[Xitami] Talking about FTP

[Chris Olson]

Frank Harrell wrote:
> 
> I use a Linksys cable router. Would this idea of ftp using various ports
> (if I read this message correctly) be a likely reason that I can (from
> the outside) connect to Xitami's ftp (running on an odd port, 384) but
> when my client requests a "list" I get no response? I do have the port
> 384 mapped. The system works fine and I get ftp lists when Xitami is
> running on it's normal ports (80, 21). I have to use an odd port due to
> cable blocking 80. Currently I am using a free generic ftp server to get
> around this. I like Xitami's though because it is so easy to setup
> usernames and passwords.

If you're using port 384, then also open port 383 and use passive
transfers.  This works with most RFC compliant FTP servers.  The Linksys
cable/DSL router, while a fine device for home networks, is a poor choice
for running port-forwarded servers on private IP addresses behind the
firewall.  The reason is because it's firewalling ruleset is too simple and
restrictive, and not dynamic enough to provide good security and still be
able to run a server.  I believe Linksys' solution was to offer limited
support for DMZ - you should refer to the documentation for your router on
how to set up the DMZ network, and put any servers on the DMZ, then place
workstations or other PC's on the firewalled network.

One other thing I don't like about the Linksys router is that whoever wrote
it's firewall ruleset used alot of DENY rules instead of REJECT, it's
default is to DENY ICMP packets, and it uses flashram, which is writeable
and/or configurable for a cracker.  They stand out like a sore thumb on a
half open syn or stealth portscan, and opening ports to servers behind the
firewall is basically the same as not running any firewall at all, as a good
cracker can tunnel a Linksys router in under 15 minutes if there's any ports
open.
-- 
Chris Olson
System Administrator
AST Communications     http://www.astcomm.net
Linux Support          http://linux.astcomm.net