[SOLVED] ip_conntrack_ftp and SSL / TLS

Al_ · 09-29-2009, 06:00 PM

FTP, i.e., FTPS, needs open ports for data transfer; these ports are negotiated by the PORTS command. There are numerous threads explaining that ip_conntrack_ftp can not decrypt TLS-encrypted traffic to figure out which ports to open in the firewall. This is certainly true if the firewall runs on a different machine than the FTP server.

However, I also have a firewall (iptables) running on the same machine that hosts the ftp server (vsftpd). Did anybody figure out whether it is possible for iptables and ip_conntrack_ftp to make use of ssl and the private key to effectively track which ports to open?

If no solution using ip_conntrack_ftp is available, I need to keep some ports permanently and unconditionally open for input. SFTP (FTP over SSH) is no alternative for me.

Regards, A_

panky · 09-30-2009, 02:54 AM

Please post what is your real problem? The client can't connect? Server can't connect to client after PORT command?

anomie · 09-30-2009, 12:22 PM

Quote:

Originally Posted by Al_

However, I also have a firewall (iptables) running on the same machine that hosts the ftp server (vsftpd). Did anybody figure out whether it is possible for iptables and ip_conntrack_ftp to make use of ssl and the private key to effectively track which ports to open?

I don't know whether said module can be enticed into working with ftps, but IMO your solution is acceptable.

Code:

# sysctl -a | grep 'port_range'
net.ipv4.ip_local_port_range = 32768	61000

So you open x - y (32768 - 61000 in my case) on your host-level firewall and let the passive ftp clients do their thing. I do the same thing on a FreeBSD host w/ PF.

-------

By the way: you could make the range that you open much smaller by specifying pasv_min_port and pasv_max_port in vsftpd.conf.

Al_ · 09-30-2009, 05:06 PM

Quote:

Originally Posted by panky

Please post what is your real problem? The client can't connect? Server can't connect to client after PORT command?

Is it a problem? I do not know. Fact is that my tight iptables settings on the computer hosting the vsftp server work fine for unencrypted FTP in passive mode but not for FTPS. The reason is very obvious: I have an iptables rule that accepts incoming ftp data if 'state RELATED,ESTABLISHED'. ip_conntrack_ftp correctly inspects unencrypted FTP traffic (on port 21) and thus knows, which traffic on data ports is RELATED. ip_conntrack_ftp is not able to inspect encrypted traffic (after all, avoiding 'inspection' is the goal of encryption), thus data traffic is not identified as RELATED and is thus dropped.
Consequence: login by FTPS works, but as soon as passive mode is switched on for directory listing, the firewall blocks.

As said, this behavior is fully understandable and due to encryption of the PASV / PORT commands. However, the option of having ports open seems to me to be a potential safety risk.

Regards

A_

Al_ · 09-30-2009, 05:19 PM

Quote:

Originally Posted by anomie

...So you open x - y (32768 - 61000 in my case) on your host-level firewall and let the passive ftp clients do their thing. I do the same thing on a FreeBSD host w/ PF. ...

Thanks. Is it safe to have ports (restricted in vsftpd.conf to a small range) continuously open / unprotected?
I could speculate on another solution: is it possible using ip_conntrack (NOT ip_conntrack_ftp) to dynamically figure out which client ip-address is connected to port 21? Is the following iptables rule (in pseudocode) possible? How to word?

Code:

iptables -A INPUT -p tcp -s the ip-address that is currently connected to port 21 -i eth0 -j ACCEPT

A_

chrism01 · 10-01-2009, 03:01 AM

Those ports are just limit the ones vsftpd server can tell the client to use. I don't think it listens on them continuously; see
http://www.linuxtopia.org/online_boo...ftpd-conf.html
http://slacksite.com/other/ftp.html

anomie · 10-01-2009, 12:19 PM

Right, the vsftpd-related ports in that range are only opened when a PASV mode transfer is set up.

Al_ · 10-02-2009, 02:55 AM

@anomie and chrism01: you seem in agreement that it is safe to have iptables accept packets on ports that vsftpd might choose for the data connection. Thanks.

This leaves me with the more philosophical question: why did somebody take the effort to write ip_conntrack_ftp (for use with non-encrypted ftp), if it is equally safe without ip_conntrack_ftp?

Regards, A_

panky · 10-02-2009, 03:58 AM

Maybe you should ask: What for is firewall?

Leaving this ports range accepted on firewall can lead to abuse of your server. In case you have untrusted users on your server or one of services (ftp, www, smtp, etc.) running on it can be compromised your server can be abused to set up arbitrary service accepting connections on port from passive-ftp range. It can be for eg. psyBNC bot used as 'Command Center' for botnets.

If in your case you are the only user you don't have to worry about it.

anomie · 10-02-2009, 03:37 PM

As I said earlier, IMO this solution is acceptable (not ideal).

@Al_: please check post #3 again for tips on how to restrict the passive port range that vsftpd uses. You can set up your iptables rule to match that same range, thus narrowing the potential attack surface.

Moreover, like any service, this is not something you put into place and then forget about for a few years. I'm giving advice with the assumption that you are actually reading your logs and monitoring system activity.