Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

RE: How the FTP protocol Challenges Firewall Security article

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2000 Firewall] >> General >> RE: How the FTP protocol Challenges Firewall Security article Page: <<   < prev  1 [2] 3 4   next >   >>
Login
Message << Older Topic   Newer Topic >>
RE: How the FTP protocol Challenges Firewall Security a... - 6.Jul.2003 11:48:00 AM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hi Darren,

even then I would not setup a secure FTP. Have you already investigated the use of Terminal Services or Citrix Metaframe? The thin client concept provides you with true mobility for your workforce - to anywhere, on any device, over any connection - because the real data never leaves the office. Just use strong user authentication, preferable a hardware token for reason of mobility and you are up and running.

Some add-on products to consider:
- Aspelle Everywhere: an ISA add-on. Checkout http://www.aspelle.com .
- Aventail: appliance system. Checkout http://www.aventail.com .
- Citrix NFuse and Secure Gateway: add-ons to the Citrix Metaframe. Check out http://www.citrix.com .

HTH,
Stefaan

(in reply to spouseele)
Post #: 21
RE: How the FTP protocol Challenges Firewall Security a... - 7.Jul.2003 5:47:00 AM   
Darren Thompson

 

Posts: 146
Joined: 21.May2002
From: Perth, Western Australia
Status: offline 		Hi Stefaan,

Thanks for the info, I have opted for anonymous FTP for uploading files to our server using IIS, with write only. And SSL/HTTPS with basic authentication for downloading files. Both the HTTPS and FTP virtual directories point to the same location, IIS running on the ISA machine using server publishing rules for the local FTP server, and a web publishing rule for the HTTPS download.

I wanted to stay with low cost/native stuff as much as possibel (cost being the primary driving force here - as always!)

I think the above scenario should be OK for our needs (Security vs Simplicity) Hows it sound to you ?

Thanks for you help and feedback

Darren

(in reply to spouseele)
Post #: 22
RE: How the FTP protocol Challenges Firewall Security a... - 7.Jul.2003 9:43:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hi Darren,

if you can't go with a thin client concept then the use of HTTPS is your best choice. That's no problem for downloading files, but for uploading you might look for a little tool such as http://www.aspupload.com/index.html . This kind of tools make it possible to upload files through HTTP/HTTPS.

HTH,
Stefaan

[ July 07, 2003, 09:43 PM: Message edited by: spouseele ]

(in reply to spouseele)
Post #: 23
RE: How the FTP protocol Challenges Firewall Security a... - 9.Jul.2003 4:09:00 PM   
felipe007

 

Posts: 29
Joined: 20.Aug.2001
From: chicago,il,usa
Status: offline 		spouseele,

wondering if you can take a look.

http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=3;t=003178

sorry to bug but i am stuck here.

Thank you for your time,
felipe

(in reply to spouseele)
Post #: 24
RE: How the FTP protocol Challenges Firewall Security a... - 9.Aug.2003 3:28:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hi all,

just to let you know I've updated the article with some new information about FTP through the Web Proxy service: Web Proxy Service Returns "The User Name Was Not Allowed" Error Message After the FTP Server Returns the "User Logged In" Message.

HTH,
Stefaan

(in reply to spouseele)
Post #: 25
RE: How the FTP protocol Challenges Firewall Security a... - 12.Aug.2003 5:26:00 AM   
dpeters

 

Posts: 64
Joined: 7.Jun.2002
Status: offline 		Hi Spouseele,

I have a question about your article on FTP. In it you say

"Although Network Address Translation is an interesting technique to mitigate the shortage of public routable IP addresses, it creates also a whole new range of problems. The reason for that is that a lot of protocols are not designed with NAT/PAT in mind. Take as an example the FTP protocol. The IP-addresses and port numbers used for the Data connection are dynamically negotiated. Simple NAT/PAT devices who only look to the IP addresses and port numbers (layer 3 and 4 information), do not analyse the application layer where the actual negotiating process occures (PORT and PASV commands). So, without added special support, simple NAT/PAT devices will very likely break those complex protocols, including the FTP protocol."

but shouldn't PASV FTP pass through NAT ok without any problems because it's the client initiating the connection ? I would think the NAT device would just tranlate the packets the same as any other client initiated packets. It shouldn't need to know in advance about the data connection.

Also, in the Microsoft Technet article about modifying the registry to let ISA support PASV FTP I have two questions:

1) I assume this means that changing the passive vs active ftp settings in IE has no effect when going through ISA.

2) Do you have to keep changing the setting and restarting the service every time a client wants to make an active ftp connection and then a different client needs to make a passive ftp connection ? This would seem unworkable in a normal situation where some programs need active access and some need passive.

(in reply to spouseele)
Post #: 26
RE: How the FTP protocol Challenges Firewall Security a... - 12.Aug.2003 4:14:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hi dpeters,

yes, PASV mode is somewhat more firewall friendly for simple firewalls at the client side. However, it doesn't solve the problem if NAT/PAT is done at the server side! [Big Grin]

If the FTP request is handled by the Web Proxy service on ISA, then the registry setting mentioned in KB300641 determines the FTP mode. Note that this is a global setting.

Also, keep in mind that if the internal FTP client is configured to work through the Web Proxy service, the internal FTP client talks HTTP to the ISA server and the ISA server talks FTP to the FTP server. So, from the point of view of the FTP server, the FTP client is the ISA Web Proxy service, not the internal FTP client. Therefore the internal FTP client can *not* control the FTP mode because there is simply no HTTP method available to do that.

However, if the FTP request is handled by the Firewall service on ISA, then it is the internal FTP client who determines the FTP mode because the internal FTP client uses directly the FTP protocol.

HTH,
Stefaan

(in reply to spouseele)
Post #: 27
RE: How the FTP protocol Challenges Firewall Security a... - 26.Sep.2003 10:13:00 PM   
andre@freaking.info

 

Posts: 68
Joined: 23.Sep.2003
From: New York
Status: offline 		Hello,

Maybe it was more appropriate to ask my question in this thread, I asked it in Publishing message board.

I read the article this thread is dedicated to, and still cannot get the FTP site running on the ISA machine to work. Maybe you guys could explain my situation?

Thank you in advance.

Link to thread:

http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=6;t=002004

Andre.

(in reply to spouseele)
Post #: 28
RE: How the FTP protocol Challenges Firewall Security a... - 26.Sep.2003 11:13:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hi Andre,

check out http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=6;t=002004 ! [Big Grin]

Thanks,
Stefaan

(in reply to spouseele)
Post #: 29
RE: How the FTP protocol Challenges Firewall Security a... - 12.Oct.2003 6:31:00 AM   
Money Penney

 

Posts: 130
Joined: 18.Sep.2002
From: Melbourne
Status: offline 		Excellent article, FTP was one protocol I had never really bothered to get my head around properly and now I at least have a good basic understanding which has helped me fix various problems, or at least pointed me in the right direction.

Interested in comments on this situtation:

I look after a few MS SBS 2000 boxes and need to have packet filters enabled for outbound Port 21 and Inbound Port 20 to allow things like Symantec Antivirus to be able to download virus updates.

Normally this could be a potentially security hole in the system, however all of these networks are also behind a NAT router with only specified Ports open for inbound access (port 20 is not one of them!).

Is this any safer? Port 20 is not open on the router, and so the only way connections get through is if they are part of an existing session (the outbound FTP). To me this would seem much safer as it is impossible to just come in on port 20. Is my logic sound, or are there tricks that would get around this somehow that I should be aware of?

(in reply to spouseele)
Post #: 30
RE: How the FTP protocol Challenges Firewall Security a... - 12.Oct.2003 8:45:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hi Money,

I would *never* allow an FTP client on ISA itself. It's a too dangerous configuration, especially if active mode FTP is used. The reason is that when you create manually IP packet filters, they are static. So, the allowed UDP/TCP ports are always open.

The proper solution is to either do the downloads from an internal hosts and distribute them from there, or insist on HTTP download with web proxy support from ISA. In the latter case, the download client should be configured as a Web Proxy client by using 'ISA_internal_IP:8080' as proxy settings.

HTH,
Stefaan

(in reply to spouseele)
Post #: 31
RE: How the FTP protocol Challenges Firewall Security a... - 15.Oct.2003 7:24:00 AM   
Money Penney

 

Posts: 130
Joined: 18.Sep.2002
From: Melbourne
Status: offline 		Understood completely and as a rule I would rather have things differently in many ways, however a lot of my customers are small businesses running SBS 2000 (that in itself is a bit of a risk, ISA on your DC and file and print server!).

Many of these sites only have the one server, and ensuring a client machine is running all the time to facilitate these downloads is not always possible.

What I want to get a clear understanding of is if having a NAT router between the Internet connection and the ISA server, that is not allowing inbound connections on any of the FTP ports, reduces or removes the risk of someone trying to take advantage of this packet filter being configured.

HTTP is not an option, unless you can help me convince Symantec to provide their Intelligent Udpates via HTTP instead of FTP. [Cool]

(in reply to spouseele)
Post #: 32
RE: How the FTP protocol Challenges Firewall Security a... - 15.Oct.2003 10:00:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hi Money,

if Symantec isn't willing to implement HTTP download, then change from vendor! Even McAfee was able to redesign their update manager to work through HTTP download! [Big Grin]

However if you have no other option then using an FTP client, ONLY allow passive mode FTP. In that case only outbound connections are needed.

HTH,
Stefaan

[ October 15, 2003, 10:01 PM: Message edited by: spouseele ]

(in reply to spouseele)
Post #: 33
RE: How the FTP protocol Challenges Firewall Security a... - 17.Oct.2003 4:03:00 AM   
Money Penney

 

Posts: 130
Joined: 18.Sep.2002
From: Melbourne
Status: offline 		Thanks... I did quite a bit of testing between SAV and McAfee for small business environments and I personally found that the McAfee product a lot more problematic for various reasons.

SAV works well is easy to manage and administer and scales well so this is a minor issue for me.

I will investigate using a client other than the standard Windows FTP client so that I can use PASV. Thanks for the help.

PS: you never really answered my question however, about ISA being behind a NAT router... [Cool]

(in reply to spouseele)
Post #: 34
RE: How the FTP protocol Challenges Firewall Security a... - 17.Oct.2003 10:18:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hi Money,

OK!

The FTP client connect to TCP port 21 (outbound) for the control connection. In active mode the FTP server connects back *from* TCP port 20 (source port) to an unprivileged TCP port (> 1023) on the FTP client. That unprivileged TCP port is negotiated with the FTP command PORT on the control connection. So, an inbound connection to TCP port 20 is never used for an FTP client! [Big Grin]

BTW --- In general, it makes no sense at all to allow something on ISA and deny the same thing on an upstream router. Wy allowing it then on ISA in the first place?

HTH,
Stefaan

(in reply to spouseele)
Post #: 35
RE: How the FTP protocol Challenges Firewall Security a... - 19.Oct.2003 6:14:00 AM   
Money Penney

 

Posts: 130
Joined: 18.Sep.2002
From: Melbourne
Status: offline 		Ah yes you are of course correct, I had a serious brain blockage there.. [Cool]

The download is available via HTTP but not with a static filename so it has to be FTP. Will use a PASV capable client instead, thanks for your patience and pointing out temporary insanity!

(in reply to spouseele)
Post #: 36
RE: How the FTP protocol Challenges Firewall Security a... - 19.Oct.2003 5:28:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hi Money,

glad I could help and thanks for the follow up! [Smile]

Stefaan

(in reply to spouseele)
Post #: 37
RE: How the FTP protocol Challenges Firewall Security a... - 30.Oct.2003 1:17:00 AM   
Money Penney

 

Posts: 130
Joined: 18.Sep.2002
From: Melbourne
Status: offline 		OK I have been searching for a command line Passive FTP client that will run nicely on the server without any extras or spyware.

It needs to accept standard FTP commands from a batch file the same as the existing client, or is simple enough to batch...

... not having much luck.

Any suggestions, anyone???

(in reply to spouseele)
Post #: 38
RE: How the FTP protocol Challenges Firewall Security a... - 30.Oct.2003 10:03:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hi Money,

check out http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=3;t=003586 ! [Big Grin]

Thanks,
Stefaan

(in reply to spouseele)
Post #: 39
RE: How the FTP protocol Challenges Firewall Security a... - 17.Dec.2003 9:05:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline 		Hey guys,

if you want to tighten your FTP security, check out the following ISA server 2000 hotfix:
- http://support.microsoft.com/default.aspx?scid=kb;en-us;816459
- http://www.microsoft.com/downloads/details.aspx?FamilyID=2d797ea3-3958-4cbb-872e-a34455d96e6c&DisplayLang=en

HTH,
Stefaan

(in reply to spouseele)
Post #: 40

Page:   <<   < prev  1 [2] 3 4   next >   >> << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2000 Firewall] >> General >> RE: How the FTP protocol Challenges Firewall Security article Page: <<   < prev  1 [2] 3 4   next >   >>
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts