OpenBSD Journal

FTP access in PF: ftpsesame

Contributed by jose on from the additional-software. dept.

From the PF mailing list, a new software project announcement: http://marc.theaimsgroup.com/?l=openbsd-pf&m=107348940528992&w=2
ftpsesame helps the FTP protocol get through your pf firewall without having to open up whole ranges of ports. It works for FTP clients and FTP servers, and you do not have to redirect any traffic.
This may undermine some of your PF rules, so you should examine it closely. Also, we already have ftp-proxy in the base system. You can download this software here: http://www.sentia.org/downloads/ftpsesame-0.7.tar.gz .

(Comments are closed)

Comments

  1. By Anonymous Coward () on

    Can't this be abused by a malicious server/client to open up arbitrary ports in the firewall? Or is care being taken that this can't happen?

    Comments

    1. By Guillaume () g.tournat@free.fr on mailto:g.tournat@free.fr

      Don't think so. ftpsesame looks first in the state tables of pf. If no opened state for ftp (on port 20 CMD), it doesn't let data port to be used.

  2. By dengue () on

    root@lincoln0:/root/work/ftpsesame-0.7> uname -a OpenBSD lincoln0.lnkwireless.net 3.4 LINCOLN0#1 sparc
    root@lincoln0:/root/work/ftpsesame-0.7> make
    cc -O2 -pipe -I. -Wall -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wno-uninitialized -c filter.c
    filter.c: In function `filter_init':
    filter.c:53: sizeof applied to an incomplete type

  3. By Sean () sean@tinfoilhat.ca on mailto:sean@tinfoilhat.ca

    Check out: http://www.benzedrine.cx/ftp-proxy-reverse.diff

    I have no clue why it never made it into ftp-proxy but I've used it succesfully and under high loads on both i386 and SPARC.

    Comments

    1. By db () db@nipsi.de on mailto:db@nipsi.de

      yeah but i guess to get it work with latest ftp-proxy you have to fix some fix and lineerrors but then i works perfectly.

  4. By tom hensel () tom@replic8.net on mailto:tom@replic8.net

    a new version has appeared, no changelog so far.

    http://www.sentia.org/downloads/ftpsesame-0.8.tar.gz

    Comments

    1. By Loop () on

      Posted to the pf-list on 9th Jan (according to http://marc.theaimsgroup.com/?l=openbsd-pf&m=107365446715065&w=2):

      Hmm, yes, it turns out that atomic commits were added after 3.4.

      Please try this one:
      http://www.sentia.org/downloads/ftpsesame-0.8.tar.gz


      Other changes:
      - check that pf is enabled
      - use BIOCIMMEDIATE on bpf descriptor
      - stricter matching of server replies
      - more notes in manpage SECURITY section

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]