Forwarding FTP
FTP forwarding is an extension to the generic port forwarding mechanism.
The FTP control channel can be secured by using generic port forwarding,
but since the FTP protocol requires creating separate TCP connections
for the files to be transferred, all the files would be transferred
unencrypted when using generic port forwarding, as these separate TCP
connections would not be forwarded automatically.
To protect also the transferred files, use FTP forwarding instead. It
works similarly to generic port forwarding, except that the FTP
forwarding code monitors the forwarded FTP control channel and
dynamically creates new port forwardings for the data channels as they
are requested.
TCP port 21 is the port the client uses to establish a connection with
the remote server for an FTP session. The TCP port locally assigned to
the client is always going to be different since it is only used as a
method to ensure the FTP server traffic is sent back to the appropriate
machine.
This is important in situations where multiple users may be using FTP to
transfer files to the same server. If the users' machines are sitting
behind a NAT device such as a firewall, all packets coming to the server
will look as though they are from the same machine. The dynamic port
numbers assigned to each client enable the firewall to route the return
packets to the correct user.
To see exactly how this dynamically created port forwarding is done, two
different cases need to be examined: the active mode and the passive
mode of the FTP protocol.
FTP in Passive Mode
In passive mode, the FTP client sends the command PASV to the
server, which reacts by opening a listener port for the data channel and
sending the IP address and port number of the listener as a reply to the
client. The reply is of the format 227 Entering Passive Mode (10,1,60,99,6,12).
When the Secure Shell client notices the reply to the PASV
command, it creates a local port forwarding to the destination mentioned
in the reply. After this, the client rewrites the IP address and port in
the reply to point to the listener of the newly created local port
forwarding (which exists always in a localhost address, 127.0.0.1) and
passes the reply to the FTP client. The FTP client opens a data channel
based on the reply, effectively tunneling the data through the SSH
connection, to the listener that the FTP server has opened. The net
effect is that the data channel is secure all the way except from the
Secure Shell server to the FTP server, if they are on different
machines. This sequence of events takes place automatically for every
data channel.
Since port forwarding is opened to a localhost address, the FTP
client must be run on the same machine as the Secure Shell client if
passive mode is used.
FTP in Active Mode
In active mode, the FTP client creates a listener on a local port for a
data channel from the FTP server to the FTP client, and requests the
channel by sending the IP address and the port number to the FTP server
in a command of the following format: PORT 10,1,60,99,6,12. The
Secure Shell client intercepts this command and creates a remote port
forwarding from the Secure Shell server localhost address to
the address and port specified in the PORT command.
After creating the port forwarding, the Secure Shell client rewrites the
address and port in the PORT command to point to the newly
opened remote forwarding on the Secure Shell server and sends it to the
FTP server. Now the FTP server opens a data channel to the address and
port in the PORT command, effectively forwarding the data
through the SSH connection. The Secure Shell client passes the incoming
data to the original listener created by the FTP client. The net effect
is that the data channel is secure the whole way except from the Secure
Shell client to the FTP client. This sequence of events takes place
automatically for every data channel.
Since port forwarding is made to a localhost address on the
Secure Shell client machine, the FTP client must be run on the same host
as the Secure Shell client if passive mode is used.
Where end-to-end encryption of FTP data channels is desired, the FTP
server and Secure Shell server need to reside on the same host, and the
FTP client and the Secure Shell client will likewise need to reside on
the same host. If this is the case, both active or passive mode can be
used.
Note: Consider using sftp2 or scp2 (see SCP2 Syntax) instead of FTP forwarding to secure file
transfers. It will require less configuration than FTP forwarding, since
the server already has sftp-server2 as a subsystem, and
sftp2 and scp2 clients are included in the
distribution.
