An FTP problem (?)

SiLiCoN · 09-02-2004, 03:00 AM

Hi All,

This is the first time I am here and with a confusing question (for me atleast).
The problem is ... i wanted to block all outgoing FTP connections from my server and so i quoted the
#ftp 21/tcp
#ftp 21/udp fsp fspd
in /etc/services file ...
now, this worked partly as i couldnot run ftp command from my shell
ftp: ftp/tcp: unknown service <--- that is what i get and that is OK

but i ran a perl script and was able to upload files to different servers which uses Net::FTP (i guess it uses port 21 too)... that was surprising

Moreover i could still connect to that server using FTP from other machines to the server (though the port 21 in the server is blocked ?) - that is surprising too, though my initial intension was to block all outgoing FTP connections from the server, but i guess when i block port 21 it should block all incoming FTP connections too.

What i understand is that ftp daemon still runs on the server and that's why i can connect but what i dont understand is how can i connect to the server if port 21 is blocked???

Also i ran an nmap on the server and found out
Port State Service
21/tcp open ftp
(port 21 is open ?)

It would be great help if someone can tell me whats going on and how can i actually achieve to block outgoing FTP and incoming FTP individually...
oh! forgot to mention, my server is running RedHat 9.0 (if that helps!)

Thanks in advance

nukkel · 09-02-2004, 03:16 AM

Hi, and welcome

actually that's not the purpose of the /etc/services file, it's only there to define what protocol is what port#, so that the "ftp" command for example, knows it has to connect to port 21. Some programs don't use this file and directly connect to 21, without consulting /etc/services... as you noticed.

The solution is to block it in the firewall. Maybe RedHat has same program for configuring the firewall, I'm not sure. But if it doesn't, here's how you can do it in the shell:

Code:

iptables -A OUTPUT -p tcp --destination-port 21 -j DROP

This will DROP (block) all OUTgoing tcp traffic to (remote) port 21.
Likewise,

Code:

iptables -A INPUT -p tcp --destination-port 21 -j DROP

drops all incoming traffic to your ftp port.

Again, it's possible Redhat has some gui config program for this too, better check that out first

hope this helped, feel free to ask for more clarification

SiLiCoN · 09-02-2004, 04:52 AM

Thanks for the help....it worked out and now i also know the purpose of services file

Thanks for the help