Am 14.11.2012 18:01, schrieb lee: >> ftp is ALWAYS using random ports >> >> active: on the client side >> passive: on the server side >> >> so on one side there must be a firewall rule or connection >> tracking for sure depending on the ftp-mode, how the tracking >> is made is a implementation detail > > There isn't anything random about these ports, see > http://en.wikipedia.org/wiki/File_Transfer_Protocol surely pure-ftpd: PassivePortRange 10000 10100 you get a random port for the data-connection which is specified by the server and without configuration a port between 1025 and 65535 as for any other ftp-server so the client get over the control-connection to which dataport he has to connect, this port must be open for the client on the server side for active ftp it is the opposite: the client is choosing a random port, notfies the server which port and the server makes a new data connection in both cases the firewall must open this connection no matter how it is implemented, but it must do this >> nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to >> attach helpers instead. > > I don't know what you mean --- I haven't looked into it since a very > long time, and when I did, there was an extra kernel module to handle > ftp connections in combination with some firewall rules to allow traffic > on the data ports. There wasn't anything random about it. So what has > changed? yes, and nf_conntrack FTP opens dynamically the data-connection but it is a part of iptables/firewall so it is random and the firewall has to know about it
Attachment:
signature.asc
Description: OpenPGP digital signature
-- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
