Firewall settings for passive FTP. Lokkit / IPTables / RH 9

You need the ipconntrackftp module and possibly the natconntrackftp module. I'm not sure about the exact names, but the components are conntrack and ftp.

Basically, FTP is a complicated protocol in the sense that it has two connections, one control and one data. And you need special logic to keep track of this and handle it, this is where the connection tracking modules come into play. Load them up and everything will work.

> You need the ipconntrackftp module and possibly the natconntrackftp module.
Thanks. Since I hadn't had a reply here, I posted the same thing to a newsgroup yesterday and someone said to just open all ports above 1023. I've done that and it seems to work. I don't know if there is a more secure way of doing it.

I'm a bit out of my depth when it comes to modules. I notice /proc/net/ip_conntrack exists so I guess I must have that module.

Ross

Opening all ports above 1023 is the simple and insecure way to do it. It's not exactly equivalent to having no firewall but it's very close.

Connection tracking (and thus /proc/net/ip_conntrack) is on if you have a rule with state checks, the most common is a rule to check for ESTABLISHED and RELATED states (do iptables -nvL to see if you have such a rule).

Run: modprobe ipconntrackftp

to load the FTP connection tracking module. And remove the rule to open all ports above 1023, this should make the firewall allow FTP connections and still keep you safe most of the time.

You may also want: modprobe ipconntrackirc

to enable IRC connections for DCC chats and file transfers.

Thanks again but modprobe ipconntrackftp returns:

modprobe: Can't open dependencies file /lib/modules/2.4.23-linode16-6um/modules.dep (No such file or directory)

Isn't that because were can't load our own modules with Linode? I don't have any ESTABLISHED and RELATED rules.

Since the Linode is just a single (virtual) machine and I control what's listening and what's not then I wonder how important the firewall really is anyway.

Ross

You can also try: insmod ipconntrackftp

You might need to change into the modules directory, try: locate ipconntrackftp

It is likely to be in: /lib/modules/2.4.23-linode16-6um/kernel/net/ipv4/netfilter/

I have no idea regarding the problem above, maybe running: depmod -a

will cure it. I don't have a linode to test it. (I do consider getting one once my current contract is finished - paid for a year in advance).

If you don't have an ESTABLISHED,RELATED rule, then connection tracking is not likely to work for you anyway.

If you have an iron grip on what is running and you made sure that all services you don't want accessed from outside are locked down. Then you don't need a firewall. You can see what services are listening with: netstat -tul

A search for 'modprobe' on these forums shows that loadable modules is one of the very few things that can't be done with a Linode so therefore that dependency file missing is normal. If modules were allowed then it would allow anyone to effectively run arbitary code on the host o/s and create a big security problem.

I don't know enough to tell if ipconntrackftp is compiled in and therefore doesn't need to be loaded or even if that is a meaningful question to ask.

Anyway, it doesn't look like I have much of a security issue even without a firewall.

Ross