Hi,
i think the ftp_contrack module has a bug.
I'm setting up proftpd 1.3.1 with TLS for encrypting auth+data only
traffic to let ftp_conntrack module understand the port command when a
client connects to the server using a PASV mode.
Look at link below and search for question
Using mod_tls, FTP sessions through my firewall now no longer work.
What's going on?
ftp_conntrack module probably do no understand the port command so it do
not open the port.
Tryed to define a limited passive ports in proftpd.conf and setted up
iptables to ACCEPT any conection in this range fixed the problem. But
pratically i've bypassed the ftp_conntrack module.
Here are system infos and main configuration parts.
Debian Lenny
uname -a
Linux debian 2.6.24-1-amd64 #1 SMP Thu Mar 27 16:52:38 UTC 2008 x86_64
GNU/Linux
__________
iptables -V
iptables v1.4.0
________
proftpd -V
Compile-time Settings:
Version: 1.3.1
Platform: LINUX
Built With:
configure --prefix=/usr
--with-includes=/usr/include/postgresql:/usr/include/mysql
--mandir=/usr/share/man --sysconfdir=/etc/proftpd
--localstatedir=/var/run --libexecdir=/usr/lib/proftpd --enable-sendfile
--enable-facl --enable-dso --enable-autoshadow --enable-ctrls
--with-modules=mod_readme --enable-ipv6 --build x86_64-linux-gnu
--with-shared=mod_site_misc:mod_load:mod_ban:mod_quotatab:mod_sql:mod_sql_mysql:mod_sql_postgres:mod_quotatab_sql:mod_ldap:mod_quotatab_ldap:mod_ratio:mod_tls:mod_rewrite:mod_radius:mod_wrap:mod_wrap2:mod_wrap2_file:mod_wrap2_sql:mod_quotatab_file:mod_quotatab_radius:mod_facl:mod_ctrls_admin:mod_ifsession
CFLAGS: -O2 -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -DHAVE_OPENSSL
-DUSE_LDAP_TLS -Wall -Wno-long-double
LDFLAGS: -L$(top_srcdir)/lib
LIBS: -lsupp -lcrypt
Files:
Configuration File:
/etc/proftpd/proftpd.conf
Pid File:
/var/run/proftpd.pid
Scoreboard File:
/var/run/proftpd/proftpd.scoreboard
Shared Module Directory:
/usr/lib/proftpd
Features:
+ Autoshadow support
+ Controls support
+ curses support
- Developer support
+ DSO support
+ IPv6 support
+ Largefile support
- Lastlog support
+ ncurses support
- NLS support
+ OpenSSL support
+ POSIX ACL support
+ Shadow file support
+ Sendfile support
+ Trace support
Tunable Options:
PR_TUNABLE_BUFFER_SIZE = 1024
PR_TUNABLE_GLOBBING_MAX = 8
PR_TUNABLE_HASH_TABLE_SIZE = 40
PR_TUNABLE_NEW_POOL_SIZE = 512
PR_TUNABLE_RCVBUFSZ = 8192
PR_TUNABLE_SCOREBOARD_BUFFER_SIZE = 80
PR_TUNABLE_SCOREBOARD_SCRUB_TIMER = 30
PR_TUNABLE_SELECT_TIMEOUT = 30
PR_TUNABLE_SNDBUFSZ = 8192
PR_TUNABLE_TIMEOUTIDENT = 10
PR_TUNABLE_TIMEOUTIDLE = 600
PR_TUNABLE_TIMEOUTLINGER = 180
PR_TUNABLE_TIMEOUTLOGIN = 300
PR_TUNABLE_TIMEOUTNOXFER = 300
PR_TUNABLE_TIMEOUTSTALLED = 3600
PR_TUNABLE_XFER_BUFFER_SIZE = 1024
PR_TUNABLE_XFER_SCOREBOARD_UPDATES = 10
___________
*** CONFIGURATIONS ****
cat /etc/proftpd/proftpd.conf
# Includes DSO modules
Include /etc/proftpd/modules.conf
UseIPv6 off
ServerName "ftp.foo.barl"
ServerType standalone
ServerAdmin support@xxxxxxx
UseReverseDNS off
DeferWelcome off
MultilineRFC2228 on
DefaultServer off
DefaultAddress 127.0.0.1
TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200
DisplayLogin "README"
#DisplayFirstChdir .message
ListOptions "-l"
DenyFilter \*.*/
Port 21
MaxInstances 50
User proftpd
Group nogroup
Umask 000
AllowOverwrite on
UseSendFile off
TransferLog /var/log/proftpd/main.log
SystemLog /var/log/proftpd/system.log
LogFormat default "%t USER: SEND %r "
LogFormat extended "%t USER: %u (from IP %a ) send CMD: %r
REPLY: %s (Transfer %b bytes in %T sec.)"
SocketBindTight off
<IfModule mod_tls.c>
TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol SSLv23
TLSOptions NoCertRequest
TLSRSACertificateFile /etc/proftpd/ssl/proftpd.cert.pem
TLSRSACertificateKeyFile /etc/proftpd/ssl/proftpd.key.pem
TLSVerifyClient off
</IfModule>
<IfModule mod_quota.c>
QuotaEngine on
</IfModule>
<IfModule mod_ratio.c>
Ratios on
</IfModule>
<IfModule mod_delay.c>
DelayEngine on
</IfModule>
<IfModule mod_ctrls.c>
ControlsEngine on
ControlsMaxClients 2
ControlsLog /var/log/proftpd/controls.log
ControlsInterval 5
ControlsSocket /var/run/proftpd/proftpd.sock
</IfModule>
<IfModule mod_ctrls_admin.c>
AdminControlsEngine on
</IfModule>
<Global>
PassivePorts 32768 32778
MaxLoginAttempts 2
ServerIdent on " "
ExtendedLog /var/log/proftpd/Activity.log
AUTH default
ExtendedLog /var/log/proftpd/Activity.log
WRITE,READ extended
DefaultRoot ~
AllowRetrieveRestart on
MaxClients 30 "SERVER_BUSY: Please
retry. NOTE: The Accident will be reported to System Administrator"
MaxClientsPerHost 5 "ERROR: You can't open
more than five (5) session form the same host. Close an FTP session or
retry later."
AllowStoreRestart on
DeleteAbortedStores off
LoginPasswordPrompt off
AccessDenyMsg "ERROR: Incorrect Login! Please
Retry. NOTE: The Accident will be reported to System Admnistrator"
AccessGrantMsg "Welcome to lifesaver FTP
service, DO NOT FORGET TO SWITCH to TLS/SSL FTP ! ... and please keep in
mind all your actions here will be logged! "
DefaultTransferMode binary
IdentLookups off
HiddenStores off
ShowSymlinks off
DirFakeGroup on ftp
DirFakeUser on ftp
AllowOverwrite on
WtmpLog on
RootLogin off
AuthAliasOnly off
PathDenyFilter "\\.(ftpaccess|htaccess)$"
ListOptions "-l"
DisplayConnect "Welcome to xxxxxx. Please Login
... "
DisplayGoAway "Welcome to xxxxxx ... Sorry, too
many user are logged in ... Please retry later"
AuthOrder mod_auth_file.c
RequireValidShell no
AuthUserFile /etc/proftpd/passwd
<Limit SITE_CHMOD>
DenyAll
</Limit>
<IfModule mod_delay.c>
DelayEngine on
</IfModule>
</Global>
<VirtualHost xx.xxx.x.x>
ServerName "ftp.lifesaver.it"
ServerIdent on "FTP Server
ready. Please use FTP-TLS or login will be rejected. "
TransferLog /var/log/proftpd/ftp-lifesaver-it.log
<Limit LOGIN>
AllowUser ftp_temp
Deny All
</Limit>
<IfModule mod_tls.c>
TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSOptions NoCertRequest
TLSRSACertificateFile
/etc/proftpd/ssl/proftpd.cert.pem
TLSRSACertificateKeyFile
/etc/proftpd/ssl/proftpd.key.pem
TLSVerifyClient off
TLSRequired auth+data
</IfModule>
TransferRate RETR 213.0:1024
TransferRate APPE 213.0:1024
TransferRate STOR 2048.0:1024
TransferRate STOU 2048.0:1024
</VirtualHost>
____________
cat /etc/init.d/firewall
# Loading ipfilter connection tracking modules
echo -n "Loading conntrack modules ... "
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc
modprobe ip_nat_ftp
# Loading ipfilter rules
echo -n "Loading ipfilter rules ... "
# Setting Chains State
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
# Drop Ping-Flood
iptables -A INPUT -p icmp --icmp-type echo-request -m
limit --limit 1/s --limit-burst 5 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -m
limit --limit 1/s --limit-burst 5 -j LOG --log-prefix PING_FLOOD-DROP
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
# Allow loopback traffic (lo)
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow established connections
iptables -A OUTPUT -o $NIC0 -m state --state
ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o $NIC1 -m state --state
ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o $NIC2 -m state --state
ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $NIC0 -m state --state
ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $NIC1 -m state --state
ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $NIC2 -m state --state
ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $NIC0 -m state --state
ESTABLISHED,RELATED -j ACCEPT
# Allow new outgoing tcp, udp, icmp connections
iptables -A OUTPUT -p tcp -o $NIC0 -m state --state NEW
-j ACCEPT
iptables -A OUTPUT -p tcp -o $NIC1 -m state --state NEW
-j ACCEPT
iptables -A OUTPUT -p tcp -o $NIC2 -m state --state NEW
-j ACCEPT
iptables -A OUTPUT -p udp -o $NIC0 -m state --state NEW
-j ACCEPT
iptables -A OUTPUT -p udp -o $NIC1 -m state --state NEW
-j ACCEPT
iptables -A OUTPUT -p udp -o $NIC2 -m state --state NEW
-j ACCEPT
iptables -A OUTPUT -p icmp -o $NIC0 -m state --state NEW
-j ACCEPT
iptables -A OUTPUT -p icmp -o $NIC1 -m state --state NEW
-j ACCEPT
iptables -A OUTPUT -p icmp -o $NIC2 -m state --state NEW
-j ACCEPT
# Drop fragments and invalid packets
iptables -A INPUT -f -m limit --limit 1/s --limit-burst 1
-j LOG --log-prefix INPUT_FRAG-DROP:
iptables -A INPUT -f -j DROP
iptables -A INPUT -m state --state INVALID -m limit
--limit 1/s --limit-burst 1 -j LOG --log-prefix INPUT_INVALID-DROP:
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -f -m limit --limit 1/s --limit-burst
1 -j LOG --log-prefix OUTPUT_FRAG-DROP:
iptables -A OUTPUT -f -j DROP
iptables -A OUTPUT -m state --state INVALID -j LOG
--log-prefix OUTPUT_INVALID-DROP:
iptables -A OUTPUT -m state --state INVALID -j DROP
# Allow FTP from LAN
iptables -A INPUT -p tcp --syn -i $NIC0 -s $LANPOOL -d
$LAN --dport 21 -m state --state NEW -j ACCEPT
# Allow FTP from WAN2
iptables -A INPUT -p tcp --syn -i $NIC2 -d $WAN2 --dport
21 -m state --state NEW -j ACCEPT
##
# FTPES Workaround
##
iptables -A INPUT -p tcp --syn -i $NIC2 -d $WAN2 --dport 32768:32778 -j
ACCEPT
# Allow SSH from LAN
...
----- CUTTED HERE -----
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
