RE: [suse-security] NT-ftp through linux machine suggestions
Kurt, First of all thanks for the advice/help you gave so far. But I still have some issues...
The problem I have is that I can't get my ftp-forwarding to work. If I use ftp through the browser it works but if I try to use ftp directly it doesn't, not from the NT-machine or from an other linux-box hooked up to my server.
Welcome to the wonderful wacky world of ftp. Passive and active FTP, sounds like the firewalling breaks one,
It is probably "just" a squid problem but I'm not very familiar with squid and need to get this to work. I'm aware that allowing ftp-forwarding is a potential security risk but there is no other way to do this...I think.
I have this exact same setup, I have an NT server with frontpage, I use frontpage to edit my web docs (I'm a truly lazy bastard), but i need to get those docs out to web sites on a regular basis. My solution is to enable ftp on the NT box and have the Linux box synchronize all the ftp files once an hour (you could easily do it more often). From the Linux box I can grab the files via ftp, rsync, etc. If you want "realtime" updates simple install Samba on the Linux box, mount the NT drive with the web docs and then make that available via ftp. This way the NT box is not exposed at all to the outside world, def. a good thing.
I've already using samba, so there I'm o.k. And I guess enabling ftp on the NT-WORKSTATION means getting the passive/active ftp problem fixed. Do you or anyone elso no a "safe" configuration to get squid/SuSE firewall to allow both ftp's. I'm sort of new to linux networking and don't want to open it all up... Dreamweaver uses the ftp that's using port 21. A ftp-proxy can be specified but I don't know if I really need one. I don't allow ftp access to my machine. I only want to allow outgoing ftp.
Please help me out with this. Maurits de Loë
Kurt Seifried SecurityPortal, your focal point for security on the net http://www.securityportal.com/
"De Loe, Maurits" wrote:
Kurt,
First of all thanks for the advice/help you gave so far. But I still have some issues...
The problem I have is that I can't get my ftp-forwarding to work. If I use ftp through the browser it works but if I try to use ftp directly it doesn't, not from the NT-machine or from an other linux-box hooked up to my server.
Welcome to the wonderful wacky world of ftp. Passive and active FTP, sounds like the firewalling breaks one,
It is probably "just" a squid problem but I'm not very familiar with squid and need to get this to work. I'm aware that allowing ftp-forwarding is a potential security risk but there is no other way to do this...I think.
I have this exact same setup, I have an NT server with frontpage, I use frontpage to edit my web docs (I'm a truly lazy bastard), but i need to get those docs out to web sites on a regular basis. My solution is to enable ftp on the NT box and have the Linux box synchronize all the ftp files once an hour (you could easily do it more often). From the Linux box I can grab the files via ftp, rsync, etc. If you want "realtime" updates simple install Samba on the Linux box, mount the NT drive with the web docs and then make that available via ftp. This way the NT box is not exposed at all to the outside world, def. a good thing.
I've already using samba, so there I'm o.k. And I guess enabling ftp on the NT-WORKSTATION means getting the passive/active ftp problem fixed. Do you or anyone elso no a "safe" configuration to get squid/SuSE firewall to allow both ftp's. I'm sort of new to linux networking and don't want to open it all up... Dreamweaver uses the ftp that's using port 21. A ftp-proxy can be specified but I don't know if I really need one. I don't allow ftp access to my machine. I only want to allow outgoing ftp.
Please help me out with this. Maurits de Loë
Kurt Seifried SecurityPortal, your focal point for security on the net http://www.securityportal.com/
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
Hi Maurits, Take a look at the attached snippet from a typical "rc.firewall". It may assist in getting your FTP clients working. Cheers - Les Catterall # # Snippet from "rc.firewall" # # Derived from Robert Ziegler, "Linux Firewalls". # EXTERNAL_INTERFACE="<Internet-Connected-Interface>" IPADDR="<Your-IP-Address>" UNPRIVPORTS="1024:65535" ANYWHERE="any/0" INTERNAL_NET="192.168.x.y/24" # # Required Module. # modprobe ip_masq_ftp # # Masquerade Internal Traffic. # ipchains -A forward -i $EXTERNAL_INTERFACE -s $INTERNAL_NET -j MASQ : : ##### # # Enable FTP Client. # ##### # # Allow Local Client Requests. # ipchains -A output -i $EXTERNAL_INTERFACE -p tcp \ -s $IPADDR $UNPRIVPORTS \ -d $ANYWHERE 21 -j ACCEPT # # Allow Remote Server Responses to Local Client Requests. # ipchains -A input -i $EXTERNAL_INTERFACE -p tcp ! -y \ -s $ANYWHERE 21 \ -d $IPADDR $UNPRIVPORTS -j ACCEPT #- # # Allow Remote Server Initiated Normal Port Mode FTP Data Channels. # ipchains -A input -i $EXTERNAL_INTERFACE -p tcp \ -s $ANYWHERE 20 \ -d $IPADDR $UNPRIVPORTS -j ACCEPT ipchains -A output -i $EXTERNAL_INTERFACE -p tcp ! -y \ -s $IPADDR $UNPRIVPORTS \ -d $ANYWHERE 20 -j ACCEPT #- # # Allow Local Client Initiated Passive Port Mode FTP Data Channels. # ipchains -A output -i $EXTERNAL_INTERFACE -p tcp \ -s $IPADDR $UNPRIVPORTS \ -d $ANYWHERE $UNPRIVPORTS -j ACCEPT ipchains -A input -i $EXTERNAL_INTERFACE -p tcp ! -y \ -s $ANYWHERE $UNPRIVPORTS \ -d $IPADDR $UNPRIVPORTS -j ACCEPT ##### # # End - Enable FTP Client. # #####
participants (2)
-
De Loe, Maurits -
Les Catterall