[toc] | [prev] | [next] | [standalone]

#4222

On Wednesday 29 August 2018 17:14, David W. Hodgins conveyed the 
following to comp.os.linux.networking...

> On Wed, 29 Aug 2018 08:27:19 -0400, Dan Purgert <dan@djph.net> wrote:
> 
>> William Unruh wrote:
>>
>>> It sounds to me like he has put a firewall ban on all higher ports.
>>> But that also bans all passive ftp connections. So he wants to track
>>> his machine's ftp responses on higher ports, so as not to ban all
>>> ftp (eg he may be allowing annonymous ftp)
> 
>> And that's what the enquiries were about -- "what's the usecase for
>> this FTP server in the first place?"
> 
> I agree that is the question.

No, no, no, to be or not to be, THAT is the question.  Sir Francis 
Bacon, um, I mean, William Shakespeare said so! :p
 
-- 
With respect,
= Aragorn =

[toc] | [prev] | [next] | [standalone]

#4224

On 8/29/18 5:14 PM, David W. Hodgins wrote:
> As to the questions of why use ftp instead
> of something secure, there are many times where publicly shared files
> have no need for security, so ftp is the lowest overhead option for
> those transfers.

No, HTTP is. FTP, with is two ports, incurs a high amount of overhead on
all middle boxes for no particularly good reason.

FTP must die.

[toc] | [prev] | [next] | [standalone]

#4225

On Thu, 2018-08-30, Wouter Verhelst wrote:
> On 8/29/18 5:14 PM, David W. Hodgins wrote:
>> As to the questions of why use ftp instead
>> of something secure, there are many times where publicly shared files
>> have no need for security, so ftp is the lowest overhead option for
>> those transfers.
>
> No, HTTP is. FTP, with is two ports, incurs a high amount of overhead on
> all middle boxes for no particularly good reason.
>
> FTP must die.

Other possible points of view:
- Middle boxes must die.
- IPv4 must die.

(Not that I'm a big fan of FTP, especially not the "please dump your
data on <addr:port>" part, or the cleartext auth part.)

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#4226

Jorgen Grahn <grahn+nntp@snipabacken.se> writes:
> On Thu, 2018-08-30, Wouter Verhelst wrote:
>> On 8/29/18 5:14 PM, David W. Hodgins wrote:
>>> As to the questions of why use ftp instead of something secure,
>>> there are many times where publicly shared files have no need for
>>> security, so ftp is the lowest overhead option for those transfers.
>>
>> No, HTTP is. FTP, with is two ports, incurs a high amount of overhead on
>> all middle boxes for no particularly good reason.
>>
>> FTP must die.
>
> Other possible points of view:
> - Middle boxes must die.
> - IPv4 must die.

All three. l-)

> (Not that I'm a big fan of FTP, especially not the "please dump your
> data on <addr:port>" part, or the cleartext auth part.)

It should have been killed off some time in the 1990s. Ridiculous
protocol.

-- 
https://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#4227

On 8/30/18 3:16 PM, Jorgen Grahn wrote:
> On Thu, 2018-08-30, Wouter Verhelst wrote:
>> On 8/29/18 5:14 PM, David W. Hodgins wrote:
>>> As to the questions of why use ftp instead
>>> of something secure, there are many times where publicly shared files
>>> have no need for security, so ftp is the lowest overhead option for
>>> those transfers.
>>
>> No, HTTP is. FTP, with is two ports, incurs a high amount of overhead on
>> all middle boxes for no particularly good reason.
>>
>> FTP must die.
> 
> Other possible points of view:
> - Middle boxes must die.

Middle boxes are not just NAT machines, they're also things like routers
 and firewalls. You do want the former, otherwise you just have a bunch
of LANs and no Internet. You do want the latter, because... well, reasons.

Everything which needs to inspect traffic (which definitely includes
firewalls, and sometimes also includes routers, not just for NAT) hates FTP.

Also, because of the required deep inspection, two of the three forms of
encrypted FTP are doomed (sftp isn't, because that uses SSH and thus a
single TCP connection -- but then sftp also isn't really FTP).

> - IPv4 must die.

Well, yes. But FTP "works" over IPv6 too, with similar problems.

> (Not that I'm a big fan of FTP, especially not the "please dump your
> data on <addr:port>" part, or the cleartext auth part.)

Exactly, that's my point.

[toc] | [prev] | [next] | [standalone]

#4231

On 2018-08-30, Wouter Verhelst <w@uter.be> wrote:
> On 8/30/18 3:16 PM, Jorgen Grahn wrote:
>> On Thu, 2018-08-30, Wouter Verhelst wrote:
>>> On 8/29/18 5:14 PM, David W. Hodgins wrote:
>>>> As to the questions of why use ftp instead
>>>> of something secure, there are many times where publicly shared files
>>>> have no need for security, so ftp is the lowest overhead option for
>>>> those transfers.
>>>
>>> No, HTTP is. FTP, with is two ports, incurs a high amount of overhead on
>>> all middle boxes for no particularly good reason.
>>>
>>> FTP must die.
>> 
>> Other possible points of view:
>> - Middle boxes must die.
>
> Middle boxes are not just NAT machines, they're also things like routers
>  and firewalls. You do want the former, otherwise you just have a bunch
> of LANs and no Internet. You do want the latter, because... well, reasons.
>
> Everything which needs to inspect traffic (which definitely includes
> firewalls, and sometimes also includes routers, not just for NAT) hates FTP.

?? I would think that making it has hard as possible to inspect trafffic
After alll that is the whole point of encryption to make that impossible
>
> Also, because of the required deep inspection, two of the three forms of
> encrypted FTP are doomed (sftp isn't, because that uses SSH and thus a
> single TCP connection -- but then sftp also isn't really FTP).
>O
This soulds like speccial pleading-- " If I like it, it really isn't
that which I hate".

>> - IPv4 must die.
>
> Well, yes. But FTP "works" over IPv6 too, with similar problems.
>
>> (Not that I'm a big fan of FTP, especially not the "please dump your
>> data on <addr:port>" part, or the cleartext auth part.)
>
> Exactly, that's my point.

All protoccols say "pleaase dump your data on <addr:port>" What
difference does it make if it is the same addr:port as the request came
from or not?

Clear text auth is  clearly a problem, but irrelevant to annonymous ftp.

[toc] | [prev] | [next] | [standalone]

#4233

On Fri, 2018-08-31, William Unruh wrote:
> On 2018-08-30, Wouter Verhelst <w@uter.be> wrote:
>> On 8/30/18 3:16 PM, Jorgen Grahn wrote:
...
>>> (Not that I'm a big fan of FTP, especially not the "please dump your
>>> data on <addr:port>" part, or the cleartext auth part.)
>>
>> Exactly, that's my point.
>
> All protoccols say "pleaase dump your data on <addr:port>" What
> difference does it make if it is the same addr:port as the request came
> from or not?

I wrote that, but now I'm not sure why.  As far as I can tell it's a
problem only if the server and client aren't "equal internet
citizens", and I was (kind of) arguing against such a setup.

I suppose it made sense for the protocol to separate the slow command
stream and the data stream.

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#4235

On 8/31/18 2:31 AM, William Unruh wrote:
> On 2018-08-30, Wouter Verhelst <w@uter.be> wrote:
>> On 8/30/18 3:16 PM, Jorgen Grahn wrote:
>>> On Thu, 2018-08-30, Wouter Verhelst wrote:
>>>> On 8/29/18 5:14 PM, David W. Hodgins wrote:
>>>>> As to the questions of why use ftp instead
>>>>> of something secure, there are many times where publicly shared files
>>>>> have no need for security, so ftp is the lowest overhead option for
>>>>> those transfers.
>>>>
>>>> No, HTTP is. FTP, with is two ports, incurs a high amount of overhead on
>>>> all middle boxes for no particularly good reason.
>>>>
>>>> FTP must die.
>>>
>>> Other possible points of view:
>>> - Middle boxes must die.
>>
>> Middle boxes are not just NAT machines, they're also things like routers
>>  and firewalls. You do want the former, otherwise you just have a bunch
>> of LANs and no Internet. You do want the latter, because... well, reasons.
>>
>> Everything which needs to inspect traffic (which definitely includes
>> firewalls, and sometimes also includes routers, not just for NAT) hates FTP.
> 
> ?? I would think that making it has hard as possible to inspect trafffic
> After alll that is the whole point of encryption to make that impossible

I should clarify.

There is inspection, and there is deep inspection.

With "inspection", I mean that a middle box looks at (and possibly
changes) the (unencrypted) IP headers: source/destination address,
source/destination port, TCP flags etc, but nothing else. With those
things, it can reliably follow the state of the connection. Machine
which do NAT, firewalls, and sometimes also routers, need to do that in
order to do their job. There is also nothing wrong with this; in fact,
if we were to encrypt the IP and TCP headers, nothing would work anymore
and things would go very very wrong.

With "deep inspection", I mean to say that you do more than just look at
those fields; you also look at the application layer data that flows
through the network in order to be able to figure out which connections
are expected. In order to be able to properly NAT an FTP connection, you
absolutely need to do deep inspection.

I agree with you that that is undesirable. I agree with you that
encryption is a good thing, and that we should encrypt as much as possible.

However, if you want encryption to not fuck up your connection, then you
cannot use FTP, because in order for it to work properly in the face of
middle boxes, you cannot combine FTP and encryption.

This is why I said that FTP should die ;-)

>> Also, because of the required deep inspection, two of the three forms of
>> encrypted FTP are doomed (sftp isn't, because that uses SSH and thus a
>> single TCP connection -- but then sftp also isn't really FTP).
>> 
> This soulds like speccial pleading-- " If I like it, it really isn't
> that which I hate".

I'm not sure what you mean by that, but I suspect you misunderstood what
I meant in the first place ;-)

>>> - IPv4 must die.
>>
>> Well, yes. But FTP "works" over IPv6 too, with similar problems.
>>
>>> (Not that I'm a big fan of FTP, especially not the "please dump your
>>> data on <addr:port>" part, or the cleartext auth part.)
>>
>> Exactly, that's my point.
> 
> All protoccols say "pleaase dump your data on <addr:port>" What
> difference does it make if it is the same addr:port as the request came
> from or not?

FTP says "please open a new TCP connection on <addr:port> and dump your
data there". This is awful.

> Clear text auth is  clearly a problem, but irrelevant to annonymous ftp.

Sure.

[toc] | [prev] | [next] | [standalone]

#4239

On 2018-08-31, Wouter Verhelst <w@uter.be> wrote:
:
> FTP says "please open a new TCP connection on <addr:port> and dump your
> data there". This is awful.

Why is this awful?

[toc] | [prev] | [next] | [standalone]

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

Back to top | Article view | comp.os.linux.networking

csiph-web