© 2022 HyQuest Solutions
133
Appendices
response to the PASV command. The client then initiates the connection from port N+1 to port P on the server to transfer
data.
From the server-side firewall's standpoint, to support passive mode FTP the following communication channels need to
be opened:
§
FTP server's port 21 from anywhere (Client initiates connection)
§
FTP server's port 21 to ports > 1023 (Server responds to client's control port)
§
FTP server's ports > 1023 from anywhere (Client initiates data connection to random port specified by server)
§
FTP server's ports > 1023 to remote ports > 1023 (Server sends ACKs (and data) to client's data port)
When drawn, a passive mode FTP connection looks like this:
In step 1, the client contacts the server on the command port and issues the PASV command. The server then replies in
step 2 with PORT 2024, telling the client which port it is listening to for the data connection. In step 3 the client then
initiates the data connection from its data port to the specified server data port. Finally, the server sends back an ACK in
step 4 to the client's data port.
While passive mode FTP solves many of the problems from the client side, it opens up a whole range of problems on the
server side. The biggest issue is the need to allow any remote connection to high numbered ports on the server.
Fortunately, many FTP daemons, including the popular WU-FTPD allow the administrator to specify a range of ports
which the FTP server will use.
The second issue involves supporting and troubleshooting clients which do (or do not) support passive mode.
As an example, the command line FTP utility provided with Solaris does not support passive mode, necessitating a third-
party FTP client, such as ncftp.
Note
: This is no longer the case--use the -p option with the Solaris FTP client to enable passive mode!
With the massive popularity of the World Wide Web, many people prefer to use their web browser as an FTP client. Most
browsers only support passive mode when accessing ftp:// URLs. This can either be good or bad depending on what the
servers and firewalls are configured to support.
Passive FTP Example
Below is an actual example of a passive FTP session. The only things that have been changed are the server names, IP
addresses, and user names. In this example an FTP session is initiated from testbox1.slacksite.com (192.168.150.80), a
Linux box running the standard FTP command line client, to testbox2.slacksite.com (192.168.150.90), a Linux box running
ProFTPd 1.2.2RC2. The debugging (
-d
) flag is used with the FTP client to show what is going on behind the scenes.
