1.\" $OpenBSD: ftp-proxy.8,v 1.7 2006/12/30 13:01:54 camield Exp $ 2.\" 3.\" Copyright (c) 2004, 2005 Camiel Dobbelaar, <cd@sentia.nl> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.\" $FreeBSD$ 18.\" 19.Dd November 28, 2004 20.Dt FTP-PROXY 8 21.Os 22.Sh NAME 23.Nm ftp-proxy 24.Nd Internet File Transfer Protocol proxy daemon 25.Sh SYNOPSIS 26.Nm ftp-proxy 27.Op Fl 6Adrv 28.Op Fl a Ar address 29.Op Fl b Ar address 30.Op Fl D Ar level 31.Op Fl m Ar maxsessions 32.Op Fl P Ar port 33.Op Fl p Ar port 34.Op Fl q Ar queue 35.Op Fl R Ar address 36.Op Fl t Ar timeout 37.Sh DESCRIPTION 38.Nm 39is a proxy for the Internet File Transfer Protocol. 40FTP control connections should be redirected into the proxy using the 41.Xr pf 4 42.Ar rdr 43command, after which the proxy connects to the server on behalf of 44the client. 45.Pp 46The proxy allows data connections to pass, rewriting and redirecting 47them so that the right addresses are used. 48All connections from the client to the server have their source 49address rewritten so they appear to come from the proxy. 50Consequently, all connections from the server to the proxy have 51their destination address rewritten, so they are redirected to the 52client. 53The proxy uses the 54.Xr pf 4 55.Ar anchor 56facility for this. 57.Pp 58Assuming the FTP control connection is from $client to $server, the 59proxy connected to the server using the $proxy source address, and 60$port is negotiated, then 61.Nm ftp-proxy 62adds the following rules to the various anchors. 63(These example rules use inet, but the proxy also supports inet6.) 64.Pp 65In case of active mode (PORT or EPRT): 66.Bd -literal -offset 2n 67rdr from $server to $proxy port $port -> $client 68pass quick inet proto tcp \e 69 from $server to $client port $port 70.Ed 71.Pp 72In case of passive mode (PASV or EPSV): 73.Bd -literal -offset 2n 74nat from $client to $server port $port -> $proxy 75pass in quick inet proto tcp \e 76 from $client to $server port $port 77pass out quick inet proto tcp \e 78 from $proxy to $server port $port 79.Ed 80.Pp 81The options are as follows: 82.Bl -tag -width Ds 83.It Fl 6 84IPv6 mode. 85The proxy will expect and use IPv6 addresses for all communication. 86Only the extended FTP modes EPSV and EPRT are allowed with IPv6. 87The proxy is in IPv4 mode by default. 88.It Fl A 89Only permit anonymous FTP connections. 90Either user "ftp" or user "anonymous" is allowed. 91.It Fl a Ar address 92The proxy will use this as the source address for the control 93connection to a server. 94.It Fl b Ar address 95Address where the proxy will listen for redirected control connections. 96The default is 127.0.0.1, or ::1 in IPv6 mode. 97.It Fl D Ar level 98Debug level, ranging from 0 to 7. 99Higher is more verbose. 100The default is 5. 101(These levels correspond to the 102.Xr syslog 3 103levels.) 104.It Fl d 105Do not daemonize. 106The process will stay in the foreground, logging to standard error. 107.It Fl m Ar maxsessions 108Maximum number of concurrent FTP sessions. 109When the proxy reaches this limit, new connections are denied. 110The default is 100 sessions. 111The limit can be lowered to a minimum of 1, or raised to a maximum of 500. 112.It Fl P Ar port 113Fixed server port. 114Only used in combination with 115.Fl R . 116The default is port 21. 117.It Fl p Ar port 118Port where the proxy will listen for redirected connections. 119The default is port 8021. 120.It Fl q Ar queue 121Create rules with queue 122.Ar queue 123appended, so that data connections can be queued. 124.It Fl R Ar address 125Fixed server address, also known as reverse mode. 126The proxy will always connect to the same server, regardless of 127where the client wanted to connect to (before it was redirected). 128Use this option to proxy for a server behind NAT, or to forward all 129connections to another proxy. 130.It Fl r 131Rewrite sourceport to 20 in active mode to suit ancient clients that insist 132on this RFC property. 133.It Fl t Ar timeout 134Number of seconds that the control connection can be idle, before the 135proxy will disconnect. 136The maximum is 86400 seconds, which is also the default. 137Do not set this too low, because the control connection is usually 138idle when large data transfers are taking place. 139.It Fl v 140Set the 'log' flag on pf rules committed by 141.Nm . 142Use twice to set the 'log-all' flag. 143The pf rules do not log by default. 144.El 145.Sh CONFIGURATION 146To make use of the proxy, 147.Xr pf.conf 5 148needs the following rules. 149All anchors are mandatory. 150Adjust the rules as needed. 151.Pp 152In the NAT section: 153.Bd -literal -offset 2n 154nat-anchor "ftp-proxy/*" 155rdr-anchor "ftp-proxy/*" 156rdr pass on $int_if proto tcp from $lan to any port 21 -> \e 157 127.0.0.1 port 8021 158.Ed 159.Pp 160In the rule section: 161.Bd -literal -offset 2n 162anchor "ftp-proxy/*" 163pass out proto tcp from $proxy to any port 21 164.Ed 165.Sh SEE ALSO 166.Xr ftp 1 , 167.Xr pf 4 , 168.Xr pf.conf 5 169.Sh CAVEATS 170.Xr pf 4 171does not allow the ruleset to be modified if the system is running at a 172.Xr securelevel 7 173higher than 1. 174At that level 175.Nm ftp-proxy 176cannot add rules to the anchors and FTP data connections may get blocked. 177.Pp 178Negotiated data connection ports below 1024 are not allowed. 179.Pp 180The negotiated IP address for active modes is ignored for security 181reasons. 182This makes third party file transfers impossible. 183.Pp 184.Nm ftp-proxy 185chroots to "/var/empty" and changes to user "proxy" to drop privileges. 186