NAME

SYNOPSIS

DESCRIPTION

ftpsesame uses bpf(4) to get a copy of the data inside FTP control connections passing the specified interface. This data is searched for negotiations about data connections. For passive mode, this is a port that a client should use to connect to a server. For active mode this is a port and an IP address that a server should use to connect to a client.

Assuming the FTP control connection is from $client to $server, and $port is negotiated, ftpsesame adds one of the following rules to pf(4), inside an anchor named "ftpsesame".

In case of active mode (PORT or EPRT):

pass in log quick inet proto tcp \
    from $server to $client port $port flags S/SAFR keep state

In case of passive mode (PASV or EPSV):

pass in log quick inet proto tcp \
    from $client to $server port $port flags S/SAFR keep state

In the special case of passive mode where the client is subject to NAT, an extra rule is added, where $client_real is the client's real IP address:

pass in log quick inet proto tcp \
    from $client_real to $server port $port flags S/SAFR keep state

The options are as follows:

-D level

Debug level, ranging from 0 to 7. Higher is more verbose. The default is 5. (These levels correspond to the syslog(3) levels.)

-d

Do not daemonize. The process will stay in the foreground, logging to stderr.

-i interface

Listen on interface.

-t tag

Create rules with tag tag. Also, option quick is not used. This way the anchor always returns to the main ruleset, with the tag set on approved FTP data connections. The tag can then be used in pass rules below the anchor.

-q queue

Create rules with queue queue appended.

expression

Selects the packets that bpf(4) will pass on to ftpsesame. An expression consist of the primitives described in tcpdump(8). For efficiency, the expression should narrow down the traffic as much as possible. The default is "tcp and port 21".

CONFIGURATION EXAMPLES

# (1) Allow internal LAN to access FTP servers anywhere.
#     (passive mode only if $lan is subject to NAT, see below)
# cmd: ftpsesame -i $ext_if
anchor "ftpsesame/*" on { $int_if, $ext_if }
pass in  quick on $int_if proto tcp from $lan to any port 21 keep state
pass out quick on $ext_if proto tcp from $lan to any port 21 keep state

# (2) Allow access to FTP servers in the DMZ, while queueing the data
#     transfers.
# cmd: ftpsesame -i $dmz_if -q ftp
queue ftp bandwidth 10%
# passive
anchor "ftpsesame/*" in  on $ext_if proto tcp from any to { $ftp_servers }
anchor "ftpsesame/*" out on $dmz_if proto tcp from any to { $ftp_servers }
# active
anchor "ftpsesame/*" in  on $dmz_if proto tcp from { $ftp_servers } to any
anchor "ftpsesame/*" out on $ext_if proto tcp from { $ftp_servers } to any
# ... rules for port 21 omitted ...

# (3) Allow access to FTP servers in the DMZ, using tagging for fine
#     grained control.
# cmd: ftpsesame -i $dmz_if -t ftpok
anchor "ftpsesame/*"
# passive
pass in  quick on $ext_if proto tcp from to any to $realftp \
    port > 49151 tagged ftpok keep state
pass in  quick on $ext_if proto tcp from any to $msftp \
    port 1023 >< 5001 tagged ftpok keep state
pass out quick on $dmz_if all tagged ftpok keep state
# active
pass in  quick on $dmz_if proto tcp from $realftp to any \
    tagged ftpok keep state
pass in  quick on $dmz_if proto tcp from $msftp port 20 to any \
    tagged ftpok keep state
pass out quick on $ext_if all tagged ftpok keep state
# ... rules for port 21 omitted ...

Keep state is mandatory on the control connection (port 21), because ftpsesame checks that these connections are in the statetable, before allowing data connections.

NAT ISSUES

Active mode connections from clients subject to NAT are not supported, because it requires commands inside the control connection to be rewritten. ftp-proxy(8) can be used for that purpose.

SECURITY

The negotiated IP address for active mode is ignored for security reasons. This makes third party file transfers impossible.

ftpsesame checks that the ftp control connection is in the packet filter statetable before it will trust its contents.

ftpsesame chroots to "/var/empty" and changes to user "proxy" to drop privileges. It does keep a file descriptor to both bpf(4) and pf(4) so it is still very powerful.

The concept of rebuilding a TCP session from IP packets on a passive listener is fundamentally flawed. ftpsesame would need a full TCP stack that emulates each endpoint perfectly to be safe from all evasion techniques. ftp-proxy(8) does not have this problem. Ofcourse ftpsesame tries hard to detect irregularities. The following are not allowed: IP options, IP fragments, ttl below 2, lines without end-of-line marker. Also, ftpsesame only looks at the first line of whatever the server has to say in response to a client.

It is recommended to run ftpsesame on an interface where packets from untrusted hosts are already scrubbed. Also, anchors and tags can be used to restrict the allowed addresses and portranges.

CAVEATS

SEE ALSO