Subject: FTP proxy and Checkpoint FW-1 4.0 SP7

From: [email-masked]
Date: Thu, 24 Aug 2000 09:26:12 -0700

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi there,

The ftp-gw worked fine before I upgraded the Checkpoint FW-1 4.0 from SP4 to
SP7. The ftp-gw resides on the DMZ. It hangs everytime at the point I issue
"user [email-masked]". When I look at it with a sniffer, I've found the
ftp-gw is able to log on to the ftp site but when the ftp-gw passes the welcome
banner to the the firewall, the firewall just resets the connection. Any idea
why that happens and is there any solution to that ?

Thanks
Bernard

---

From: Darren Reed <[email-masked]>
Date: Fri, 25 Aug 2000 22:51:23 +1000 (EST)

In some email I received from [email-masked], sie wrote:
> "user [email-masked]". When I look at it with a sniffer, I've found
> the ftp-gw is able to log on to the ftp site but when the ftp-gw passes the
> welcome banner to the the firewall, the firewall just resets the connection.
> Any idea why that happens and is there any solution to that ?

In a recent post on bugtraq about FW-1, it was mentioned that there were
problems with its FTP "proxy", so 10:1 they've made a change in the best
interests of security but actually verified it doesn't break something
else (why care about interoperability with a competitor's product ? ;->)
Dealing with FTP in a packet level "proxy" is a real PITA.

What if you take ftp-gw out of the equation, does the problem still persist?

It maybe something as simple as it doesn't like the idea of multiple
commands/lines per packet.  There is at least one web `client' around
which is a very nasty ftp client - links.  To retrieve anonymous FTP
things, it sends:

USER anonymous\r\nPASS foo@\r\nCWD /path/to/foo\r\nPASV\r\nRETR foo.txt\r\n

in one go to the FTP server.  In the WWW view of the world, that is
probably how you would treat FTP, but FTP isn't a transaction orientated
protocol.

Darren