|
Posted by BillD on August 20, 2008, 8:19 pm
If you were Registered and logged in, you could reply and use other advanced thread options
> wndavis wrote:
> > I am attempting to setup a file transfer with a bank using Robo-FTP wit=
h
> > ftp-ssl. =A0I am unable to connect to the bank.
>
> Are you running the ftp Server or the bank?
>
> > The bank says our
> > firewall has to be setup not to inspect FTP Packets (from them?) and
> > tcp/ip data port ranges 6540 - 6590 need to be open.
>
> A firewall must not be able to inspect the packets, if it can read the
> traffic, it will be a successful man-in-the-middle attacker. ;)
>
> PLease read:
>
> http://en.wikipedia.org/wiki/FTPS
>
> which describes the problem quite well. At least the bank seems to use a
> fixed port range and uses passive mode for the ftp-data connection.
>
> If the bank runs the ftp server you need to allow tcp connections to port
> 990 (ftps command) and to the port range they told you (passive mode, ftp=
-
> data).
> So you need rules looking somewhat like this:
>
> from =A0 =A0to =A0 =A0 =A0proto =A0 port =A0 =A0 =A0 =A0 =A0 =A0action
> -----------------------------------------------
> you =A0 =A0 bank =A0 =A0tcp =A0 =A0 990 =A0 =A0 =A0 =A0 =A0 =A0 allow (st=
ateful)
> you =A0 =A0 bank =A0 =A0tcp =A0 =A0 6540-6590 =A0 =A0 =A0 allow (stateful=
)
> you =A0 =A0 bank =A0 =A0all =A0 =A0 all =A0 =A0 =A0 =A0 =A0 =A0 reject
>
> Complete stateful handling of the data-connection will never work,
> because you have a ancrypted connection, so the firewall can't identify
> the destination port of the data-connection.
>
> > Our network
> > security folks are reluctant to create such a firewall rule or make any
> > firewall changes for that matter.
>
> Well, as long as the bank allows only passive mode I see not a very big
> problem.
>
> > I'm an applications programmer, not a security expert. =A0How difficult=
is
> > it to create such a rule and would it create a vulnerability that we
> > should resist?
>
> Well, it is tcp, therefore the direction of the connection is easy to
> determine. But as with standard ftp you two connections (ftp-command and
> ftp-data).
>
> Wolfgang
The bank has the secure server. Robo-FTP is a client that allows just
about any configuration to be used.
Passive mode is used here.
Thanks for the wikipedia link. When it came to the certificate I got
from Verisign, I had to use OpenSSL to create files with different
extensions to import/export.
| 
XML site map