1.\" $OpenBSD: ftp-proxy.8,v 1.18 2011/05/16 16:38:51 jmc Exp $ 2.\" 3.\" Copyright (c) 2004, 2005 Camiel Dobbelaar, <cd@sentia.nl> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd $Mdocdate: May 16 2011 $ 18.Dt FTP-PROXY 8 19.Os 20.Sh NAME 21.Nm ftp-proxy 22.Nd Internet File Transfer Protocol proxy daemon 23.Sh SYNOPSIS 24.Nm 25.Bk -words 26.Op Fl 6Adrv 27.Op Fl a Ar address 28.Op Fl b Ar address 29.Op Fl D Ar level 30.Op Fl m Ar maxsessions 31.Op Fl P Ar port 32.Op Fl p Ar port 33.Op Fl q Ar queue 34.Op Fl R Ar address 35.Op Fl T Ar tag 36.Op Fl t Ar timeout 37.Ek 38.Sh DESCRIPTION 39.Nm 40is a proxy for the Internet File Transfer Protocol. 41FTP control connections should be redirected into the proxy using the 42.Xr pf 4 43.Ar divert-to 44command, after which the proxy connects to the server on behalf of 45the client. 46.Pp 47The proxy allows data connections to pass, rewriting and redirecting 48them so that the right addresses are used. 49All connections from the client to the server have their source 50address rewritten so they appear to come from the proxy. 51Consequently, all connections from the server to the proxy have 52their destination address rewritten, so they are redirected to the 53client. 54The proxy uses the 55.Xr pf 4 56.Ar anchor 57facility for this. 58.Pp 59Assuming the FTP control connection is from $client to $server, the 60proxy connected to the server using the $proxy source address, and 61$port is negotiated, then 62.Nm 63adds the following rules to the anchor. 64$server and $orig_server are the same unless 65.Fl R 66is used to force a different $server address for all connections. 67(These example rules use inet, but the proxy also supports inet6.) 68.Pp 69In case of active mode (PORT or EPRT): 70.Bd -literal -offset 2n 71pass in from $server to $proxy port $proxy_port \e 72 rdr-to $client port $port 73pass out from $server to $client port $port \e 74 nat-to $orig_server port $natport 75.Ed 76.Pp 77In case of passive mode (PASV or EPSV): 78.Bd -literal -offset 2n 79pass in from $client to $orig_server port $proxy_port \e 80 rdr-to $server port $port 81pass out from $client to $server port $port nat-to $proxy 82.Ed 83.Pp 84The options are as follows: 85.Bl -tag -width Ds 86.It Fl 6 87IPv6 mode. 88The proxy will expect and use IPv6 addresses for all communication. 89Only the extended FTP modes EPSV and EPRT are allowed with IPv6. 90The proxy is in IPv4 mode by default. 91.It Fl A 92Only permit anonymous FTP connections. 93Either user "ftp" or user "anonymous" is allowed. 94.It Fl a Ar address 95The proxy will use this as the source address for the control 96connection to a server. 97.It Fl b Ar address 98Address where the proxy will listen for redirected control connections. 99The default is 127.0.0.1, or ::1 in IPv6 mode. 100.It Fl D Ar level 101Debug level, ranging from 0 to 7. 102Higher is more verbose. 103The default is 5. 104(These levels correspond to the 105.Xr syslog 3 106levels.) 107.It Fl d 108Do not daemonize. 109The process will stay in the foreground, logging to standard error. 110.It Fl m Ar maxsessions 111Maximum number of concurrent FTP sessions. 112When the proxy reaches this limit, new connections are denied. 113The default is 100 sessions. 114The limit can be lowered to a minimum of 1, or raised to a maximum of 500. 115.It Fl P Ar port 116Fixed server port. 117Only used in combination with 118.Fl R . 119The default is port 21. 120.It Fl p Ar port 121Port where the proxy will listen for redirected connections. 122The default is port 8021. 123.It Fl q Ar queue 124Create rules with queue 125.Ar queue 126appended, so that data connections can be queued. 127.It Fl R Ar address 128Fixed server address, also known as reverse mode. 129The proxy will always connect to the same server, regardless of 130where the client wanted to connect to (before it was redirected). 131Use this option to proxy for a server behind NAT, or to forward all 132connections to another proxy. 133.It Fl r 134Rewrite sourceport to 20 in active mode to suit ancient clients that insist 135on this RFC property. 136.It Fl T Ar tag 137The filter rules will add tag 138.Ar tag 139to data connections, and will use match rules instead of pass ones. 140This way alternative rules that use the 141.Ar tagged 142keyword can be implemented following the 143.Nm 144anchor. 145These rules can use special 146.Xr pf 4 147features like route-to, reply-to, label, rtable, overload, etc. that 148.Nm 149does not implement itself. 150There must be a matching pass rule after the 151.Nm 152anchor or the data connections will be blocked. 153.It Fl t Ar timeout 154Number of seconds that the control connection can be idle, before the 155proxy will disconnect. 156The maximum is 86400 seconds, which is also the default. 157Do not set this too low, because the control connection is usually 158idle when large data transfers are taking place. 159.It Fl v 160Set the 'log' flag on pf rules committed by 161.Nm . 162Use twice to set the 'log-all' flag. 163The pf rules do not log by default. 164.El 165.Sh CONFIGURATION 166To make use of the proxy, 167.Xr pf.conf 5 168needs the following rules. 169Adjust the rules as needed; depending on the rest of the ruleset, the 170last rule explicitly allowing FTP sessions from the proxy may not be 171necessary. 172.Bd -literal -offset 2n 173anchor "ftp-proxy/*" 174pass in quick inet proto tcp to port ftp divert-to 127.0.0.1 port 8021 175pass out inet proto tcp from (self) to any port ftp 176.Ed 177.Sh SEE ALSO 178.Xr ftp 1 , 179.Xr pf 4 , 180.Xr pf.conf 5 181.Sh CAVEATS 182.Xr pf 4 183does not allow the ruleset to be modified if the system is running at a 184.Xr securelevel 7 185higher than 1. 186At that level 187.Nm 188cannot add rules to the anchors and FTP data connections may get blocked. 189.Pp 190Negotiated data connection ports below 1024 are not allowed. 191.Pp 192The negotiated IP address for active modes is ignored for security 193reasons. 194This makes third party file transfers impossible. 195.Pp 196.Nm 197chroots to "/var/empty" and changes to user "proxy" to drop privileges. 198