1.\" $OpenBSD: ftp-proxy.8,v 1.37 2003/09/05 12:27:47 jmc Exp $ 2.\" 3.\" Copyright (c) 1996-2001 4.\" Obtuse Systems Corporation, All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY OBTUSE SYSTEMS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL OBTUSE OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.Dd August 17, 2001 31.Dt FTP-PROXY 8 32.Os 33.Sh NAME 34.Nm ftp-proxy 35.Nd Internet File Transfer Protocol proxy server 36.Sh SYNOPSIS 37.Nm ftp-proxy 38.Op Fl AnrVw 39.Op Fl D Ar debuglevel 40.Op Fl g Ar group 41.Op Fl m Ar minport 42.Op Fl M Ar maxport 43.Op Fl t Ar timeout 44.Op Fl u Ar user 45.Sh DESCRIPTION 46.Nm 47is a proxy for the Internet File Transfer Protocol. 48The proxy uses 49.Xr pf 4 50and expects to have the FTP control connection as described in 51.Xr services 5 52redirected to it via a 53.Xr pf 4 54.Em rdr 55command. 56An example of how to do that is further down in this document. 57.Pp 58The options are as follows: 59.Bl -tag -width Ds 60.It Fl A 61Permit only anonymous FTP connections. 62The proxy will allow connections to log in to other sites as the user 63.Qq ftp 64or 65.Qq anonymous 66only. 67Any attempt to log in as another user will be blocked by the proxy. 68.It Fl D Ar debuglevel 69Specify a debug level, where the proxy emits verbose debug output 70into 71.Xr syslogd 8 72at level 73.Dv LOG_DEBUG . 74Meaningful values of debuglevel are 0-3, where 0 is no debug output and 753 is lots of debug output, the default being 0. 76.It Fl g Ar group 77Specify the named group to drop group privileges to, after doing 78.Xr pf 4 79lookups which require root. 80By default, 81.Nm 82uses the default group of the user it drops privilege to. 83.It Fl m Ar minport 84Specify the lower end of the port range the proxy will use for all 85data connections it establishes. 86The default is 87.Dv IPPORT_HIFIRSTAUTO 88defined in 89.Aq Pa netinet/in.h 90as 49152. 91.It Fl M Ar maxport 92Specify the upper end of the port range the proxy will use for the 93data connections it establishes. 94The default is 95.Dv IPPORT_HILASTAUTO 96defined in 97.Aq Pa netinet/in.h 98as 65535. 99.It Fl n 100Activate network address translation 101.Pq NAT 102mode. 103In this mode, the proxy will not attempt to proxy passive mode 104.Pq PASV or EPSV 105data connections. 106In order for this to work, the machine running the proxy will need to 107be forwarding packets and doing network address translation to allow 108the outbound passive connections from the client to reach the server. 109See 110.Xr pf.conf 5 111for more details on NAT. 112The proxy only ignores passive mode data connections when using this flag; 113it will still proxy PORT and EPRT mode data connections. 114Without this flag, 115.Nm 116does not require any IP forwarding or NAT beyond the 117.Em rdr 118necessary to capture the FTP control connection. 119.It Fl r 120Use reverse host 121.Pq reverse DNS 122lookups for logging and libwrap use. 123By default, 124the proxy does not look up hostnames for libwrap or logging purposes. 125.It Fl t Ar timeout 126Specifies a timeout, in seconds. 127The proxy will exit and close open connections if it sees no data 128for the duration of the timeout. 129The default is 0, which means the proxy will not time out. 130.It Fl u Ar user 131Specify the named user to drop privilege to, after doing 132.Xr pf 4 133lookups which require root privilege. 134By default, 135.Nm 136drops privilege to the user 137.Em proxy . 138.Pp 139Running as root means that the source of data connections the proxy makes 140for PORT and EPRT will be the RFC mandated port 20. 141When running as a non-root user, the source of the data connections from 142.Nm 143will be chosen randomly from the range 144.Ar minport 145to 146.Ar maxport 147as described above. 148.It Fl V 149Be verbose. 150With this option the proxy logs the control commands 151sent by clients and the replies sent by the servers to 152.Xr syslogd 8 . 153.It Fl w 154Use the tcp wrapper access control library 155.Xr hosts_access 3 , 156allowing connections to be allowed or denied based on the tcp wrapper's 157.Xr hosts.allow 5 158and 159.Xr hosts.deny 5 160files. 161The proxy does libwrap operations after determining the destination 162of the captured control connection, so that tcp wrapper rules may 163be written based on the destination as well as the source of FTP connections. 164.El 165.Pp 166.Nm ftp-proxy 167is run from 168.Xr inetd 8 169and requires that FTP connections are redirected to it using a 170.Em rdr 171rule. 172A typical way to do this would be to use a 173.Xr pf.conf 5 174rule such as 175.Bd -literal -offset 2n 176int_if = xl0 177rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021 178.Ed 179.Pp 180.Xr inetd 8 181must then be configured to run 182.Nm 183on the port from above using 184.Bd -literal -offset 2n 185127.0.0.1:8021 stream tcp nowait root /usr/libexec/ftp-proxy ftp-proxy 186.Ed 187.Pp 188in 189.Xr inetd.conf 5 . 190.Pp 191.Nm 192accepts the redirected control connections and forwards them 193to the server. 194The proxy replaces the address and port number that the client 195sends through the control connection to the server with its own 196address and proxy port, where it listens for the data connection. 197When the server opens the data connection back to this port, the 198proxy forwards it to the client. 199The 200.Xr pf.conf 5 201rules need to let pass connections to these proxy ports 202(see options 203.Fl u , m , 204and 205.Fl M 206above) in on the external interface. 207The following example allows only ports 49152 to 65535 to pass in 208statefully: 209.Bd -literal -offset indent 210block in on $ext_if proto tcp all 211pass in on $ext_if inet proto tcp from any to $ext_if \e 212 port > 49151 keep state 213.Ed 214.Pp 215Alternatively, rules can make use of the fact that by default, 216.Nm 217runs as user 218.Qq proxy 219to allow the backchannel connections, as in the following example: 220.Bd -literal -offset indent 221block in on $ext_if proto tcp all 222pass in on $ext_if inet proto tcp from any to $ext_if \e 223 user proxy keep state 224.Ed 225.Pp 226These examples do not cover the connections from the proxy to the 227foreign FTP server. 228If one does not pass outgoing connections by default additional rules 229are needed. 230.Sh SEE ALSO 231.Xr ftp 1 , 232.Xr pf 4 , 233.Xr hosts.allow 5 , 234.Xr hosts.deny 5 , 235.Xr inetd.conf 5 , 236.Xr pf.conf 5 , 237.Xr inetd 8 , 238.Xr pfctl 8 , 239.Xr syslogd 8 240.Sh BUGS 241Extended Passive mode 242.Pq EPSV 243is not supported by the proxy and will not work unless the proxy is run 244in network address translation mode. 245When not in network address translation mode, the proxy returns an error 246to the client, hopefully forcing the client to revert to passive mode 247.Pq PASV 248which is supported. 249EPSV will work in network address translation mode, assuming a 250.Xr pf.conf 5 251setup which allows the EPSV connections through to their destinations. 252.Pp 253IPv6 is not yet supported. 254