FTP Server Configuration with pfSense

FTP Server Issues

FTP serverFile Transfer Protocol (FTP) is a standard network protocol used to transfer files from one host to another host over a TCP-based network. The original specification for File Transfer Protocol was published as RFC 114 in 1971, and thus predates even TCP/IP. Thus it is a mature protocol, but since it predates the time when security was a paramount concern, it is problematic for several reasons:

  • Passwords are transferred in the clear.
  • The protocol demands the use of at least two TCP connections (control and data) on separate ports.
  • When a session is established, data is communicated via ports selected at random.


These points create security challenges that can potentially led to issues. The best option a security professional could choose is to abandon FTP entirely, and utlilize one of several alternate methods of file transfer:

  • Explicit FTPS is an extension to the FTP standard that allows clients to request that the FTP session be encrypted. This is done by sending the “AUTH TLS” command. The server has the option of allowing or denying connections that do not request TLS, and is specified to use different ports than plain FTP.
  • SFTP, the “SSH File Transfer Protocol”, uses Secure Shell (SSH) to transfer files. Unlike standard FTP, it encrypts both commands and data preventing passwords and sensitive information from being transmitted openly over the network.
  • FTP over SSH refers to the practice of tunneling a normal FTP session over an SSH connection. Because FTP uses multiple TCP connections, it is difficult to tunnel over SSH. Nevertheless, there are several software packages that are able to rewrite FTP control channel messages and automatically open new packet forwardings for FTP data channels.
  • SFTP and SCP, in which the entire conversation is protected by the SSH protocol.

FTP-Proxy

Regardless, in some situations you may have to deal with setting up an FTP server. The best solution in this case is to redirect FTP traffic to a proxy that was written for this purpose. The proxy will then interact with pfSense. The program, which originated in OpenBSD, is called ftp-proxy. In pfSense 2.0 and later, the FTP proxy is in-kernel. To confirm that the FTP proxy is running, navigate to System -> Advanced, and click on the “System Tunables” tab. The first variable on the list, “debug.pfftpproxy” will be set to 0 if the FTP proxy is enabled (set it to 1 to disable the proxy). Also note that the FTP proxy will only work on the primary WAN at this time. It will not fail over and it will not load balance.

There are a few other configuration tips that should be mentioned, especially if you utilize FTP-proxy:

  • If you have a restrictive rule set or are utilizing policy-based routing for multiple WANS, make sure you have permitted traffic to 127.0.0.1 / ports 8000-8030 (the default port for ftp-proxy is 8021). This rule should be on top of all other LAN rules that utilize policy-based routing.
  • If you are running Windows to access the FTP server, try turning off Windows Firewall if it is running.
  • If Snort is running, try disabling Snort, and if you are able to access the server when it is disabled, try upgrading to a more recent version of Snort.
  • Delete any existing FTP ort forwards or firewall rules and add new port forwarding and firewall rules for the destination port 21 and the destination private NAT IP address. For more information on port forwarding with NAT, see my earlier posting on NAT/port forwarding.

If these tips do not help, you probably should consider using one of the alternatives to FTP listed above. However, this may not always be an option in a corporate environment or if a client wants an FTP server. If so, the use of ftp-proxy under pfSense when setting up an FTP server should provide at least a modicum of security.


External Links:

File Transfer Protocol at Wikipedia

Howto Setup FTP Server Behind pfSense at doc.pfsense.org

Be Sociable, Share!

Speak Your Mind

*

© 2013 David Zientara. All rights reserved. Privacy Policy