(Svar sendes til:
nntp://dk.edb.sikkerhed )
Jacob Jørgensen wrote:
> "Kent Friis" <nospam@nospam.invalid> skrev i en meddelelse
> news:4b81844f$0$273$14726298@news.sunsite.dk...
>> Prøv at sætte FTP programmet op til "passive" mode.
>>
>> Mvh
>> Kent
>
> Mange af de FTP sider jeg besøger bruger kun Aktiv mode, så det ville ikke
> løse mit problem.
>
> Hilsen
>
> Jacob
Hej Jacob
Der kan være to grunde til at "active" ftp justeringen virker bedre:
1) De sites du forbinder dig til understøtter kun active ftp.
2) Dit ftp program har byttet rundt på active og passive ftp
konfigurationen. Det har jeg personligt selv oplevet mindst to gange.
Skodprogrammer.
-
PS: Ftp er en dårlig protokol - set med dagens sikkerhedsbriller. Man
burde udrydde den - luk for understøttelse af den i alle firewalls!:
Kombinationen at sip (=firewall "udp-gennemtræk"), ftp
firewall-understøttelse på bl.a. PCen/Macen - og aktiveret Javascript,
Java eller activeX i en browser, laver gennemtræk gennem mange firewalls
- uanset om NAT anvendes. Aktivering af active ftp svarer stort set til
at rulle den røde løber ud til hackere på din PC (Bl.a. derfor er jeg
fan af Firefox med aktiveret NoScript):
6th January 2010, Hacker pierces hardware firewalls with web page:
http://www.theregister.co.uk/2010/01/06/web_based_firewall_attack/
Citat: "...
Now, he's back with a simple method to penetrate hardware firewalls
using little more than some javascript embedded in a webpage.
....
By luring victims to a malicious link, the attacker can access virtually
any service on their machine, even when it's behind certain routers that
automatically block it to the outside world.
....
For the hack to work, the visitor must have an application such as file
transfer protocol or session initiation protocol running on his machine.
...."
FTP Attacks.
By Kurt Seifried (seifried@securityportal.com) for SecurityPortal:
http://www.developer.com/tech/article.php/774121
Citat: "...
PASV Versus ACTIVE
....
With active ftp, the client specifies to the server how the transfer
will be done...the primary one being the firewalls must allow incoming
connections from port 20 to a large selection of ports on internal
machines. This allows attackers to easily scan internal machines by
initiating connections from port 20.
....
With passive mode ftp the client asks the server for a file and the
server specifies how the transfer will be done.
....
This allows you to steal files without having to know usernames,
passwords or any other details, and can be done randomly with a good
chance of success. Unfortunately there is nothing the clients can do to
protect themselves: the process is reliant on the server to protect data
transfers.
....
Other Attacks
Probably the most popular FTP attack in the past was the FTP "bounce"
attack. By misusing the PORT command, an attacker could use an ftp
server to connect to other machines. This allows for all sorts of
malicious activity from simple port scanning to moving files around.
....
H D Moore: To be plain, FTP sucks.
...."
Og active ftp understøttelse får sikkerheden til drøne i jorden = endnu
mere gennemtræk !
-
Flere problemer:
(1) Hvis man vælger at anvende ftp, skal alle klienter sættes op til at
anvende "passive mode".
(2) Normalt ftp-intervenerer firewalls (Cisco pix: "fixup...ftp") eller
routere - med NAT - kun port 20-21 (ftp), men anvendes du andre end
disse IP-porte, kan netudstyret ikke intervenere og så er alle dine
potentielle NAT-brugere tabt, medmindre måske kan få ændret alle
firewalls og routere.
(3) Uden NAT er der nok stadig problemer, fordi firewalls kigger i
kontrolstrømmen efter hvilken IP-port ftp-forbindelsen skal foregå via.
Og når ftp sender besked, så åbner firewallen dynamisk for den ekstra
forbindelse ftp skal anvende. Men det kan den nok ikke hvis du vælger en
anden (FTP/)IP-port.
Derfor kan det være en fordel at anvende https eller evt. http - eller
andre "rene" tcp/ip bårne protokoller.
Re: Using PORT command (passive off) on ftp through PF:
http://naughty.monkey.org/openbsd/archive/misc/0204/msg01785.html
Citat: "...
FTP just sucks
http://www.codetalker.com/whitepapers/ftp-review.shtml
So you want to allow active FTP through your firewall. This is possible
without ftp-proxy, if you're not using NAT. If you use NAT, you'll need
ftp-proxy to make active ftp work.
The big problem is that FTP sucks. The easiest way to allow active FTP, is
the following rules [Her fjernes firewall filtrene!:]:
pass in all
pass out all
....
If you don't use ftp-proxy, you can't block anything.
...."
-
FTP Reviewed.
Chris Grant | 1998-07-03:
http://pintday.org/whitepapers/ftp-review.shtml
Citat: "...
There are two possible ways of establishing a data connection: active,
and passively-initiated connections. In the active technique, the client
first issues a PORT command to the server. This indicates to the server
which port the client wishes to receive the data on.
....
The second way of creating a data connection is called a
passively-initiated data transfer. Instead of issuing a PORT command,
the client can issue the PASV command.
....
Bring on the paranoia!
After reading the above I would hope the little rotating red "I see some
security concerns here" light was going off in your head. The
description on the previous page raises a whole series of potential
security issues, some of which I'll look at now.
....
Another potential problem is the very act of getting FTP through a
firewall. Regulating data transmissions with FTP can be very tricky,
particularly if the data is being actively transmitted.
....
Inevitable, difficulty results in bugs. This coupled with the fact that
FTP is typically an external service accessible from other networks goes
a good distance to explaining why there are so many FTP exploits and
attacks. Need proof? See the Recent Exploits section, below.
...."
Problems with the FTP protocol:
http://www.seifried.org/security/network/20010926-ftp-protocol.html
"...
Currently vsftpd (Very Secure FTPD) is the only ftp server I know of
specifically designed with security as it's main goal.
....
Kurt: What do you think of FTP in general?
H D Moore: To be plain, FTP sucks
....
For a secure transfer protocol, I recommend scp [Secure CoPy], part of
the OpenSSH package. There are FREE windows clients available, as well
as Full-Featured GUI applications by companies like F-Secure. SCP does
incur an encryption overhead, but for most cases it is fast enough.
...."
14. aug. 2002, Hacker trængt ind i NASA's inderste:
http://www.computerworld.dk/default.asp?Mode=2&ArticleID=15684
"...
Hidtil ukendt sikkerhedshul
Dernæst fremlagde han beviser for, at han også havde hacket andre af
NASA's systemer og erklærede, at han har brugt et hidtil ukendt
sikkerhedshul i FTP til at trænge igennem NASA's sikkerhedsmure.
...."
-
Information om ftps, sftp, scp:
http://en.wikipedia.org/wiki/SSH_file_transfer_protocol
http://en.wikipedia.org/wiki/FTP_over_SSH#FTP_over_SSH_.28not_SFTP.29
http://en.wikipedia.org/wiki/FTPS
http://en.wikipedia.org/wiki/Secure_copy
-
ftps - FTP-SSL and FTP-TLS - the state of play:
http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html
http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html#server
http://c2.com/cgi/wiki?FtpTls
Moving Your Data Securely:
http://www.stdnet.com/products/?category_number=1&subcategory_number=1
Glenn