1.\" $NetBSD: ftp-proxy.8,v 1.6 2019/09/21 19:48:15 sevan Exp $ 2.\" $OpenBSD: ftp-proxy.8,v 1.10 2007/08/01 15:45:41 jmc Exp $ 3.\" 4.\" Copyright (c) 2004, 2005 Camiel Dobbelaar, <cd@sentia.nl> 5.\" 6.\" Permission to use, copy, modify, and distribute this software for any 7.\" purpose with or without fee is hereby granted, provided that the above 8.\" copyright notice and this permission notice appear in all copies. 9.\" 10.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17.\" 18.Dd September 21, 2019 19.Dt FTP-PROXY 8 20.Os 21.Sh NAME 22.Nm ftp-proxy 23.Nd Internet File Transfer Protocol proxy daemon 24.Sh SYNOPSIS 25.Nm ftp-proxy 26.Bk -words 27.Op Fl 6Adrv 28.Op Fl a Ar address 29.Op Fl b Ar address 30.Op Fl D Ar level 31.Op Fl i Ar netif 32.Op Fl m Ar maxsessions 33.Op Fl P Ar port 34.Op Fl p Ar port 35.Op Fl q Ar queue 36.Op Fl R Ar address 37.Op Fl T Ar tag 38.Op Fl t Ar timeout 39.Ek 40.Sh DESCRIPTION 41.Nm 42is a proxy for the Internet File Transfer Protocol. 43FTP control connections should be redirected into the proxy using the 44.Xr ipnat 4 45or 46.Xr pf 4 47.Ar rdr 48command, after which the proxy connects to the server on behalf of 49the client. 50.Pp 51The proxy allows data connections to pass, rewriting and redirecting 52them so that the right addresses are used. 53All connections from the client to the server have their source 54address rewritten so they appear to come from the proxy. 55Consequently, all connections from the server to the proxy have 56their destination address rewritten, so they are redirected to the 57client. 58The proxy uses the 59.Xr pf 4 60.Ar anchor 61facility for this, unless the option 62.Fl i 63is specified, it will then use the 64.Xr ipnat 4 65interface. 66.Pp 67Assuming the FTP control connection is from $client to $server, the 68proxy connected to the server using the $proxy source address, and 69$port is negotiated, then 70.Nm ftp-proxy 71adds the following rules to the various anchors. 72(These example rules use inet, but the proxy also supports inet6.) 73.Pp 74In case of active mode (PORT or EPRT): 75.Bd -literal -offset 2n 76rdr from $server to $proxy port $port -\*[Gt] $client 77pass quick inet proto tcp \e 78 from $server to $client port $port 79.Ed 80.Pp 81In case of passive mode (PASV or EPSV): 82.Bd -literal -offset 2n 83nat from $client to $server port $port -\*[Gt] $proxy 84pass in quick inet proto tcp \e 85 from $client to $server port $port 86pass out quick inet proto tcp \e 87 from $proxy to $server port $port 88.Ed 89.Pp 90The options are as follows: 91.Bl -tag -width Ds 92.It Fl 6 93IPv6 mode. 94The proxy will expect and use IPv6 addresses for all communication. 95Only the extended FTP modes EPSV and EPRT are allowed with IPv6. 96The proxy is in IPv4 mode by default. 97.It Fl A 98Only permit anonymous FTP connections. 99Either user "ftp" or user "anonymous" is allowed. 100.It Fl a Ar address 101The proxy will use this as the source address for the control 102connection to a server. 103.It Fl b Ar address 104Address where the proxy will listen for redirected control connections. 105The default is 127.0.0.1, or ::1 in IPv6 mode. 106.It Fl D Ar level 107Debug level, ranging from 0 to 7. 108Higher is more verbose. 109The default is 5. 110(These levels correspond to the 111.Xr syslog 3 112levels.) 113.It Fl d 114Do not daemonize. 115The process will stay in the foreground, logging to standard error. 116.It Fl i Ar netif 117Set 118.Nm ftp-proxy 119for use with IP-Filter. 120The argument 121.Ar netif 122should be set to the name of the network interface where rdr is applied on. 123.It Fl m Ar maxsessions 124Maximum number of concurrent FTP sessions. 125When the proxy reaches this limit, new connections are denied. 126The default is 100 sessions. 127The limit can be lowered to a minimum of 1, or raised to a maximum of 500. 128.It Fl P Ar port 129Fixed server port. 130Only used in combination with 131.Fl R . 132The default is port 21. 133.It Fl p Ar port 134Port where the proxy will listen for redirected connections. 135The default is port 8021. 136.It Fl q Ar queue 137Create rules with queue 138.Ar queue 139appended, so that data connections can be queued. 140.It Fl R Ar address 141Fixed server address, also known as reverse mode. 142The proxy will always connect to the same server, regardless of 143where the client wanted to connect to (before it was redirected). 144Use this option to proxy for a server behind NAT, or to forward all 145connections to another proxy. 146.It Fl r 147Rewrite sourceport to 20 in active mode to suit ancient clients that insist 148on this RFC property. 149.It Fl T Ar tag 150Automatically tag packets passing through the 151.Xr pf 4 152rule with the name supplied. 153.It Fl t Ar timeout 154Number of seconds that the control connection can be idle, before the 155proxy will disconnect. 156The maximum is 86400 seconds, which is also the default. 157Do not set this too low, because the control connection is usually 158idle when large data transfers are taking place. 159.It Fl v 160Set the 'log' flag on pf rules committed by 161.Nm . 162Use twice to set the 'log-all' flag. 163The pf rules do not log by default. 164.El 165.Sh CONFIGURATION 166To make use of the proxy using 167.Xr pf 4 , 168.Xr pf.conf 5 169needs the following rules. 170All anchors are mandatory. 171Adjust the rules as needed. 172.Pp 173In the NAT section: 174.Bd -literal -offset 2n 175nat-anchor "ftp-proxy/*" 176rdr-anchor "ftp-proxy/*" 177rdr pass on $int_if proto tcp from $lan to any port 21 -\*[Gt] \e 178 127.0.0.1 port 8021 179.Ed 180.Pp 181In the rule section: 182.Bd -literal -offset 2n 183anchor "ftp-proxy/*" 184pass out proto tcp from $proxy to any port 21 185.Ed 186.Pp 187To make use of the proxy using 188.Xr ipnat 4 , 189.Xr ipnat.conf 5 190need the following rule: 191.Bd -literal -offset 2n 192rdr $int_if any port 21 -\*[Gt] 127.0.0.1 port 8021 tcp 193.Ed 194.Sh SEE ALSO 195.Xr ftp 1 , 196.Xr ipnat 4 , 197.Xr pf 4 , 198.Xr ipnat.conf 5 , 199.Xr pf.conf 5 200.Sh CAVEATS 201.Xr ipnat 4 202and 203.Xr pf 4 204do not allow the ruleset to be modified if the system is running at a 205securelevel higher than 1. 206At that level 207.Nm ftp-proxy 208cannot add rules to the anchors and FTP data connections may get blocked. 209.Pp 210Negotiated data connection ports below 1024 are not allowed. 211.Pp 212The negotiated IP address for active modes is ignored for security 213reasons. 214This makes third party file transfers impossible. 215.Pp 216.Nm ftp-proxy 217chroots to "/var/chroot/ftp-proxy" and changes to user "_proxy" to 218drop privileges. 219