ftp-gw(8)

NAME

ftp-gw - FTP proxy server

SYNOPSIS

ftp-gw [invoked from inetd]

DESCRIPTION

ftp-gw provides pass-through FTP proxy services with logging and access control. When ftp-gw is invoked from inetd(8), it reads its configuration and checks to see if the system that has just connected is permitted to use the proxy. If not, it shuts down with a message and logs the connection. If the peer is permitted to use the proxy, ftp-gw enters a command loop in which it parses all FTP requests and passes them to a remote FTP server. Any FTP request can be selectively logged or blocked by the proxy.

There are two mechanisms supported to permit users to specify the system they with to FTP to through the proxy. The most commonly used is encoding the destination system name in the username:

% ftp gatekeeper
Connected to gatekeeper.
220 gatekeeper FTP proxy (Version 1.0) ready.
Name (host:user): user@someplace
331-(----GATEWAY CONNECTED TO someplace----)
331-(220 someplace FTP server (Version 5.60/mjr) ready.)
331 Password required for user.
Password:
230 User user logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> quit
221 Goodbye.
%

A second means of specifying the remote through the proxy is via the passerve servername option, which causes the proxy to immediately connect to the specified remote system. This is useful in supporting modified ftp(1) clients that "understand" the proxy.

OPTIONS

-a autheduser this option is provided for versions of ftpd that may exec() the proxy if given a user@host type address, where the user has already authenticated to the ftpd. If this option is provided, ftp-gw will treat the session as if it has been authenticated as belonging to the specified user. If this option is enabled, care should be taken to ensure that the FTP gateway is running on a host with restricted access, to prevent local users from attempting to spoof the authentication. The version of ftpd used should only pass this parameter when the user has been adequately authenticated using strong authentication.

-u user@host this option provides a means for directly passing a user@host destination to the proxy, for versions of ftpd that recognize user@host addresses.

ftp-gw reads its configuration rules and permissions information from the firewall configuration table netperm-table, retrieving all rules specified for "ftp-gw". The following configuration rules are recognized:

userid user: specify a numeric user-id or the name of a password file entry. If this value is specified, ftp-gw will set its user-id before providing service. Note that this option is included mostly for completeness, as ftp-gw performs no local operations that are likely to introduce a security hole.

directory pathname: specifies a directory to which ftp-gw will chroot(2) prior to providing service.

denial-msg filename: specifies the name of a file to display to the remote user if they are denied permission to use the proxy. If this option is not set, a default message is generated. When the denial-msg file is displayed to the remote user, each line is prefixed with the FTP codes for permission denied.

welcome-msg filename: specifies the name of a file to display as a welcome banner upon successful connection. If this option is not set, a default message is generated.

help-msg filename: specifies the name of a file to display if the "help" command is issued. If this option is not set, a listing of the internal commands is printed.

denydest-msg filename: specifies the name of a file to display if a user attempts to connect to a remote server that they are not permitted to. If this option is not set, a default message is generated.

timeout secondsvalue: specifies the idle timeout value in seconds. When the specified number of seconds elapses with no activity through the proxy server, it will disconnect. If this value is not set, no timeout is enforced.

hosts host-pattern [host-pattern2...] [options]

rules specify host and access permissions. Typically, a hosts rule will be in the form of:

ftp-gw: deny-hosts unknown ftp-gw: hosts 192.33.112.* 192.94.214.* -log { retr stor }

There may be several host patterns following the "hosts" keyword, ending with the first optional parameter beginning with '-'. Optional parameters permit the selective enabling or disabling of logging information, etc. Sub-options are:

: -noinput specifies that no matter what, the proxy should not accept input over a PORT. Attempts to do so result in the port being closed.

: -nooutput specifies that no matter what, the proxy should not transmit output over a PORT. Attempts to do so result in the port being closed.

: -log operation
-log { operation1 operation2 ... }
specifies that a log entry to the system log should be made whenever the listed operations are performed through the proxy. (See ftpd(8) for a list of known FTP operations)

: -authall specifies that the proxy should permit no operation (other than the quit command) until the user has authenticated to the server.

: -auth operation
-auth { operation1 operation2 ... }
specifies that the operations listed should not be permitted until the user has authenticated to the server.

-dest pattern
-dest { pattern1 pattern2 ... }
specifies a list of valid destinations. If no list is specified, all destinations are considered valid. The -dest list is processed in order as it appears on the options line. -dest entries preceeded with a '!' character are treated as negation entries. Therefore the rule:

-dest !*.mit.edu -dest *

will permit hosts that are not in the domain "mit.edu" to be connected to.

: -deny operation
-deny { operation1 operation2 ... } specifies a list of FTP operations to deny. By default, all operations are permitted.

AUTHENTICATION

Unless the user is employing a version of the FTP client program that has support for authentication via challenge/response, the user will be required to employ the quote command to communicate directly with the proxy. For authentication, the proxy recognizes the following options:

authorize username
auth username (shorthand form)

response password
resp password (shorthand form)

If the proxy requires authentication, attempts to use the service requested will not be permitted.

% ftp gatekeeper
Connected to gatekeeper.
220 gatekeeper FTP proxy (Version 1.0 stable) ready.
Name (host:user): user@someplace
500 command requires user authentication
Login failed.
ftp> quote auth mjr
331 Challenge "655968"
ftp> quote response 822113
230 Login Accepted
ftp> user user@someplace
331-(----GATEWAY CONNECTED TO someplace----)
331-(220 someplace FTP server (Version 5.60/mjr) ready.)
331 Password required for user.
Password: 
[...]

It is an unfortunate side effect of using the quote command that passwords will be visible. If authentication is being used, it should be of a changing-password or token authentication form, to eliminate the threat of passwords being seen or tapped via a network.

INSTALLATION

To install ftp-gw first place the executable in a system area, then modify /etc/inetd.conf. The TCP service port on which to install the FTP proxy will depend on local site configuration. If the gateway machine that is to run the proxy does not require having local FTP service, then the proxy can be installed on the FTP service port. If this is not the case (e.g.: the firewall doubles as an anonymous FTP archive) then the proxy should be installed at another port. In order to use it there, the FTP client application ftp(1) must support use of an alternate service port. Most BSD UNIX versions of the FTP client do, but some PC or MacIntosh versions do not. Once inetd.conf has been modified, restart or reload inetd. Verify installation by attempting a connection, and monitoring the system logs.

Typical configuration of the proxy in a firewall situation involves rules to block all systems that are not in the DNS from using the proxy, but to permit all systems on the internal protected network to use the proxy. I.e.: