|
|
On Mon, 6 Jul 2009 07:39:39 -0700, "Alun Jones" <...@texis.invalid
"DoubleJava" <...@microsoft.com...
I'm going to answer based on my experiences when working with the RFC
drafter to help define and solidify the RFC for FTP over SSL, while writing
WFTPD Pro's FTP over SSL support.
Don't use Implicit SSL (i.e. connecting to port 990) - use Explicit SSL,
where the client specifically sends an "AUTH TLS" command. This should
connect to port 21, and start in unencrypted traffic. Implicit SSL was
deprecated before the RFC was even published, so you should not rely on it,
as its use and availability across multiple servers and clients is expected
to decline.
Your problem with Active versus Passive connectivity is explained by your
firewall configuration.
The terms "Active" and "Passive" refer to how the FTP server connects.
In Active mode, the FTP server connects to the client, on a random port
chosen by the client. Obviously, that will work if the client's firewall is
configured to allow the connection to that port, and doesn't depend on the
firewall at the server to do anything but allow connections outbound.
In Passive mode, the FTP client connects to the server, on a random port
chosen by the server. This requires the server's firewall to allow the
incoming connection, and depends on the client's firewall only to allow
outbound connections.
The trick for passive mode configuration is to tell your FTP server to
choose its random ports from a particular range, and then to open up that
range of ports in your server's firewall.
One sneaky trick that you can use with WFTPD and WFTPD Pro (and which may
work with IIS FTP) is to configure the client to use "Block" mode instead of
"Stream" mode - in that mode, it can use the default data port and not close
that port. This removes the need to open ports in the firewall. The downside
is that, although Block mode has been in the FTP RFC for decades, there are
few clients that actively support it. In the FTP over SSL case, however,
Block mode overcomes a large number of problems with data connections.
Alun.
~~~~
--
Texas Imperial Software | Web: http://www.wftpd.com/
23921 57th Ave SE | Blog: http://msmvps.com/alunj/
Woodinville WA 98072-8661 | WFTPD, WFTPD Pro are Windows FTP servers.
Fax/Voice +1(206)428-1991
|