Subject: ftp-gw poxy

From: "Skolnik, Ed" <[email-masked]>
Date: Tue, 5 Jun 2001 16:18:29 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I don't understand, on some remote FTP servers this works like a charm and
on others I get the "Invalid reply" Can anyone help?

OS Net BSD 1.2.1 NetBSD 1.2.1 
	TIS Firewall Toolkit      September 1996                        

# Example ftp gateway rules:
# --------------------------
ftp-gw: denial-msg      /usr/local/etc/ftp-deny.txt
#ftp-gw:        welcome-msg     /usr/local/etc/ftp-welcome.txt
#ftp-gw:        help-msg        /usr/local/etc/ftp-help.txt
ftp-gw:         timeout 3600
# uncomment the following line if you want internal users to be
# able to do FTP with the internet
# Added support for SCO Mail server Dec 16 1997 J. Adams
ftp-gw:         permit-hosts 10.10.5.254

#!/bin/ksh
user1=xxxxxx  -----------------------------To protect
pswd1=ppppp
rmte=ftp.xxxxxx.com
logs=/tmp
listings="/tmp/$(basename $0).$$"
echo "$user1 $pswd1 $rmte"
echo "$listings"
echo "Press enter"
read DUMMY
#ftp -n $rmte << EOF > listing
ftp -v -n firewall << EOF > $listings
user $user1@$rmte $pswd1
ascii
ls
bye
EOF

OUTPUT:

Connected to gateway.
220 gw.florsheim.com FTP proxy (Version V2.0) ready.
----GATEWAY CONNECTED TO ftp.xxxxxx.com
Invalid reply.
220-You have connected to xxxxxx FTP Server
220-
220 Secure FTP Server ready.
USER xxxxxxx
Invalid reply.
530 Peer has closed connection
500 must be connected to remote server
500 must be connected to remote server
500 must be connected to remote server

Ed Skolnik 
Florsheim Group Inc. 
MIT Consultants 
200 N. LaSalle 
Chicago IL. 60601 
312-458-2655 Phone 
312-458-2661 Fax 
[email-masked] 

Confidentiality Notice: This e-mail message, including any attachments,
is for the sole use of the intended recipient(s) and may contain
confidential and privileged information. Any unauthorized review, use,
disclosure or distribution is prohibited. If you are not the intended
recipient, please contact the sender by reply e-mail and destroy all
copies of the original message. Thank you. 

--

---

From: Rick Murphy <[email-masked]>
Date: Tue, 05 Jun 2001 20:46:54 -0400

>on others I get the "Invalid reply" Can anyone help?

Without a pointer to the bad sites, it's going to be hard. However, looking at

>500 must be connected to remote server

The "----GATEWAY CONNECTED----" should really be
331-(----Gateway connnected to .... ----)
331- (more stuff)
331 Some prompt for a username

It almost seems like your FTP client isn't happy with the "331" 
continuation lines.
What happens when you run this interactively?
         -Rick

---

From: "Larry Jackson" <[email-masked]>
Date: Wed, 6 Jun 2001 12:56:16 -0400

Since the FTP server responds:
220 Secure FTP Server ready.

I would guess that the proxy isn't handling the newer
FTP Security Extensions from 1997 in RFC2228
http://www.csl.sony.co.jp/cgi-bin/hyperrfc?rfc2228.txt

The two "> Invalid reply." messages probably mean
the proxy is getting a different number response than it expects.
These responses are defined in RFC2228 and probably
contain the challenge/response info.

Has anyone written a patch to add support for this RFC?

[email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Wed, 06 Jun 2001 17:17:44 -0400

>contain the challenge/response info.

While you may be on the right track, it's not the fwtk proxy - the
text "Invalid reply" doesn't show up anywhere in the ftp-gw source.

By the way, is everyone else having really long lead times on the mailing 
list? A message I sent out yesterday didn't get sent out to the list for 16 
hours!
         -Rick