Subject: Re: ftp-gw + ncftpd

From: Joseph S D Yao <[email-masked]>
Date: Thu, 13 Apr 2000 17:49:51 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

You shouldn't run the FTP daemon and the FTP gateway on the same
machine.  It doesn't make sense, anyway.  How can the daemon be
"behind" the gateway if it's on the same machine?  Even if you change
ports, which would allow this configuration, intruders can access those
ports.  So you switch to TCP wrappers, and they spoof an address, and
...  Better to have your services truly behind the gateway on a
separate machine than out on the Internet.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: [email-masked]
Date: Thu, 13 Apr 2000 18:46:26 -0400 (EDT)

>>>>> "Joseph" == Joseph S D Yao <[email-masked]> writes:

Joseph> You shouldn't run the FTP daemon and the FTP gateway on the same
Joseph> machine.  It doesn't make sense, anyway.  How can the daemon be
Joseph> "behind" the gateway if it's on the same machine?  Even if you change
Joseph> ports, which would allow this configuration, intruders can access those
Joseph> ports.  So you switch to TCP wrappers, and they spoof an address, and
Joseph> ...  Better to have your services truly behind the gateway on a
Joseph> separate machine than out on the Internet.

While I agree that having it on a separate machine is "better" in some
environments, you _can_ have them on the same box. A simple example:

Server has 1 physical interface:

hme0: 10.1.1.1

ftpd is configured to only listen on the loopback interface (127.0.0.1).

ftp-gw is configured to only listen on 10.1.1.1:21, and hand off all connections to
127.0.0.1:21.

Th box is running a packet filter to be extra sure that nobody off the box
can talk to 127.0.0.1.

You now have your FTP server protected by ftp-gw. This is a good thing, even
for your internal FTP servers.

Hmmm... connection hand-off is in the toolkit ftp-gw, isn't it? I've been
staring at Gauntlet source so much lately, I forget. If not, it's trivial to
add.

If you also need to do proxying to other machines on the same box, the
easiest way is to have a second ftp-gw on a virtual address.

I'm not sure how the toolkit transparancy patches work - it should be a
trivial source modification to do handoff for a local dest IP, and normal
proxying for everything else, if such functionality doesn't already exist.

-- 
Carson Gaspar -- [email-masked] [email-masked] [email-masked]
http://www.cs.columbia.edu/~carson/home.html
Queen Trapped in a Butch Body

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 13 Apr 2000 18:59:38 -0400

On Thu, Apr 13, 2000 at 06:46:26PM -0400, [email-masked] wrote:
...
> environments, you _can_ have them on the same box. A simple example:

Of course, true.  Which is why I went back and changed "can't" [written
in righteous fervor but misinterpretable] to "shouldn't" [clearly also
misinterpretable].  ;-)