Solved

Problems with Passive mode on PROFTP behind firewall

Posted on 2001-07-17
6
1,547 Views
Last Modified: 2013-12-16
I have a problem where I cannot connect to a proftp server in passive mode behind a firewall, the /var/messages file reports SECURITY VIOLATION: Passive connection from x.x.x.x rejected when the server tries to initiate passive mode.

Non passive mode connections are fine, but I have some customers who need passive mode.

I have set the passive ports directive in proftpd.conf, and ensured that the relevant ports are open on the firewall, but still can't get the server to do anything useful in passive mode. It eventually times out, saying that no transfer has taken place.

Please help.
0
Comment
Question by:dredmann
  • 3
  • 2
6 Comments
 
LVL 1

Expert Comment

by:rcm9445
ID: 6289948
Try using tcp/ip wrappers to send the packets thru port 80 instead of port 23.
0
 
LVL 14

Accepted Solution

by:
chris_calabrese earned 200 total points
ID: 6290057
What kind of firewall do you have?  If it is a non-transparent application proxy such as Raptor, it may be chaning the aparent IP address of some of the packets.  This may be causing the security violation the software is complaining about.
0
 

Author Comment

by:dredmann
ID: 6290456
The firewall is by borderware.
The actual message reported is:

1.1.1.1 (gateway-ext.central.smartways.com[2.2.2.2]) - SECURITY VIOLATION: Passive connection from 3.3.3.3 rejected.


I've replaced the ip addresses for security reasons:
1.1.1.1 The host ftp server
2.2.2.2 IP of external side of clients firewall
3.3.3.3 IP of Internal side of our firewall

The ftp connection is being initiated inside the client's firewall.
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 14

Expert Comment

by:chris_calabrese
ID: 6290722
This is exactly the type of thing I was talking about.  The firewall intercepts the data traffic, making the ftp server see its IP address as the originating address for the packets.

The only way to solve this problem is to fix your firewall (or perhaps configure proftpd not to be concerned with this, but it's probably a problem for your clients too).
0
 

Author Comment

by:dredmann
ID: 6292764
Chris, how would you suggest that I go about making Proftp not care about the addresses getting changed?
0
 
LVL 14

Expert Comment

by:chris_calabrese
ID: 6293936
Never used proftp, so I can't tell you.  However this firewall behavior is likely to cause problems for your clients too, so the real answer is fixing the firewall.  I'd contact the firewall vendor to see if they have a solution to this problem.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Daily system administration tasks often require administrators to connect remote systems. But allowing these remote systems to accept passwords makes these systems vulnerable to the risk of brute-force password guessing attacks. Furthermore there ar…
The purpose of this article is to demonstrate how we can use conditional statements using Python.
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now