Re: secure ftp with SSL

[Thomas Lussnig <lussnig@smcc.net>]

Rendy V wrote:

> Hi All,
> I have a strange problem, the problem is like this :
> I have an application that use secure ftp and for that reason I have 
> opened up the command port (990) with state NEW and allowed data port 
> (20000:20049) with state ESTABLISHED, RELATED on the firewall. It 
> fails when it try to use data port, for authentication it working just 
> fine. Please see the log on the below.
>
> If I open data port 2000:20049 with state NEW it working normally but 
> I don't want to make a big hole on my firewall. I suspect that the 
> iptables connection tracking cannot track the relation between command 
> port and data port because it is encrypted using SSL. Is it true or is 
> there something I miss here?? What should I do now??
>
The problem you have is that on SSL crypted connection the RELATED could 
not work right. Because for FTP there is an extra module that analyse the
control traffic and can so evalute what ports are related. But this is 
not posible then the traffic is unreadable for the module.

Cu Thomas