FTP-Server in Jail with FreeBSD 10

B

bjoerns

Hello,

I spent 2 days reading different manuals, documentation and howto, but I'm not able to configure pf to forward active ftp transmissions to a ftpd() in a jail.
Yes, I now FTP is outdated, but I have to provide an FTP-upload possibility to get some files I need. And the other side seems to be restricted to active mode.

Here is my current configuration:
  • external interface 144.76.37.181 on re0
  • ftp server in jail 10.0.0.5 on lo1
  • ftp proxy on host 10.0.0.1 on lo1

Network and Jail specific lines in /etc/rc.config
Code: 
ifconfig_re0="inet 144.76.37.181 netmask 255.255.255.224"
gateway_enable="YES"
defaultrouter="144.76.37.161"

cloned_interfaces="lo1"
ifconfig_lo1="inet 10.0.0.1/32"
ifconfig_lo1_alias0="inet 10.0.0.2/32"
ifconfig_lo1_alias1="inet 10.0.0.3/32"
ifconfig_lo1_alias2="inet 10.0.0.4/32"
ifconfig_lo1_alias3="inet 10.0.0.5/32"

ftpproxy_enable="YES"
ftpproxy_flags="-b 10.0.0.1 -p 8021 -R 10.0.0.5 -P 21"

pf_enable="YES"
pf_rules="/etc/pf.conf"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"

ezjail_enable="YES"

Here my reduced /etc/pf.conf
Code: 
EXT_IF = "re0"
JAIL_NET = "lo1:network"

nat-anchor "ftp-proxy/*"
nat on $EXT_IF from $JAIL_NET to any -> $EXT_IF
rdr-anchor "ftp-proxy/*"
rdr pass on $EXT_IF proto tcp from any to $EXT_IF port 21 -> 10.0.0.1 port 8021

block all
set skip on lo0
set skip on lo1
anchor "ftp-proxy/*"

## I tried those (made no difference), but I thing ftp-proxy should take care of this:
# pass in on lo1 proto tcp from any to any port { 21, >1024 }
# pass out proto tcp from any to any port { 21, >1024 }

To debug what is going on I started ftpd() in the jail
Code: 
/usr/libexec/ftpd -Dlld
and the ftp-proxy() on the host from console:
Code: 
`--> sudo ftp-proxy -d -R 10.0.0.5 -b 10.0.0.1 -D7 -vv
using fixed server 10.0.0.5
listening on 10.0.0.1 port 8021
#1 accepted connection from 37.24.79.224
#1 FTP session 1/100 started: client 37.24.79.224 to server 10.0.0.5 via proxy 10.0.0.5 
#1 server: 220 otr FTP server (Version 6.00LS) ready.\r\n
#1 client: USER otrfiles\r\n
#1 server: 331 Password required for otrfiles.\r\n
#1 client: PASS xxxxxxxxx\r\n
#1 server: 230 User otrfiles logged in, access restrictions apply.\r\n
#1 client: SYST\r\n
#1 server: 215 UNIX Type: L8 Version: BSD-199506\r\n
#1 client: PASV\r\n
#1 server: 227 Entering Passive Mode (10,0,0,5,216,42)\r\n
#1 passive: client to server port 55338 via port 53353
#1 proxy: 227 Entering Passive Mode (144,76,37,181,208,105)\r\n
#1 client: LIST\r\n
#1 server: 150 Opening ASCII mode data connection for '/bin/ls'.\r\n
#1 server: 226 Transfer complete.\r\n
#1 client: PORT 37,24,79,224,145,237\r\n
#1 proxy: PORT 10,0,0,5,248,90\r\n
#1 active: server to client port 37357 via port 63578
#1 server: 200 PORT command successful.\r\n
#1 client: LIST\r\n
#1 server: 425 Can't build data connection: Connection refused.\r\n

Here is the output of cat /var/log/debug.log from the jail:
Code: 
May 18 10:13:06 otr ftpd[11108]: <--- 220 
May 18 10:13:06 otr ftpd[11108]: otr FTP server (Version 6.00LS) ready.
May 18 10:13:06 otr ftpd[11108]: command: USER otrfiles
May 18 10:13:06 otr ftpd[11108]: <--- 331 
May 18 10:13:06 otr ftpd[11108]: Password required for otrfiles.
May 18 10:13:06 otr ftpd[11108]: command: PASS  ???
May 18 10:13:06 otr ftpd[11108]: <--- 230 
May 18 10:13:06 otr ftpd[11108]: User otrfiles logged in, access restrictions apply.
May 18 10:13:06 otr ftpd[11108]: command: SYST
May 18 10:13:06 otr ftpd[11108]: <--- 215 
May 18 10:13:06 otr ftpd[11108]: UNIX Type: L8 Version: BSD-199506
May 18 10:13:12 otr ftpd[11108]: command: PASV
May 18 10:13:12 otr ftpd[11108]: <--- 227 
May 18 10:13:12 otr ftpd[11108]: Entering Passive Mode (10,0,0,5,216,42)
May 18 10:13:12 otr ftpd[11108]: command: LIST
May 18 10:13:12 otr ftpd[11108]: <--- 150 
May 18 10:13:12 otr ftpd[11108]: Opening ASCII mode data connection for '/bin/ls'.
May 18 10:13:12 otr ftpd[11108]: <--- 226 
May 18 10:13:12 otr ftpd[11108]: Transfer complete.
May 18 10:13:16 otr ftpd[11108]: command: PORT 10,0,0,5,248,90
May 18 10:13:16 otr ftpd[11108]: <--- 200 
May 18 10:13:16 otr ftpd[11108]: PORT command successful.
May 18 10:13:16 otr ftpd[11108]: command: LIST
May 18 10:13:16 otr ftpd[11108]: <--- 425 
May 18 10:13:16 otr ftpd[11108]: Can't build data connection: Connection refused.
May 18 10:13:19 otr ftpd[11108]: command: QUIT
May 18 10:13:19 otr ftpd[11108]: <--- 221 
May 18 10:13:19 otr ftpd[11108]: Goodbye.

As you can see, passive transfer is working, but I can not make active mode work. :\

Here are a few more details from pfctl():
Code: 
`--> sudo pfctl -vv -s nat                    
No ALTQ support in kernel
ALTQ related functions disabled
@0 nat-anchor "ftp-proxy/*" all
  [ Evaluations: 29        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 10748 State Creations: 0     ]
@1 nat on re0 inet from 10.0.0.0/24 to any -> 144.76.37.181
  [ Evaluations: 29        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 10748 State Creations: 0     ]
@2 nat on re0 inet from 10.0.0.2 to any -> 144.76.37.181
  [ Evaluations: 23        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 10748 State Creations: 0     ]
@3 nat on re0 inet from 10.0.0.3 to any -> 144.76.37.181
  [ Evaluations: 23        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 10748 State Creations: 0     ]
@4 nat on re0 inet from 10.0.0.4 to any -> 144.76.37.181
  [ Evaluations: 23        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 10748 State Creations: 0     ]
@5 nat on re0 inet from 10.0.0.5 to any -> 144.76.37.181
  [ Evaluations: 23        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 10748 State Creations: 0     ]
@0 rdr-anchor "ftp-proxy/*" all
  [ Evaluations: 2         Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 10748 State Creations: 0     ]
@1 rdr pass on re0 inet proto tcp from any to 144.76.37.181 port = ftp -> 10.0.0.1 port 8021
  [ Evaluations: 1         Packets: 27        Bytes: 1896        States: 1     ]
  [ Inserted: uid 0 pid 10748 State Creations: 1     ]

`--> sudo pfctl -vv -s rules
No ALTQ support in kernel
ALTQ related functions disabled
@0 block drop all
  [ Evaluations: 35        Packets: 34        Bytes: 2530        States: 0     ]
  [ Inserted: uid 0 pid 10748 State Creations: 0     ]
@1 anchor "ftp-proxy/*" all
  [ Evaluations: 35        Packets: 10        Bytes: 2933        States: 0     ]
  [ Inserted: uid 0 pid 10748 State Creations: 1     ]
@2 pass in on re0 proto tcp from any to any port = cvspserver flags S/SA keep state
  [ Evaluations: 34        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 0 pid 10748 State Creations: 0     ]


`--> sudo pfctl -vv -s Anchors                    
No ALTQ support in kernel
ALTQ related functions disabled
  ftp-proxy
  ftp-proxy/10761.1


`--> sudo pfctl -vv -a ftp-proxy/10761.1 -s rules
No ALTQ support in kernel
ALTQ related functions disabled
@0 pass in log (all) quick inet proto tcp from 10.0.0.5 to 37.24.79.224 port = 37357 flags S/SA keep state (max 1) rtable 0
  [ Evaluations: 31        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 62 pid 10761 State Creations: 0     ]
@1 pass out log (all) quick inet proto tcp from 144.76.37.181 to 37.24.79.224 port = 37357 flags S/SA keep state (max 1) rtable 0
  [ Evaluations: 31        Packets: 0         Bytes: 0           States: 0     ]
  [ Inserted: uid 62 pid 10761 State Creations: 0     ]

Is ftp-proxy() the right way to redirect the FTP traffic to the jail? What am I doing wrong? I am a bit frustrated :q

Best regards,
Björn
 
Sorry, if my last post was too long or had too many details. I am sure that something is missing. Can someone push me in the right direction on how to debug and investigate the problem?
 
You must log in or register to reply here.
Back
Top