FTP passive mode is a popular alternative to FTP active mode that
many engineers find more intuitive to deploy.
This module covers passive mode operations in depth.
Passive FTP is more commonly deployed than active FTP,
but is still not well understood by many.
In the previous module, we learned about some flaws with active mode,
and I'll briefly summarize those findings up front.
I'll quickly explain how passive mode operates and how it is different
from active mode without rehashing all of the FTP basics.
You shouldn't trust me until I prove it,
so I'll demonstrate some file transfers across the network.
The results of these demonstrations will constitute
the following packet deep dive.
Again, I'll focus on the passive mode versus active mode differences.
Securing passive FTP from a network perspective is a bit easier,
but still has its challenges.
We will retool our firewall to accommodate our passive FTP design.
To wrap up, I will compare the two modes of FTP side by side.
This will help solidify your understanding of these first two modules.
I want to briefly recap the main security challenge with FTP active mode.
In most flavors of FTP,
the client initiates a TCP session towards the server
using a destination port of 21.
Permitting this through a firewall from inside to outside is
relatively low risk and easy to quantify.
There are, after all, a relatively small number of FTP servers in the network,
so adding permissible IP addresses to the rule is also simple.
Inside this signaling channel,
the client tells the server what ephemeral port to use,
which could be one of more than 64, 000 values.
Few security administrators are excited about opening so
many ports from outside to inside.
While the firewall can, and should, match a source port of 20,
attackers could just source their attacks from port 20 to easily bypass it.
In almost all cases, these inbound FTP data sessions are denied by firewalls,
both in the network and on the client host operating system.
The million-dollar question is whether we can find a way to
prevent these outside-to-inside connections.
These are challenging to secure,
and it would be convenient if the client could initiate the FTP data session somehow.