4

In VSFTPD, the default for pasv_promiscuous is "NO", and the man page indicates:

Only enable if you know what you are doing! The only legitimate use for this is in some form of secure tunnelling scheme, or perhaps to facilitate FXP support.

Although we have never had a problem with this, we now have a customer who apparently needs to have this set to "YES" so they can connect through their proxy. I see numerous recommendations on the web to setting it to YES to fix the problem that we're having, but I can't find any details about what the real risk of this setting is.

I've been trying to figure out what this is guarding against, and the best I can come up with is that it's protecting against someone trying to hijack the connection after signon and before opening the data connection. It seems (although I'm not sure) that an attacker would have to know the ports used for the passive connection and repeatedly attempt to access those ports in hope for catching one open at the right moment, but maybe it's easier than that? Assuming such an attack is successful, what does that give the attacker? I presume simply whatever access the hijacked user session had.

Does anybody have a good explanation of what is the realistic security risk of pasv_promiscuous=YES?

4

When an FTP transfer starts in a passive mode (the most common mode nowadays), the FTP starts listening on a random port. The client connects to that port and starts sending/receiving the transferred file.

If the pasv_promiscuous is off (the default), the vsftpd server checks that the client (IP address), which is connecting to the transfer port is the same, as the client connected to the FTP control connection (which requested the transfer).

When the pasv_promiscuous is on, no check is done. So if a potential attacker guesses the random port number (which may not be random, but incremental, hence easy to guess), he/she can connect to the transfer port before a legitimate client does and steal the data (in case of a download) or sneak in his/her own data (in case of an upload).

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.