Subject: ftp-gw problem with Checkpoint

From: "Larry D. Bonham" <[email-masked]>
Date: Wed, 06 Sep 2000 13:32:48 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Has anyone run into this?

I have FWTK 2.1 with all of the latest ftp patches (as far as I 
know).  ftp-gw has been working fine for years.

A customer upgraded their firewall to the latest version of Checkpoint 
FW-1.  Now when they try to access ftp-gw they get disconnected at this point.

$ ftp gatekeeper.d2000.com
Connected to gatekeeper.d2000.com.
220 gatekeeper.d2000.com FTP proxy (Version V2.1) ready.
Name (fw:root): [email-masked]
331-(

It pukes right here.  According to my sniffer, instead of receiving the 
rest of the 331 message as below.  The client end sends a RST (I assume 
reset) and then tries to resend the username@system command again.  The 
internal server gets confused and disconnects.

----GATEWAY CONNECTED TO web3.d2000.com----)
331-(220 web3.d2000.com NcFTPd Server (licensed copy) ready.)
331 User dummy okay, need password.
Password:

Any patch or fix that anyone is aware of?  I know that it really is a 
Checkpoint problem but that may be more difficult to deal with than 
applying a workable patch on my end.

Thanks

=================================================
Larry D. Bonham     <[email-masked]>
Distribution 2000
10401-F Baur
Olivette, MO  63132
Phone: (314)997-4342 x312  /  Fax: (314)997-7814

**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been swept by
MAILsweeper for the presence of computer viruses.
**********************************************************************

---

From: Rick Murphy <[email-masked]>
Date: Thu, 07 Sep 2000 16:42:41 -0400

>FW-1.  Now when they try to access ftp-gw they get disconnected at this point.

Firewall-1 requires that FTP connections come from port 20.  There's been 
patches posted in the past to permit this.
         -Rick

---

From: Rick Murphy <[email-masked]>
Date: Sat, 09 Sep 2000 10:58:01 -0400

At 11:10 AM 9/8/00 -0500, Larry D. Bonham wrote:
>Rick,
>
>Thanks for the response.  We had already had the default port setting at
>port 20.  We dealt with that problem quite some time ago.

Rats. Never anything easy.

>As it turns out I had to do a little slash and burn.  I disabled most of
>the entire sendsaved() function and sent it directly to flushsaved().  For
>whatever reason the Checkpoint proxy couldn't (wouldn't) handle the
>multiline response 331-.

That's probably a side effect of Checkpoint's "patch" to fix their FTP 
vulnerability. That's the only time ftp-gw adds anything to the 
interaction, so your change shouldn't have any effect (authenticated ftp 
users will probably break, though, if you're using authentication.)
         -Rick

---

From: "Larry D. Bonham" <[email-masked]>
Date: Fri, 8 Sep 2000 11:10:14 -0500 (CDT)

Rick,

The best I can tell everything is working.  It didn't break it for other
clients that could handle the multiline.  It just appears that it is
sending less information back to the client.  Most of the users are
utilizing send/wait scripting (expect) so I assume they are only looking
for the last lines anyway.

There must more to this than I am realizing.  What other effects might
this have?  Everything that I have tested with so far seems to work (DIR,
CD, PWD, GET, PUT, BINARY, ASCII).  We don't do much more than the basics.

Thanks for your help.

Larry B.

 > patches posted in the past to permit this.

=====================================================
Larry D. Bonham           Email: [email-masked]
Distribution 2000         Phone: (314)997-4342 x312
1160 Research Blvd.       Fax  : (314)997-7814
St. Louis, MO  63132
=====================================================

---

From: Rick Murphy <[email-masked]>
Date: Thu, 07 Sep 2000 16:42:41 -0400

---

From: Rick Murphy <[email-masked]>
Date: Sat, 09 Sep 2000 10:58:01 -0400