1.\" $OpenBSD: ftp-proxy.8,v 1.40 2004/03/16 08:50:07 jmc Exp $ 2.\" 3.\" Copyright (c) 1996-2001 4.\" Obtuse Systems Corporation, All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY OBTUSE SYSTEMS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL OBTUSE OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" $FreeBSD$ 31.\" 32.Dd August 17, 2001 33.Dt FTP-PROXY 8 34.Os 35.Sh NAME 36.Nm ftp-proxy 37.Nd Internet File Transfer Protocol proxy server 38.Sh SYNOPSIS 39.Nm ftp-proxy 40.Op Fl AnrVw 41.Op Fl a Ar address 42.Op Fl D Ar debuglevel 43.Op Fl g Ar group 44.Op Fl M Ar maxport 45.Op Fl m Ar minport 46.Op Fl t Ar timeout 47.Op Fl u Ar user 48.Sh DESCRIPTION 49.Nm 50is a proxy for the Internet File Transfer Protocol. 51The proxy uses 52.Xr pf 4 53and expects to have the FTP control connection as described in 54.Xr services 5 55redirected to it via a 56.Xr pf 4 57.Em rdr 58command. 59An example of how to do that is further down in this document. 60.Pp 61The options are as follows: 62.Bl -tag -width Ds 63.It Fl A 64Permit only anonymous FTP connections. 65The proxy will allow connections to log in to other sites as the user 66.Qq ftp 67or 68.Qq anonymous 69only. 70Any attempt to log in as another user will be blocked by the proxy. 71.It Fl a Ar address 72Specify the local IP address to use in 73.Xr bind 2 74as the source for connections made by 75.Nm ftp-proxy 76when connecting to destination FTP servers. 77This may be necessary if the interface address of 78your default route is not reachable from the destinations 79.Nm 80is attempting connections to, or this address is different from the one 81connections are being NATed to. 82In the usual case this means that 83.Ar address 84should be a publicly visible IP address assigned to one of 85the interfaces on the machine running 86.Nm 87and should be the same address to which you are translating traffic 88if you are using the 89.Fl n 90option. 91.It Fl D Ar debuglevel 92Specify a debug level, where the proxy emits verbose debug output 93into 94.Xr syslogd 8 95at level 96.Dv LOG_DEBUG . 97Meaningful values of debuglevel are 0-3, where 0 is no debug output and 983 is lots of debug output, the default being 0. 99.It Fl g Ar group 100Specify the named group to drop group privileges to, after doing 101.Xr pf 4 102lookups which require root. 103By default, 104.Nm 105uses the default group of the user it drops privilege to. 106.It Fl M Ar maxport 107Specify the upper end of the port range the proxy will use for the 108data connections it establishes. 109The default is 110.Dv IPPORT_HILASTAUTO 111defined in 112.Aq Pa netinet/in.h 113as 65535. 114.It Fl m Ar minport 115Specify the lower end of the port range the proxy will use for all 116data connections it establishes. 117The default is 118.Dv IPPORT_HIFIRSTAUTO 119defined in 120.Aq Pa netinet/in.h 121as 49152. 122.It Fl n 123Activate network address translation 124.Pq NAT 125mode. 126In this mode, the proxy will not attempt to proxy passive mode 127.Pq PASV or EPSV 128data connections. 129In order for this to work, the machine running the proxy will need to 130be forwarding packets and doing network address translation to allow 131the outbound passive connections from the client to reach the server. 132See 133.Xr pf.conf 5 134for more details on NAT. 135The proxy only ignores passive mode data connections when using this flag; 136it will still proxy PORT and EPRT mode data connections. 137Without this flag, 138.Nm 139does not require any IP forwarding or NAT beyond the 140.Em rdr 141necessary to capture the FTP control connection. 142.It Fl r 143Use reverse host 144.Pq reverse DNS 145lookups for logging and libwrap use. 146By default, 147the proxy does not look up hostnames for libwrap or logging purposes. 148.It Fl t Ar timeout 149Specifies a timeout, in seconds. 150The proxy will exit and close open connections if it sees no data 151for the duration of the timeout. 152The default is 0, which means the proxy will not time out. 153.It Fl u Ar user 154Specify the named user to drop privilege to, after doing 155.Xr pf 4 156lookups which require root privilege. 157By default, 158.Nm 159drops privilege to the user 160.Em proxy . 161.Pp 162Running as root means that the source of data connections the proxy makes 163for PORT and EPRT will be the RFC mandated port 20. 164When running as a non-root user, the source of the data connections from 165.Nm 166will be chosen randomly from the range 167.Ar minport 168to 169.Ar maxport 170as described above. 171.It Fl V 172Be verbose. 173With this option the proxy logs the control commands 174sent by clients and the replies sent by the servers to 175.Xr syslogd 8 . 176.It Fl w 177Use the tcp wrapper access control library 178.Xr hosts_access 3 , 179allowing connections to be allowed or denied based on the tcp wrapper's 180.Xr hosts.allow 5 181and 182.Xr hosts.deny 5 183files. 184The proxy does libwrap operations after determining the destination 185of the captured control connection, so that tcp wrapper rules may 186be written based on the destination as well as the source of FTP connections. 187.El 188.Pp 189.Nm ftp-proxy 190is run from 191.Xr inetd 8 192and requires that FTP connections are redirected to it using a 193.Em rdr 194rule. 195A typical way to do this would be to use a 196.Xr pf.conf 5 197rule such as 198.Bd -literal -offset 2n 199int_if = \&"xl0\&" 200rdr pass on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021 201.Ed 202.Pp 203.Xr inetd 8 204must then be configured to run 205.Nm 206on the port from above using 207.Bd -literal -offset 2n 208ftp-proxy stream tcp nowait root /usr/libexec/ftp-proxy ftp-proxy 209.Ed 210.Pp 211in 212.Xr inetd.conf 5 . 213.Pp 214.Nm 215accepts the redirected control connections and forwards them 216to the server. 217The proxy replaces the address and port number that the client 218sends through the control connection to the server with its own 219address and proxy port, where it listens for the data connection. 220When the server opens the data connection back to this port, the 221proxy forwards it to the client. 222The 223.Xr pf.conf 5 224rules need to let pass connections to these proxy ports 225(see options 226.Fl u , m , 227and 228.Fl M 229above) in on the external interface. 230The following example allows only ports 49152 to 65535 to pass in 231statefully: 232.Bd -literal -offset indent 233block in on $ext_if proto tcp all 234pass in on $ext_if inet proto tcp from any to $ext_if \e 235 port > 49151 keep state 236.Ed 237.Pp 238Alternatively, rules can make use of the fact that by default, 239.Nm 240runs as user 241.Qq proxy 242to allow the backchannel connections, as in the following example: 243.Bd -literal -offset indent 244block in on $ext_if proto tcp all 245pass in on $ext_if inet proto tcp from any to $ext_if \e 246 user proxy keep state 247.Ed 248.Pp 249These examples do not cover the connections from the proxy to the 250foreign FTP server. 251If one does not pass outgoing connections by default additional rules 252are needed. 253.Sh SEE ALSO 254.Xr ftp 1 , 255.Xr pf 4 , 256.Xr hosts.allow 5 , 257.Xr hosts.deny 5 , 258.Xr inetd.conf 5 , 259.Xr pf.conf 5 , 260.Xr inetd 8 , 261.Xr pfctl 8 , 262.Xr syslogd 8 263.Sh BUGS 264Extended Passive mode 265.Pq EPSV 266is not supported by the proxy and will not work unless the proxy is run 267in network address translation mode. 268When not in network address translation mode, the proxy returns an error 269to the client, hopefully forcing the client to revert to passive mode 270.Pq PASV 271which is supported. 272EPSV will work in network address translation mode, assuming a 273.Xr pf.conf 5 274setup which allows the EPSV connections through to their destinations. 275.Pp 276IPv6 is not yet supported. 277