FTP-GW(8)

NAME
ftp-gw - FTP proxy

SYNOPSIS
ftp-gw [-daemon <port>] [-fastdaemon <port>] [-as <tag>]

DESCRIPTION
The Firewall Toolkit FTP proxy is an application level proxy that provides configurable access control, authentication and logging mechanisms. The FTP proxy, which runs on the firewall, passes FTP requests through the firewall (at the application level), using rules you supply. You can configure the proxies to allow connections based on:

•   source IP address

•   source host name

•   destination IP address

•   destination host name

•   FTP command (for example, STOR and RETR)

All packets, and therefore all application requests go to the firewall. On the firewall, the FTP proxy software relays information from one side of the firewall to the other. The proxy prevents the applications on outside networks from talking directly with the applications on your inside network, and vice versa. No IP packets pass from one side of the firewall to the other. All data is passed at the application level.

The default configuration for the FTP proxy does not allow inbound connections from outside the defense perimeter to inside. This means that users must connect to the firewall, authenticate, and then can FTP to the host inside the perimeter.

The FTP proxy (ftp-gw) generally runs as a daemon (invoked from system startup script, p.e. /etc/rc.local) and listens for requests on the specified port (tcp/21, as indicated in /etc/services ,is reasonable default). Whenever the system receives an FTP request on this port, the FTP proxy checks its configuration information (in the netperm-table) and determines whether the initiating host has permission to use FTP. If the host does not have permission, the proxy logs the connection attempt and displays an error message.

The proxy may also be invoked from tcp/ip "superserver" (inetd or xinetd). -daemon parameter should be omitted in this case.

If the host has permission, the proxy authenticates the user (if required), logs the transaction and passes the request to the destination host.

OPTIONS

  Command Line Options
The FTP proxy recognizes the following command line options (whether started from the command line or from within /etc/rc.local):

-daemon port
    Indicates that the FTP proxy runs as a daemon, and the port (name or number) on which the FTP proxy listens. When -daemon option is used, configuration is being read from netperm-table for every new connection accepted by proxy.

    port Specifies either a numeric id or symbolic name from the /etc/services file.

-fastdaemon port
    Indicates that the FTP proxy runs as a daemon, and the port (name or number) on which the FTP proxy listens. When -fastdaemon option is used, configuration is being read from netperm-table once the daemon starts or if SIGHUP is received.

-as tag
    Changes default application tag for netperm-table from "ftp-gw" to any given string.

  Configuration Options
The FTP proxy reads configuration rules from the /usr/local/etc/netperm-table. It reads all rules using the ftp-gw and * (wildcard) keywords. The FTP proxy reads the netperm-table from top to bottom. If there are multiple rules in the table that could apply for a particular attribute, the FTP proxy uses the first one that it finds. See netperm-table(5) for a more complete explanation of netperm-table syntax and precedence.

The FTP proxy recognizes the following attributes:

authserver host port
    Specifies the host running the authentication server (and the port on which it runs) that the proxies use for authenticating users.

    host
        Specifies an IP address or host name.

    port
        Specifies a service name or port number.

denial-msg file
    Specifies the name of the file the FTP proxy displays when it denies access to a user because they do not have permission to use the FTP proxy. If no file is specified, the FTP proxy generates a default message.

denydest-msg file
    Specifies the name of the file the FTP proxy displays when it denies access to a user because they are trying to access a destination that they are not permitted to access. If no file is specified, the FTP proxy generates a default message.

user-limit number
    Specifies max permitted username length.

pass-limit number
    Specifies max permitted password length.

buf-limit number
    Specifies max permitted protocol line size (user command or response).

hosts host-pattern [host-pattern2...] [options]
    rules specify host and access permissions. Typically, a hosts rule will be in the form of:

    ftp-gw: deny-hosts unknown

    ftp-gw: hosts 192.33.112.* 192.94.214.* -log { retr stor }

    There may be several host patterns following the "hosts" keyword, ending with the first optional parameter beginning with '-'. Optional parameters permit the selective enabling or disabling of logging information, etc. Sub-options are:

    -transparent specifies that the proxy runs in transparent mode; see OS-specific details on how to setup transparent redirection. Proxy destination host is not extracted from username part but taken from connection properties instead. This makes proxy "transparent", so no special client setup is required.

    -plug-to server-address specifies that proxy is "hardwired" to a given server.

    -port server-port overrides default ftp port for plug-to

    -log operation
    -log { operation1 operation2 ... }
    specifies that a log entry to the system log should be made whenever the listed operations are performed through the proxy. (See ftpd(8) for a list of known FTP operations)

    -authall specifies that the proxy should permit no operation (other than the quit command) until the user has authenticated to the server.

    -auth operation
    -auth { operation1 operation2 ... }
    specifies that the operations listed should not be permitted until the user has authenticated to the server.

    -dest pattern
    -dest { pattern1 pattern2 ... }
    specifies a list of valid destinations. If no list is specified, all destinations are considered valid. The -dest list is processed in order as it appears on the options line. -dest entries preceeded with a '!' character are treated as negation entries. Therefore the rule:

    -dest !*.mit.edu -dest *

    will permit hosts that are not in the domain "mit.edu" to be connected to.

    -deny operation
    -deny { operation1 operation2 ... } specifies a list of FTP operations to deny. By default, all operations are permitted.

    -user username
    -user { username1 username2 ... } specifies a list of users allowed to authenticate to remote server. By default, all users are permitted.

    -extnd specifies that the proxy should request per-operation permissions from authsrv.

    -separator separator-char specifies separator character used to distinguish user and host name parts in non-transparent mode (instead of default `@').

    -clientcmd-dscp dscp-tag-name
    -clientcmd-dscp dscp-hex-value specifies diffserv codepoint (QoS/ToS mark) for client to proxy command stream.

    -clientdata-dscp dscp-tag-name
    -clientdata-dscp dscp-hex-value specifies diffserv codepoint (QoS/ToS mark) for client to proxy data stream.

    -servercmd-dscp dscp-tag-name
    -servercmd-dscp dscp-hex-value specifies diffserv codepoint (QoS/ToS mark) for proxy to server command stream.

    -serverdata-dscp dscp-tag-name
    -serverdata-dscp dscp-hex-value specifies diffserv codepoint (QoS/ToS mark) for proxy to server data stream.

    -keepalive-timeout timeout specifies period to send "keepalive" packets while performing content inspection to prevent peers from disconnecting due to inactivity.

content-type type/subtype [-milter filter-socket]
    rules specify content type permissions. Typically, a content-type rule will be in the form of:

    ftp-gw: deny-content-type application/x-dosexec

    ftp-gw: permit-content-type text/plain text.rtf image/*

    ftp-gw: content-type application/msole -milter unix:/var/tmp/antivirus.sock

    There may be several content-type patterns following the "content-type" keyword, ending with the first optional parameter beginning with '-'. At the moment only "-milter" parameter is supported, specifying content inspection server (unix:/domain-path or inet:port@host syntax).

directory directory
    Specifies the directory that the FTP proxy makes its root directory before providing service. This option is equivalent to the chroot option in previous versions.

groupid group
    Specifies the name of the group the FTP proxy uses when running.

    group
        Specifies either a name or numeric id from the /etc/group file.

help-msg file
    Specifies the name of the file the FTP proxy displays when the user accesses the help command. If no file is specified, the FTP proxy displays a list of internal commands.

timeout seconds
    Specifies the number of seconds the FTP proxy is idle (with no network activity) before disconnecting

userid user
    Specifies the user ID the proxy uses when running.

    user
        Specifies either a name or numeric id from the /etc/passwd file. This option is equivalent to the -user command in previous versions.

welcome-msg file
    Specifies the name of the file the proxy displays as a welcome banner upon successful connection to the proxy. If no file is specified, the proxy generates a default message.

  Proxy Commands
The FTP proxy recognizes all FTP server commands. The following ones are of special interest:

help
    Displays a list of valid commands for the FTP server.

quit
    Exits the FTP proxy.

quote options
    Sends the options verbatim to the remote FTP server. This option is useful when the FTP client does not have support for authentication. In order to authenticate to the FTP proxy, you must use the quote auth username command to send the user name and the quote resp password command to send the password. When using the quote command, all information (including passwords) is echoed to the screen.

user username@host
    Connects to the remote host using the given user name and password.

    username
        Specifies the name of the user on the remote host.

    host
        Specifies the name of the remote host.

    You must use the user command to tell the proxy the name of the remote host to which you wish to connect.

?   Displays a list of valid commands for the FTP server.

EXAMPLES
This example shows the configuration lines in the netperm-table that denies ftp.bigu.edu as a destination and sets the name of the file that the FTP proxy displays when users try to access this site:

    #deny ftp.bigu.edu as a destination (by IP address)
    ftp-gw: deny-destination 192.168.1.100

    #file to display when users try to access a denied site
    ftp-gw: denial-msg /usr/local/etc/ftp-deny.txt

A common policy for the FTP proxy is to authenticate all requests from untrusted networks to or through the firewall. This example shows a sample FTP session from an untrusted network to a trusted network, using S/Key authentication at the firewall:

    blaze.clientsite.com-27: ftp firewall.yoyodyne.com
    Connected to firewall.yoyodyne.com
    220-Proxy first requires authentication
    220 firewall.yoyodyne.com FTP proxy (Version 3.1) ready.
    Name (firewall.yoyodyne.com:clancy): clancy
    331 Skey Challenge: s/key 653 fi19289
    Password:                         password does not display
    230 User authenticated to proxy
    ftp> user clancy@dimension
    331- (-----GATEWAY CONNECTED TO dimension----)
    331- (220 dimension FTP server ready.)
    331 Password required for clancy.
    Password: #########
    230 User clancy logged in.
    ftp>

FILES

/etc/rc.local
    Command script that controls automatic reboot, and includes startup information for the FTP proxy.

/usr/local/etc/netperm-table
    The network permissions file contains configuration information for the Firewall Toolkit, including the FTP proxy.

BUGS
Report bugs to arkenoi@gmail.com or fwtk-users@buoy.com mailing list. Include a complete example, explaining what you expected to happen and what actually happened. Be sure to indicate the type of system (operating system, hardware, etc.) you are using, as well as the version of the FTP proxy.

AUTHOR
Alexei Kravchuk, based on "fk toolkit" ftp proxy by Matthew Kirkwood.

SEE ALSO
netperm-table(5), rc(8), authsrv(8), netacl(8)