FTP协议对防火墙安全性的挑战

5. What about Secure FTP

The document defines Security Extensions to the FTP protocol. These extensions provide strong authentication, integrity, and confidentiality on both the control and data channels with the introduction of new optional commands, replies, and file transfer encodings.

A widely implemented security extension to the FTP protocol is the use of the SSL (Secure Sockets Layer) version 3.0 or TLS (Transport Layer Security) version 1.0 protocol. It is documented in the Internet-Draft Securing FTP with TLS. The SSL/TLS protocol runs above the transport layer (TCP/IP), but below the application layer protocol. Therefore, it is relativily easy to implement for securing all sort of application protocols such as HTTP, Telnet, POP3, IMAP4, SMTP and FTP. 

In actual FTP client and server implementations there exists at least two distinct mechanisms by which the SSL security extension is initiated: explicit (active) and implicit (passive) security:

• Explicit Security: In order to establish the SSL link, explicit security requires that the FTP client issues a specific command to the FTP server after establishing a connection. The default FTP server port is used. This formal method is documented in RFC 2228.
• Implicit Security: Implicit security automatically begins with an SSL connection as soon as the FTP client connects to an FTP server. In implicit security, the FTP server defines a specific port for the client (TCP Port 990) to be used for secure connections.
  Note: Implicit SSL is discussed in various SSL drafts but is not formally adopted in an RFC. For strict compliance to standards, use the explicit method.

You can think of implicit security as "always on" and explicit security as "turn on". The following nice drawing, taken from the GlobalScape Inc. website,  contrasts implicit and explicit SSL connections:

When using FTP over SSL/TLS, in short FTPS, the control connection is encrypted and therefore unreadable for entities other than the FTP client and the FTP server. As a consequence, NAT/PAT devices and firewalls can no longer monitor the negotiation of the data connection and do smart things with that information. This places some serious limitations on the practical use of the FTPS protocol through all sort of firewalls and Network Address Translators.

Note: a good discussion about some of the issues with running FTP, secured with SSL/TLS, through firewalls can be found in the Internet-Draft . Keep in mind that an Internet-Draft is "work in progress".

It must be clear that the FTP Application Filter on the ISA server cannot help you in this situation. Therefore, you will have a hard time to support FTPS through ISA for SecureNAT clients. In fact, a lot of firewalls will have a problem to support in a secure way fully the FTPS protocol (PORT and PASV mode). However, with the ISA server you should be able to fully support FTPS if the Firewall client is installed on the client machine. In that case you must follow the configuration steps outlined for FTP client access to an FTP server on an alternate port number and for server publishing an FTP server on an alternate port number.

For FTPS client access, the custom FTP protocol definition I refer to (see section 4.3. Firewall client) should be slightly adopted. For the mode Implicit Security the primary connection should be TCP port 990 Outbound. If you have to support also the mode Explicit Security then some more work has to be done. Because Explicit Security uses the standard FTP Control port TCP port 21, you need to first disable the FTP Application Filter. Otherwise, the FTP Application Filter would interfere with the FTPS Control connection. Next, in the custom FTP protocol definition use as primary connection TCP port 21 Outbound. As a consequence, SecureNAT clients will no longer be able to access FTP servers.

6 Conclusion

The FTP protocol is a somewhat messy protocol that definitely wasn’t designed with firewall security in mind. FTP clients can use one of the two modes: PORT and PASV mode. While PORT mode has been around for a longer time, PASV mode is more popular because it doesn’t require a new inbound connection to be made to the FTP client from the FTP server. Modern firewalls and NAT devices have components that are able to handle the connection request details contained in the PORT and PASV commands to improve on the security issues related to the FTP protocol.

I hope you enjoyed this article and found something in it that you can apply to your own network. If you have any questions on anything I discussed in this article, head on over to and post a message. I’ll be informed of your post and will answer your questions ASAP. Thanks!  – Stefaan.

翻译：

5 关于Secure FTP
文档 RFC2228中定义了FTP协议的安全性扩展。这些扩展同时在数据通道和控制通道对认证，完整性，和机密性都有所加强。该文还介绍了新增的命令、应答和文件传输的加解码。一个广泛使用的加强FTP协议的安全性的方法是使用3.0版的SSL（安全套接层）或者1.0版的TLS（传输层加密）协议。这在Internet-Draft Securing FTP with TLS 中有详细描述。SSL/TLS协议在传输层（TCP/IP）之上、但是在应用层之下工作的。因此，它可以很容易在诸如HTTP，Telnet，POP3，IMAP4，SMTP和FTP等应用层协议上实现。在实际的FTP客户端和服务器的应用中，SSL安全扩展至少有两种不同的初始化方法：显式安全（端口模式）和隐式安全（被动模式）。

· 显示安全:为了建立SSL连接，显式安全要求FTP客户端在和FTP服务器建立连接后发送一个特定的命令给FTP服务器。客户端使用服务器的缺省端口。具体实现方法详见RFC 2228文档。
· 隐式安全: 当FTP客户端连接到FTP服务器时，隐式安全将会自动和SSL连接一起开始运行。在隐式安全中服务器定义了一个特定的端口（TCP端口990）让客户端来和其建立安全连接。
注: 隐式安全在很多SSL草案中都有讨论，但是没有被RFC正式采纳。为了依从标准，请使用显式安全。
可以认为隐式安全总是“始终打开”的，而显式安全是要被“打开”（才能使用）的。下面是GlobalScape 公司（著名的CuteFTP FTP客户端软件）站点上的一个很好图示，说明了显式和隐式安全SSL连接的区别：

当通过SSL/TLS来使用FTP时（缩写为FTPS），FTP客户端和FTP服务器之间的控制连接就被加密了，因此除了它们之外谁也不能读懂（它们之间的控制连接的信息）。正式因为这样，NAT/PAT设备和防火墙再也不能监控控制连接（原文是数据连接，而实际上应该是控制连接――译者注）（并且从中得到有用的信息）从而再（有针对性地）做一些事情了。（所以）FTPS协议在所有种类的防火墙和网络地址转换（环境下）的实际应用受到严重的限制。
注:在 FTP/TLS Friendly Firewalls一文可以找到关于在防火墙上环境下运行使用SSL/TLS的安全FTP的很好的讨论。但是请注意Internet-Draft 仅仅是 “正在制定中”（尚未正式发布）。
必须清楚的是ISA Server的FTP应用层过滤器（同样也）不能帮助你解决这种情况（问题）。因此，ISA Server是几乎不可能支持在SecureNAT客户端上运行的FTPS协议的。实际上，许多防火墙在完全支持安全的FTPS协议（端口模式和被动模式）时都是有问题的。但是，在ISA Server下你（也）完全可以支持FTPS，（条件是）你在客户端上安装了防火墙客户端（软件）。在这种情况下，你必须按照要点的步骤来配置，以让FTP客户端（可以）访问（发布在）非常规端口上的FTP服务器或者将FTP服务器发布到非常规端口上。
对于（客户端的）FTPS访问，应该继续采用我前面提到到自定义FTP协议规则（参见4.3节，防火墙客户端）。对于隐式安全模式，第一连接应该是对TCP端口990的向外访问。如果你也必须同时支持显式安全，那么还要做一些额外的事情。因为显式安全使用标准的TCP 21号控制端口，所以你必须将FTP应用过滤器禁用。否则，FTP应用过滤器会干扰FTP的控制连接。接下来，在自定义FTP规则中让第一连接向外访问21号端口。因而，SecureNAT客户再也不能访问FTP服务器了。
6. 结束语
FTP协议是一个显得稍微有点凌乱的协议，并且没有任何为（应用于）防火墙（环境中）的（特别）设计。FTP客户端可以使用两种模式中的一种：端口模式和被动模式。端口模式已经存在很长时间了，但是被动模式更加流行，因为其不需要FTP服务器主动向内访问从而和FTP客户端建立（第二）连接。现在的防火墙和NAT设备可以在（第一连接中，即控制连接中的）PORT和PASV命令中得到FTP连接的详细信息来支持客户端的FTP请求（和会话），从而增强了FTP协议的安全性。

我希望你能够对我的这篇文章满意并且能够从中得到一些你可以在你自己网络中使用的东西。如果你对我们的讨论有什么疑问，请在查看并发布消息。你的回复我会收到通知并且我会尽快回复。谢谢！－Stefaan。