All About FTP Must Read
Posted by NovaAngel at October 9th, 2006
Settin’ Up A Ftp:
Well, since many of us have always wondered this, here it is. Lon’ and drawn out. Also, before attemptin’ this, realize one thin’; You will have to give up your time, effort, bandwidth, and security to have a quality ftp server.
That bein’ said, here it goes. First of all, find out if your IP (Internet Protocol) is static (not chan’in’) or dynamic (changes everytime you log on). To do this, first consider de fact if you have a dial up mothem. If you do, chances are about 999 999 out of 1 000 000 that your IP is dynamic. To make it static, just go to a place like h*tp://www.myftp.org/ to register for a static ip address.
You’ll den need to get your IP. This can be done by doin’ this:
Goin’ to Start -> Run -> winipcfg or www.ask.com and askin’ ‘What is my IP?’
After doin’ so, you’ll need to download an FTP server client. Personally, I’d recommend G6 FTP Server, Serv-U FTPor Bullitproof v2.15 all three of which are extremely reliable, and de norm of de ftp world.
You can download them on this site: h*tp://www.liaokai.com/softw_en/d_index.htm
First, you’ll have to set up your ftp. For this guide, I will use step-by-step instructions for G6. First, you’ll have to go into ‘Setup -> General’. From here, type in your port # (default is 21). I recommend somethin’ unique, or somethin’ a bit larger (ex: 3069). If you want to, check de number of max users (this sets de amount of simultaneous maximum users on your server at once performin’ actions - The more on at once, de slower de connection and vice versa).
The below options are den chooseable:
-Launch with windows
-Activate FTP Server on Start-up
-Put into tray on startup
-Allow multiple instances
-Show “Loadin’…” status at startup
-Scan drive(s) at startup
-Confirm exit
You can do what you want with dese, as dey are pretty self explanatory. The scan drive feature is nice, as is de 2nd and de last option. From here, click de ‘options’ text on de left column.
To protect your server, you should check ‘login check’ and ‘password check’, ‘Show relative path (a must!)’, and any oder options you feel you’ll need. After doin’ so, click de ‘advanced’ text in de left column. You should den leave de buffer size on de default (unless of course you know what you’re doin’ ), and den allow de type of ftp you want.
Uploadin’ and downloadin’ is usually good, but it’s up to you if you want to allow uploads and/or downloads. For de server priority, that will determine how much conventional memory will be used and how much ‘effort’ will go into makin’ your server run smoothly.
Anti-hammerin’ is also good, as it prevents people from slowin’ down your speed. From here, click ‘Log Options’ from de left column. If you would like to see and record every sin’le command and clutter up your screen, leave de defaults.
But, if you would like to see what is goin’ on with de lowest possible space taken, click ‘Screen’ in de top column. You should den check off ‘Log successful logins’, and all of de options in de client directry, except ‘Log directory changes’. After doin’ so, click ‘Ok’ in de bottom left corner.
You will den have to go into ‘Setup -> User Accounts’ (or ctrl & u). From here, you should click on de right most column, and right click. Choose ‘Add’, and choose de username(s) you would like people to have access to.
After givin’ a name (ex: themoonlandin’), you will have to give them a set password in de bottom column (ex: wasfaked). For de ‘Home IP’ directory, (if you registered with a static server, check ‘All IP Homes’. If your IP is static by default, choose your IP from de list. You will den have to right click in de very center column, and choose ‘Add’.
From here, you will have to set de directory you want de people to have access to. After choosin’ de directory, I suggest you choose de options ‘Read’, ‘List’, and ‘Subdirs’, unless of course you know what you’re doin’ . After doin’ so, make an ‘upload’ folder in de directory, and choose to ‘add’ this folder seperately to de center column. Choose ‘write’, ‘append’, ‘make’, ‘list’, and ’subdirs’. This will allow them to upload only to specific folders (your upload folder).
Now click on ‘Miscellaneous’ from de left column. Choose ‘enable account’, your time-out (how lon’ it takes for people to remain idle before you automatically kick them off), de maximum number of users for this name, de maximum number of connections allowed simultaneously for one ip address, show relative path (a must!), and any oder thin’s at de bottom you’d like to have. Now click ‘Ok’.
**Requested**
From this main menu, click de little boxin’ glove icon in de top corner, and right click and unchoose de hit-o-meter for both uploads and downloads (with this you can monitor IP activity). Now click de lightnin’ bolt, and your server is now up and runnin’.
Post your ftp info, like this:
213.10.93.141 (or somethin’ else, such as: ‘f*p://example.getmyip.com’)
User: *** (The username of de client)
Pass: *** (The password)
Port: *** (The port number you chose)
So make a FTP and join de FTP section
Listin’ The Contents Of A Ftp:
Listin’ de content of a FTP is very simple.
You will need FTP Content Maker, which can be downloaded from here:
ht*p://www.etplanet.com/download/application/FTP%20Content%20Maker%201.02.zip
1. Put in de IP of de server. Do not put “ftp://” or a “/” because it will not work if you do so.
2. Put in de port. If de port is de default number, 21, you do not have to enter it.
3. Put in de username and password in de appropriate fields. If de login is anonymous, you do not have to enter it.
4. If you want to list a specific directory of de FTP, place it in de directory field. Oderwise, do not enter anythin’ in de directory field.
5. Click “Take de List!”
6. After de list has been taken, click de UBB output tab, and copy and paste to wherever you want it.
If FTP Content Maker is not workin’, it is probably because de server does not utilize Serv-U Software.
If you get this error message:
StatusCode = 550
LastResponse was : ‘Unable to open local file test-ftp’
Error = 550 (Unable to open local file test-ftp)
Error = Unable to open local file test-ftp = 550
Close and restart FTP Content Maker, den try again.
error messages:
110 Restart marker reply. In this case, de text is exact and not left to de particular implementation; it must read: MARK yyyy = mmmm Where yyyy is User-process data stream marker, and mmmm server’s equivalent marker (note de spaces between markers and “=”).
120 Service ready in nnn minutes.
125 Data connection already open; transfer startin’.
150 File status okay; about to open data connection.
200 Command okay.
202 Command not implemented, superfluous at this site.
211 System status, or system help reply.
212 Directory status.
213 File status.
214 Help message. On how to use de server or de meanin’ of a particular non-standard command. This reply is useful only to de human user.
215 NAME system type. Where NAME is an official system name from de list in de Assigned Numbers document.
220 Service ready for new user.
221 Service closin’ control connection. Logged out if appropriate.
225 Data connection open; no transfer in progress.
226 Closin’ data connection. Requested file action successful (for example, file transfer or file abort).
227 Enterin’ Passive Mode (h1,h2,h3,h4,p1,p2).
230 User logged in, proceed.
250 Requested file action okay, completed.
257 “PATHNAME” created.
331 User name okay, need password.
332 Need account for login.
350 Requested file action pendin’ furder information.
421 Too many users logged to de same account
425 Can’t open data connection.
426 Connection closed; transfer aborted.
450 Requested file action not taken. File unavailable (e.g., file busy).
451 Requested action aborted: local error in processin’.
452 Requested action not taken. Insufficient storage space in system.
500 Syntax error, command unrecognized. This may include errors such as command line too lon’.
501 Syntax error in parameters or arguments.
502 Command not implemented.
503 Bad sequence of commands.
504 Command not implemented for that parameter.
530 Not logged in.
532 Need account for storin’ files.
550 Requested action not taken. File unavailable (e.g., file not found, no access).
551 Requested action aborted: page type unknown.
552 Requested file action aborted. Exceeded storage allocation (for current directory or dataset).
553 Requested action not taken. File name not allowed.
Active FTP vs. Passive FTP, a Definitive Explanation
Introduction
One of de most commonly seen questions when dealin’ with firewalls and oder Internet connectivity issues is de difference between active and passive FTP and how best to support eider or both of them. Hopefully de followin’ text will help to clear up some of de confusion over how to support FTP in a firewalled environment.
This may not be de definitive explanation, as de title claims, however, I’ve heard enough good feedback and seen this document linked in enough places to know that quite a few people have found it to be useful. I am always lookin’ for ways to improve thin’s though, and if you find somethin’ that is not quite clear or needs more explanation, please let me know! Recent additions to this document include de examples of both active and passive command line FTP sessions. These session examples should help make thin’s a bit clearer. They also provide a nice picture into what goes on behind de scenes durin’ an FTP session. Now, on to de information…
The Basics
FTP is a TCP based service exclusively. There is no UDP component to FTP. FTP is an unusual service in that it utilizes two ports, a ‘data’ port and a ‘command’ port (also known as de control port). Traditionally dese are port 21 for de command port and port 20 for de data port. The confusion begins however, when we find that dependin’ on de mode, de data port is not always on port 20.
Active FTP
In active mode FTP de client connects from a random unprivileged port (N > 1024) to de FTP server’s command port, port 21. Then, de client starts listenin’ to port N+1 and sends de FTP command PORT N+1 to de FTP server. The server will den connect back to de client’s specified data port from its local data port, which is port 20.
From de server-side firewall’s standpoint, to support active mode FTP de followin’ communication channels need to be opened:
FTP server’s port 21 from anywhere (Client initiates connection)
FTP server’s port 21 to ports > 1024 (Server responds to client’s control port)
FTP server’s port 20 to ports > 1024 (Server initiates data connection to client’s data port)
FTP server’s port 20 from ports > 1024 (Client sends ACKs to server’s data port)
In step 1, de client’s command port contacts de server’s command port and sends de command PORT 1027. The server den sends an ACK back to de client’s command port in step 2. In step 3 de server initiates a connection on its local data port to de data port de client specified earlier. Finally, de client sends an ACK back as shown in step 4.
The main problem with active mode FTP actually falls on de client side. The FTP client doesn’t make de actual connection to de data port of de server–it simply tells de server what port it is listenin’ on and de server connects back to de specified port on de client. From de client side firewall this appears to be an outside system initiatin’ a connection to an internal client–somethin’ that is usually blocked.
Active FTP Example
Below is an actual example of an active FTP session. The only thin’s that have been changed are de server names, IP addresses, and user names. In this example an FTP session is initiated from testbox1.slacksite.com (192.168.150.80), a linux box runnin’ de standard FTP command line client, to testbox2.slacksite.com (192.168.150.90), a linux box runnin’ ProFTPd 1.2.2RC2. The debuggin’ (-d) flag is used with de FTP client to show what is goin’ on behind de scenes. Everythin’ in red is de debuggin’ output which shows de actual FTP commands bein’ sent to de server and de responses generated from those commands. Normal server output is shown in black, and user input is in bold.
There are a few interestin’ thin’s to consider about this dialog. Notice that when de PORT command is issued, it specifies a port on de client (192.168.150.80) system, rader than de server. We will see de opposite behavior when we use passive FTP. While we are on de subject, a quick note about de format of de PORT command. As you can see in de example below it is formatted as a series of six numbers separated by commas. The first four octets are de IP address while de second two octets comprise de port that will be used for de data connection. To find de actual port multiply de fifth octet by 256 and den add de sixth octet to de total. Thus in de example below de port number is ( (14*256) + 178), or 3762. A quick check with netstat should confirm this information.
testbox1: {/home/p-t/slacker/public_html} % ftp -d testbox2
Connected to testbox2.slacksite.com.
220 testbox2.slacksite.com FTP server ready.
Name (testbox2:slacker): slacker
—> USER slacker
331 Password required for slacker.
Password: TmpPass
—> PASS XXXX
230 User slacker logged in.
—> SYST
215 UNIX Type: L8
Remote system type is UNIX.
Usin’ binary mode to transfer files.
ftp> ls
ftp: setsockopt (ignored): Permission denied
—> PORT 192,168,150,80,14,178
200 PORT command successful.
—> LIST
150 Openin’ ASCII mode data connection for file list.
drwx—— 3 slacker users 104 Jul 27 01:45 public_html
226 Transfer complete.
ftp> quit
—> QUIT
221 Goodbye.
Passive FTP
In order to resolve de issue of de server initiatin’ de connection to de client a different method for FTP connections was developed. This was known as passive mode, or PASV, after de command used by de client to tell de server it is in passive mode.
In passive mode FTP de client initiates both connections to de server, solvin’ de problem of firewalls filterin’ de incomin’ data port connection to de client from de server. When openin’ an FTP connection, de client opens two random unprivileged ports locally (N > 1024 and N+1). The first port contacts de server on port 21, but instead of den issuin’ a PORT command and allowin’ de server to connect back to its data port, de client will issue de PASV command. The result of this is that de server den opens a random unprivileged port (P > 1024) and sends de PORT P command back to de client. The client den initiates de connection from port N+1 to port P on de server to transfer data.
From de server-side firewall’s standpoint, to support passive mode FTP de followin’ communication channels need to be opened:
FTP server’s port 21 from anywhere (Client initiates connection)
FTP server’s port 21 to ports > 1024 (Server responds to client’s control port)
FTP server’s ports > 1024 from anywhere (Client initiates data connection to random port specified by server)
FTP server’s ports > 1024 to remote ports > 1024 (Server sends ACKs (and data) to client’s data port)
In step 1, de client contacts de server on de command port and issues de PASV command. The server den replies in step 2 with PORT 2024, tellin’ de client which port it is listenin’ to for de data connection. In step 3 de client den initiates de data connection from its data port to de specified server data port. Finally, de server sends back an ACK in step 4 to de client’s data port.
While passive mode FTP solves many of de problems from de client side, it opens up a whole range of problems on de server side. The biggest issue is de need to allow any remote connection to high numbered ports on de server. Fortunately, many FTP daemons, includin’ de popular WU-FTPD allow de administrator to specify a range of ports which de FTP server will use. See Appendix 1 for more information.
The second issue involves supportin’ and troubleshootin’ clients which do (or do not) support passive mode. As an example, de command line FTP utility provided with Solaris does not support passive mode, necessitatin’ a third-party FTP client, such as ncftp.
With de massive popularity of de World Wide Web, many people prefer to use deir web browser as an FTP client. Most browsers only support passive mode when accessin’ ftp:// URLs. This can eider be good or bad dependin’ on what de servers and firewalls are configured to support.
Passive FTP Example
Below is an actual example of a passive FTP session. The only thin’s that have been changed are de server names, IP addresses, and user names. In this example an FTP session is initiated from testbox1.slacksite.com (192.168.150.80), a linux box runnin’ de standard FTP command line client, to testbox2.slacksite.com (192.168.150.90), a linux box runnin’ ProFTPd 1.2.2RC2. The debuggin’ (-d) flag is used with de FTP client to show what is goin’ on behind de scenes. Everythin’ in red is de debuggin’ output which shows de actual FTP commands bein’ sent to de server and de responses generated from those commands. Normal server output is shown in black, and user input is in bold.
Notice de difference in de PORT command in this example as opposed to de active FTP example. Here, we see a port bein’ opened on de server (192.168.150.90) system, rader than de client. See de discussion about de format of de PORT command above, in de Active FTP Example section.
testbox1: {/home/p-t/slacker/public_html} % ftp -d testbox2
Connected to testbox2.slacksite.com.
220 testbox2.slacksite.com FTP server ready.
Name (testbox2:slacker): slacker
—> USER slacker
331 Password required for slacker.
Password: TmpPass
—> PASS XXXX
230 User slacker logged in.
—> SYST
215 UNIX Type: L8
Remote system type is UNIX.
Usin’ binary mode to transfer files.
ftp> passive
Passive mode on.
ftp> ls
ftp: setsockopt (ignored): Permission denied
—> PASV
227 Enterin’ Passive Mode (192,168,150,90,195,149).
—> LIST
150 Openin’ ASCII mode data connection for file list
drwx—— 3 slacker users 104 Jul 27 01:45 public_html
226 Transfer complete.
ftp> quit
—> QUIT
221 Goodbye.
Summary
The followin’ chart should help admins remember how each FTP mode works:
Active FTP :
command : client >1024 -> server 21
data : client >1024 <- server 20
Passive FTP :
command : client >1024 -> server 21
data : client >1024 -> server >1024
A quick summary of de pros and cons of active vs. passive FTP is also in order:
Active FTP is beneficial to de FTP server admin, but detrimental to de client side admin. The FTP server attempts to make connections to random high ports on de client, which would almost certainly be blocked by a firewall on de client side. Passive FTP is beneficial to de client, but detrimental to de FTP server admin. The client will make both connections to de server, but one of them will be to a random high port, which would almost certainly be blocked by a firewall on de server side.
Luckily, dere is somewhat of a compromise. Since admins runnin’ FTP servers will need to make deir servers accessible to de greatest number of clients, dey will almost certainly need to support passive FTP. The exposure of high level ports on de server can be minimized by specifyin’ a limited port range for de FTP server to use. Thus, everythin’ except for this range of ports can be firewalled on de server side. While this doesn’t eliminate all risk to de server, it decreases it tremendously.