Let's see how well we can secure active mode FTP from a network perspective.
I've written two simple access lists applied to R3,
our stateless firewall device, to provide some basic security.
The first access list is applied inbound on R3,
facing R1, effectively facing the client.
I'm permitting two kinds of traffic.
The first rule matches all of my FTP clients connected to R1,
and there would likely be many.
The rule allows these hosts to communicate using FTP,
which is TCP port 21, specifically to the host 10.2 .5 .5,
which is the FTP server.
We don't try to match the source port here, as it is random.
The second rule is almost identical,
except matches a destination port of FTP data,
which is port 20.
Remember that when the server initiates traffic to the client,
it does so sourced from port 20 so the client-to-server
replies would be destined to port 20.
The second access list is applied inbound on R3 facing R2,
this time facing the FTP server.
It's basically the same rule set from the first ACL,
except with some fields reversed.
The source ports are ftp, which is TCP port 21,
and ftp-data,
which is TCP port 20 with no matching done against destination ports.
The inside in ACL is reasonably secure,
since only outbound FTP and FTP data are allowed.
But the outside in ACL is Swiss cheese.
So long as the attacker sources her traffic from port 20 or 21,
that can blast right through.
Even in a stateful firewall, at a minimum,
the FTP data exception would be needed, providing a perfect attack avenue.
We'll explore how to help close this gap in future clips.
Let's see if the ACLs actually work.
I wrote a security-specific LFTP script to help speed up testing.
Notice that I have disabled debugging since we only
care if the transfer works or not.
I'm performing both a download and upload as well.
Time to run the script.
We get no output, which is actually good news.
Let's check our firewall next.
We should see several matches on our permit entries
and no matches on our deny entries.
This looks good.
Both ACLs are showing ftp and ftp-data matches with no log
messages or hits on the deny statements.
I wanted to use the security-oriented demos to give you some
basic access list rules as a starting point for your real-life security policy designs.