Subject: [fwtk-users] ftp-gw problems behind a Nokia/FW-1-NG

From: "Michael C. Ibarra" <[email-masked]>
Date: Wed, 29 May 2002 07:59:58 -0400

Hello:

I've recently migrated from using FW-1 on a Solaris server
to a Nokia box running FW-1 version NG. Now, I am having some
difficulty getting ftp-gw to work. I've searched the archives
and all I have been able to find was a mention regarding data-
port. I've since then applied the data-port patch and modified
my netperm-table to include:

ftp-gw:   data-port 20

Unfortunately my results are still the same. Here is what my logs
from my ftp server looks like:

May 24 16:09:50 localhost ftpd[2713]: command: USER smith^M 
May 24 16:09:50 localhost ftpd[2713]: <--- 331 Password required for smith.
May 24 16:09:50 localhost ftpd[2713]: <--- 221 You could at least say goodbye.
May 24 16:09:50 localhost ftpd[2713]: FTP session closed

As you can see, the session closes immediately after sending a request
for the users password but the client never even sees a password prompt.
Are there some other patches aside from the ones on fwtk.org for this
problem?

My set looks like the following:

Client(ftp's to Proxy-srvr) --> Proxy-Server(ftp-gw) --> Ftp-Server

Both connections on either side of the Proxy-Server(ftp-gw) pass through
a Nokia box. My Proxy-Server, where fwtk lives, is running Solaris 2.8.
Proxy-Server works fine passing through old FW-1 (version 4)

Thanks in advance.

-mike

Michael C. Ibarra
Hawk Technologies, Inc
http://www.hawk.com
800.hawk.com

--------------------------------------------------

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Ted Keller <[email-masked]>
Date: Tue, 3 Sep 2002 18:05:44 -0400 (EDT)

Michael,

I suspect this is a fw-1 ftp protocol check that needs to be modified.  We
tend to install the following in our base.def files inside of fw1.  Note -
these are 4.1 type patches - but I suspect strongly that they should also
be in the NG version...

Ticket Note
----------------
  Placed changes back

  Made the following changes on base.def file:

  1) FIX 1: Remove the PASV newline check:

  --Comment out (with // marks) the following line:

       #define FTPPORT(match)        (call KFUNC_FTPPORT <0x1|(match)>)

  --Uncomment out the following line:

       //#define FTPPORT(match)  (call KFUNC_FTPPORT <(match)>)

  =====================================================================
  2) FIX 2: Remove the FTP control port newline check:

  --Comment out the following line:
       #define FTP_ENFORCE_NL

I suspect fix2 is the one that you need.

ted keller

On Wed, 29 May 2002, Michael C. Ibarra wrote:

> You are currently subscribed to fwtk-users as: [email-masked]

---